Access Control Lists
In my last blog post, I covered Access Control Lists or ACLs which were being used on two multi-layer switches separating building b to the backbone of the network. I was having issues with limiting return traffic for ICMP requests sourced from the management network, as well as limiting what reponse was given if a computer which was not allowed to ping a remote network. The following ACL was configured on the student VLAN of building b:
#BBS1
ip access-list extended BLK_STUDENTS
#allow DHCP/BOOTP packets in and out of VLAN interface
permit udp any eq bootpc any eq bootps
#allow HSRP packets from BBS2
permit udp host 10.3.255.253 eq 1985 host 224.0.0.102 eq 1985
#allow connections from the management network
permit ip 10.0.3.128 0.0.0.127 any
#allow echo-reply messages to reach management devices.
permit icmp 10.3.0.0 0.0.255.255 10.0.3.128 0.0.0.127 echo-reply
#prevent anything not specifically allowed, blackhole entry
deny ip any any
#BBS2
ip access-list extended BLK_STUDENTS
!allow DHCP/BOOTP packets in and out of VLAN interface
permit udp any eq bootpc any eq bootps
!
!allow HSRP packets from BBS1
permit udp host 10.3.255.252 eq 1985 host 224.0.0.102 eq 1985
!
!allow connections from the management network
permit ip 10.0.3.128 0.0.0.127 any
!
!allow echo-reply messages to reach management devices.
permit icmp 10.3.0.0 0.0.255.255 any echo-reply
!
!prevent anything not specifically allowed, blackhole entry
deny ip any any
However, when a host on the students network tried to ping a device outside of its network, it would return the "destination unreachable" message. From a host perspective, this message implies that the destination 'exists' but is not reachable which could lead to malicious users learning about networks that exist further than their LANs. In order to prevent network snooping from users, the command "no ip unreachables" was configured on the VLAN interfaces. Here is a sample configuration of the Students VLAN interface (10):
#BBS1
interface Vlan10
description STUDENTS-B
ip address 10.3.255.252 255.255.0.0
!ip access-group BLK_STUDENTS in
ip helper-address 10.0.2.22
no ip unreachables
standby version 2
standby 10 ip 10.3.255.254
standby 10 preempt
#BBS2
interface Vlan10
description STUDENTS-B
ip address 10.3.255.253 255.255.0.0
ip access-group BLK_STUDENTS in
ip helper-address 10.0.2.22
no ip unreachables
standby version 2
standby 10 ip 10.3.255.254
standby 10 preempt
A similar configuration was configured on each VLAN interface across Building A and B devices, specifically the multi-layer switches which separated each access network to the network backbone.
Zone Based Policy Firewalls
Instead of configuring ACLs on the routers exiting the network, Zone Based Policy Firewalls or ZBFs were configured on CENR1 and CENR2. The great thing with ZBFs is that you can mark an interface in a certain security zone using the "zone security {zone}" command. I have used two zones, 'Local' and 'ISP' as the routers are using two interfaces each, a FastEthernet 10/100 interface and a Serial interface. The FastEthernet interface is connected to the backbone network via Fa0/24 on CENS1 and CENS2 respectively, whereas the Serial interface is connected to the 'ISP' via S0/0/0 and S0/0/1 on 'ISP' respectively.
#CENR1 #CENR2
zone security Local
zone security ISP
#CENR1 #CENR2
zone security Local
zone security ISP
After the zones are configured, zone pairs are configured using the "zone-pair security {name} source {src-zone} destination {dest-zone}" which defines a pairing of zones.
#CENR1 #CENR2
zone-pair security Local->ISP source Local destination ISP
#CENR1 #CENR2
zone-pair security Local->ISP source Local destination ISP
Next comes the creation of class maps. Class maps allows traffic to be marked for use with ZBF. In my case, I have configured an inspection class map using the "class-map type inspect match-any" configuration to inspect any HTTP, HTTPS and DNS traffic.
#CENR1 #CENR2
class-map type inspect match-any basic-web
! match traffic using the protocol HTTP (TCP 80)
match protocol http
! match traffic using the protocol HTTPS (TCP 8080)
match protocol https
! match traffic using the protocol DNS (TCP/UDP 53)
match protocol dns
Following this, a policy map is created in order to pair actions with inspected traffic. In the case of this network, traffic exiting to the ISP is inspected using the class-map "basic-web" configured earlier. Any other classes that haven't been explicitly configured are dropped.
#CENR1 #CENR2
policy-map type inspect Local_to_ISP
class type inspect basic-web
inspect
class class-default
drop
Now a service policy must be configured on the zone pairs by using the command "service-policy type inspect" under the zone pair sub configuration.
#CENR1 #CENR2
zone-pair security Local->ISP
service-policy type inspect Local_to_ISP
And then to finalize, the interfaces are configured as zone members using the interface subcommand "zone-member security".
