! Check Security Level
ASA# show nameif
Interface Name Security
GigabitEthernet0 ouside 0
GigabitEthernet1 inside 100
GigabitEthernet2 dmz 50
ASA# show ip
System IP Addresses:
Interface Name IP address Subnet mask Method
GigabitEthernet0 ouside 192.168.0.254 255.255.255.0 manual
GigabitEthernet1 inside 10.0.0.254 255.255.255.0 manual
GigabitEthernet2 dmz 20.0.0.254 255.255.255.0 manual
! Check Telnet Access From inside to outside and from inside to dmz.
R1#tel 192.168.0.3
Trying 192.168.0.3 ... Open ! (Permited)
R3>exit
R1#tel 20.0.0.2
Trying 20.0.0.2 ... Open ! (Permited)
R2>exit
! ASA Logs
ASA(config)# logging on
%ASA-6-302013: Built outbound TCP connection 105 for ouside:192.168.0.3/23 (192.168.0.3/23) to inside:10.0.0.1/49351 (10.0.0.1/49351)
%ASA-6-302014: Teardown TCP connection 105 for ouside:192.168.0.3/23 to inside:10.0.0.1/49351 duration 0:00:15 bytes 77 TCP FINs
%ASA-6-302013: Built outbound TCP connection 106 for dmz:20.0.0.2/23 (20.0.0.2/23) to inside:10.0.0.1/56955 (10.0.0.1/56955)
%ASA-6-302014: Teardown TCP connection 106 for dmz:20.0.0.2/23 to inside:10.0.0.1/56955 duration 0:00:03 bytes 71 TCP FINs
! If We need deny trafic From Inside to DMZ, we have to configure Access-Lists
ASA(config)# access-list INSIDE_IN deny ip 10.0.0.0 255.255.255.0 20.0.0.0 255.255.255.0
ASA(config)# access-list INSIDE_IN permit ip any any
ASA(config)# access-group INSIDE_IN in interface inside
! Check Again Telnet Access From inside to outside and from inside to dmz.
R1#tel 192.168.0.3
Trying 192.168.0.3 ... Open ! (Permited)
R3>exit
R1#tel 20.0.0.2
Trying 20.0.0.2 ... ! (Droped)
% Connection refused by remote host
! ASA Logs
%ASA-6-302013: Built outbound TCP connection 107 for ouside:192.168.0.3/23 (192.168.0.3/23) to inside:10.0.0.1/62840 (10.0.0.1/62840) ! (Permit trafic from inside to outside)
%ASA-6-302014: Teardown TCP connection 107 for ouside:192.168.0.3/23 to inside:10.0.0.1/62840 duration 0:00:05 bytes 71 TCP FINs ! (Permit trafic from inside to outside)
%ASA-4-106023: Deny tcp src inside:10.0.0.1/34138 dst dmz:20.0.0.2/23 by access-group "INSIDE_IN" [0x71cd432c, 0x0] ! (Deny trafic from inside to dmz)
! Check this connection with Packet-tracer command
ASA(config)# packet-tracer input inside icmp 10.0.0.1 8 0 20.0.0.2
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 20.0.0.0 255.255.255.0 dmz
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: DROP
Config:
access-group INSIDE_IN in interface inside
access-list INSIDE_IN extended deny ip 10.0.0.0 255.255.255.0 20.0.0.0 255.255.255.0 <---- Access-list INSIDE_IN
Additional Information:
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: dmz
output-status: up
output-line-status: up
Action: drop <---- DROP
Drop-reason: (acl-drop) Flow is denied by configured rule <---- Reason
In the Zone, with IOS Zone Based Firewalls:
Stateful and Application Layer Filtering Services
ZBF Ingredients:
- Zones
- Inspect Class Maps
- Inspect Policy Maps
- Zone-Pairs
- Inspect Service Policy
Application Layer Options:
- APP inspect Class Maps
- APP inspect Policy Maps
! Create 3 Security Zones
R1#configure terminal
R1(config)#zone security IN
R1(config-sec-zone)#exit
R1(config)#zone security OUT
R1(config-sec-zone)#exit
R1(config)#zone security DMZ
R1(config-sec-zone)#exit
! Configure Interface modes
R1(config)#interface gig 1/0
R1(config-if)#zone-member security OUT
R1(config-if)#exit
R1(config)#interface gig 2/0
R1(config-if)#zone-member security IN
R1(config-if)#exit
R1(config)#interface gig 3/0
R1(config-if)#zone-member security DMZ
R1(config-if)#exit
! Verify the configuration
R1# show zone security
! Note: No Traffic is allowed by default.
! IN-OUT Traffic
! Create ACL and Inspect Class Map
R1(config)#ip access-list extended IN-OUT-ACL
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#class-map type inspect match-all IN-OUT-CLASS
R1(config-cmap)#match access-group name IN-OUT-ACL
R1(config-cmap)#exit
! Verify the configuration
R1# show class-map type inspect
! Create Inspect Policy Maps
R1(config)#policy-map type inspect IN-OUT-POLICY
R1(config-pmap)#class type inspect IN-OUT-CLASS
R1(config-pmap-c)#inspect
R1(config-pmap-c)#exit
R1(config-pmap)#exit
! Verify the configuration
R1# show policy-map type inspect
! Create Zone Pairs
R1(config)#zone-pair security IN-OUT-ZP source IN dest OUT
R1(config-sec-zone-pair)#service-policy type inspect IN-OUT-POLICY
R1(config-sec-zone-pair)#exit
! Verify the configuration
R1# show zone-pair security
R1# show policy-map type inspect zone-pair
R1# show policy-map type inspect zone-pair sessions
! OUT-DMZ Traffic
! Create Inspect Class Map
R1(config)#class-map type inspect match-any WEB-CLASS
R1(config-cmap)#match protocol http
R1(config-cmap)#exit
! Verify the configuration
R1# show class-map type inspect
! Create Inspect Policy Maps
R1(config)#policy-map type inspect WEB-POLICY
R1(config-pmap)#class type inspect WEB-CLASS
R1(config-pmap-c)#inspect
R1(config-pmap-c)#exit
R1(config-pmap)#exit
! Verify the configuration
R1# show policy-map type inspect
! Create Zone Pairs
R1(config)#zone-pair security OUT-DMZ-ZP source OUT dest DMZ
R1(config-sec-zone-pair)#service-policy type inspect WEB-POLICY
R1(config-sec-zone-pair)#exit
! Verify the configuration
R1# show zone-pair security
R1# show policy-map type inspect zone-pair
R1# show policy-map type inspect zone-pair sessions
! #Create Application Layer Security
! Create Class Map
R1(config)#class-map type inspect http match-any BAD-HTTP-CLASS
R1(config-cmap)#match request uri regex COM
R1(config-cmap)#match req-resp protocol-violation
R1(config-cmap)#exit
! Verify the configuration
R1# show class-map type inspect http
! Create Policy Map
R1(config)#policy-map type inspect http BAD-HTTP-POLICY
R1(config-pmap)#class type inspect http BAD-HTTP-CLASS
R1(config-pmap-c)#log
R1(config-pmap-c)#reset
R1(config-pmap-c)#exit
R1(config-pmap)#exit
! Verify the configuration
R1# show policy-map type inspect http
! Tag it on
R1(config)#policy-map type inspect WEB-POLICY
R1(config-pmap)#class type inspect WEB-CLASS
R1(config-pmap-c)#inspect
R1(config-pmap-c)#service-policy http BAD-HTTP-POLICY
R1(config-pmap-c)#exit
R1(config-pmap)#exit
