Home > Articles > Cisco > CCNP Security

📄 Contents

  1. Primer
  2. IOS Zone Based Firewall Configuration
  3. Summary
  • Print
  • + Share This
From the author of IOS Zone Based Firewall Configuration

IOS Zone Based Firewall Configuration

There are a number of different protocols which are supported with AIC; these are shown in following list:

  • America Online (AOL) Instant Messenger
  • eDonkey P2P protocol
  • FastTrack traffic P2P protocol
  • Gnutella Version 2 traffic P2P protocol
  • H.323 VoIP Protocol version 4
  • Hypertext Transfer Protocol (HTTP) (URL Filtering and HTTP inspection)
  • Internet Message Access Protocol (IMAP)
  • I Seek You (ICQ) IM protocol
  • Kazaa Version 2 P2P protocol
  • MSN Messenger IM protocol
  • Post Office Protocol version 3 (POP3)
  • Session Initiation Protocol (SIP)
  • Simple Mail Transfer Protocol (SMTP)
  • Sun RPC (SUNRPC)
  • Windows Messenger IM protocol
  • Yahoo IM protocol

As the coverage of each specific one of these options would make this article into a book, this article will be limited to the HTTP inspection configuration options. However, know that capabilities similar to those shown are available for each of the protocols shown in the above list.

The HTTP inspection option provides the ability to match traffic based not only on the fact that it is using port 80 or 443 (or others using Port to Application (PAM) matching) but also based on much more specific criteria inside HTTP. These matching criteria include:

  • Whether the HTTP traffic is compliant
  • HTTP body length
  • HTTP content type
  • HTTP encoding method
  • URI or argument length
  • HTTP request method
  • HTTP port misuse (For example, p2p or chat protocols)
  • URI or argument matching expressions (Using Regex)

The steps to configure a layer 5-7 class-map are very similar to those used for the layer 3/4 class-map. The main difference is the addition of an extra keyword (in this case http). The example syntax of this for HTTP inspection is shown below:

router(config)#class-map type inspect http [match-any | match-all] class-map-name

The large portion of what makes the layer 5-7 class-maps different is the match options. As shown above, there are a number of different deeper HTTP packet options that can be used to match with. The following commands can be used to match; these are listed in order listed above.

router(config-cmap)#match req-resp protocol violation
router(config-cmap)#match req-resp body length {lt | gt} {bytes}
router(config-cmap)#match req-resp header content-type { violation | mismatch | unknown}
router(config-cmap)#match req-resp header transfer-encoding {chunked | compress |
 deflate | gzip | identity | all}
router(config-cmap)#match request {uri | arg} length gt bytes
router(config-cmap)#match request method {connect | copy | delete | edit |
 get | getattribute | getattributenames | getproperties | head | index | lock |
 mkdir | move | options | post | put | revadd | revlabel | revlog | revnum |
 save | setattribute | startrev | stoprev | trace | unedit | unlock}
router(config-cmap)#match request port-misuse {im | p2p | tunneling | any}
router(config-cmap)#match request {not} {uri | arg} regex parameter-map-name

As with the class-map shown above, the difference between layer 3/4 and layer 5-7 policy-maps is a single keyword (again http). The example syntax of this for HTTP inspection is shown below:

router(config)#policy-map type inspect http policy-map-name

The policy-map actions are also very similar; the following are the supported layer 5-7 policy actions:

  • Allow—Permits the matched traffic
  • Log—Logs the matched traffic
  • Reset—Resets the connection of the matched traffic

The following commands would be used to match based on a configured class-map and assign a policy action:

router(config-pmap)#class type inspect http class-map-name
router(config-pmap-c)#allow
router(config-pmap-c)#log
router(config-pmap-c)#reset

The application of a layer 5-7 policy-map is where there is a major difference in implementation from a layer 3/4 policy. A layer 5-7 policy-map is not applied to a specific zone-pair but to an existing layer 3/4 policy-map. This is done by nesting inside a layer 3/4 policy-map. The example syntax for this is shown below:

router(config-pmap-c)#service-policy http policy-map-name

Because the concept of nesting different policies can be rather confusing, and in order to wrap the material presented here, the following example is presented. This example is based on a simple topology shown in Figure 1. This policy inspects all HTTP traffic going from the private to the public zones and resets the connection of any non-compliant HTTP traffic.

Figure 1 Advanced Zone Configuration Example

  1. Configure the 5-7 class-map:
  2. router(config)#class-map type inspect http AIC-sample-class
    router(config-cmap)match req-resp protocol violation
  3. Configure the 5-7 policy-map:
  4. router(config)#policy-map type inspect http AIC-sample-policy
    router(config-pmap)#class type inspect http AIC-sample-class
    router(config-pmap-c)#reset
  5. Configure the 3/4 class-map:
  6. router(config)#class-map type inspect sample-class
    router(config-cmap)#match protocol http
  7. Configure the 3/4 policy-map:
  8. router(config)#policy-map type inspect sample-policy
    router(config-pmap)#class type inspect sample-class
    router(config-pmap-c)#inspect
    router(config-pmap-c)#service-policy http AIC-sample-policy
  9. Configure the zones:
  10. router(config)# zone security Public
    router(config)# zone security Private
  11. Configure the zone-pairs:
  12. router(config)# zone-pair security private-pubic-pair source Private destination Public
    router(config-sec-zone-pair)# service-policy type inspect sample-policy
  13. Assign a zone onto the interface:
  14. router(config)#interface F0/0
    router(config-if)#zone-member security Private
    router(config)#interface F0/1
    router(config-if)#zone-member security Public
  • + Share This
  • 🔖 Save To Your Account