#CENR1
interface fastethernet0/1
zone-member security Local
!
interface serial0/0/1
zone-member security ISP
#CENR2
interface fastethernet0/1
zone-member security Local
!
interface serial0/0/0
zone-member security ISP
The final configuration for the zone-based policy firewall is as follows:
#CENR1
hostname CENR1
!
! zone based policy firewall configuration
! configuring security zones
zone security Local
zone security ISP
!
! configuring zone pairs
zone-pair security Local->ISP source Local destination ISP
!
!creating an inspection class map
class-map type inspect match-any basic-web
! match traffic using the protocol HTTP (TCP 80)
match protocol http
! match traffic using the protocol HTTPS (TCP 8080)
match protocol https
! match traffic using the protocol DNS (TCP/UDP 53)
match protocol dns
!
! creating inspection policy map
policy-map type inspect Local_to_ISP
class type inspect basic-web
inspect
class class-default
drop
!
zone-pair security Local->ISP
service-policy type inspect Local_to_ISP
!
interface fastethernet0/1
zone-member security Local
!
interface serial0/0/1
zone-member security ISP
#CENR2
hostname CENR2
!
! zone based policy firewall configuration
! configuring security zones
zone security Local
zone security ISP
!
! configuring zone pairs
zone-pair security Local->ISP source Local destination ISP
!
!creating an inspection class map
class-map type inspect match-any basic-web
! match traffic using the protocol HTTP (TCP 80)
match protocol http
! match traffic using the protocol HTTPS (TCP 8080)
match protocol https
! match traffic using the protocol DNS (TCP/UDP 53)
match protocol dns
!
! creating inspection policy map
policy-map type inspect Local_to_ISP
class type inspect basic-web
inspect
class class-default
drop
!
zone-pair security Local->ISP
service-policy type inspect Local_to_ISP
!
interface fastethernet0/1
zone-member security Local
!
interface serial0/0/0
zone-member security ISP
#CENR1 #CENR2
class-map type inspect match-any basic-web
! match traffic using the protocol HTTP (TCP 80)
match protocol http
! match traffic using the protocol HTTPS (TCP 8080)
match protocol https
! match traffic using the protocol DNS (TCP/UDP 53)
match protocol dns
Following this, a policy map is created in order to pair actions with inspected traffic. In the case of this network, traffic exiting to the ISP is inspected using the class-map "basic-web" configured earlier. Any other classes that haven't been explicitly configured are dropped.
#CENR1 #CENR2
policy-map type inspect Local_to_ISP
class type inspect basic-web
inspect
class class-default
drop
Now a service policy must be configured on the zone pairs by using the command "service-policy type inspect" under the zone pair sub configuration.
#CENR1 #CENR2
zone-pair security Local->ISP
service-policy type inspect Local_to_ISP
And then to finalize, the interfaces are configured as zone members using the interface subcommand "zone-member security".
#CENR1
interface fastethernet0/1
zone-member security Local
!
interface serial0/0/1
zone-member security ISP
#CENR2
interface fastethernet0/1
zone-member security Local
!
interface serial0/0/0
zone-member security ISP
The final configuration for the zone-based policy firewall is as follows:
#CENR1
hostname CENR1
!
! zone based policy firewall configuration
! configuring security zones
zone security Local
zone security ISP
!
! configuring zone pairs
zone-pair security Local->ISP source Local destination ISP
!
!creating an inspection class map
class-map type inspect match-any basic-web
! match traffic using the protocol HTTP (TCP 80)
match protocol http
! match traffic using the protocol HTTPS (TCP 8080)
match protocol https
! match traffic using the protocol DNS (TCP/UDP 53)
match protocol dns
!
! creating inspection policy map
policy-map type inspect Local_to_ISP
class type inspect basic-web
inspect
class class-default
drop
!
zone-pair security Local->ISP
service-policy type inspect Local_to_ISP
!
interface fastethernet0/1
zone-member security Local
!
interface serial0/0/1
zone-member security ISP
#CENR2
hostname CENR2
!
! zone based policy firewall configuration
! configuring security zones
zone security Local
zone security ISP
!
! configuring zone pairs
zone-pair security Local->ISP source Local destination ISP
!
!creating an inspection class map
class-map type inspect match-any basic-web
! match traffic using the protocol HTTP (TCP 80)
match protocol http
! match traffic using the protocol HTTPS (TCP 8080)
match protocol https
! match traffic using the protocol DNS (TCP/UDP 53)
match protocol dns
!
! creating inspection policy map
policy-map type inspect Local_to_ISP
class type inspect basic-web
inspect
class class-default
drop
!
zone-pair security Local->ISP
service-policy type inspect Local_to_ISP
!
interface fastethernet0/1
zone-member security Local
!
interface serial0/0/0
zone-member security ISP
