URL filtering - CBAC vs. ZFW

CBAC URL Filtering
URL filtering allows you to control access to Internet websites by permitting or denying access to specific websites based on information contained in an URL list. You can maintain a local URL list on the router, and you can use URL lists stored on Websense or Secure Computing URL filter list servers.

ip urlfilter allow-mode on/off

This is a fail open, fail close mechanism, if it is turned on, all the rest of the websites not specified are going to be allowed, if it is set to off, all the websites will be blocked.

ip urlfilter exclusive-domain deny www.yahoo.com
ip urlfilter exclusive-domain deny www.cisco.com
ip inspect name WEBFILTER http urlfilter
interface FastEthernet1/1
 ip address 172.20.1.2 255.255.255.0
 ip inspect WEBFILTER out

verification

R1#show ip urlfilter cache
Maximum number of cache entries: 5000
Number of entries cached: 2
--------------------------------------------------------
    IP address        Age         Time since last hit
                   (In seconds)     (In seconds)
--------------------------------------------------------
87.248.122.122       117               106  
95.100.64.170        146               144   

R1#show ip urlfilter statistics
URL filtering statistics
=========================
Current requests count: 0
Current packet buffer count(in use): 0
Current cache entry count: 2
Maxever request count: 1
Maxever packet buffer count: 0
Maxever cache entry count: 1
Total requests sent to URL Filter Server :0
Total responses received from URL Filter Server :0
Total requests allowed: 0
Total requests blocked: 0

Because of these issues, ACLs typically are not used to implement these kinds of policies. Instead, a content-filtering server is used. Cisco currently supports server products from N2H2 (Sentian) and Websense to perform this filtering process.

 ip urlfilter server vendor websense 10.1.1.100

R1#show ip urlfilter config
Websense URL Filtering is DISABLED
Primary Websense server configurations
=========================================
Websense server IP address Or Host Name: 10.0.0.100
Websense server port: 15868
Websense retransmission time out: 6 (in seconds)
Websense number of retransmission: 2
Secondary Websense servers configurations
============================================
Other configurations
=====================
Allow Mode: ON
System Alert: ENABLED
Audit Trail: DISABLED
Log message on Websense server: DISABLED
Truncate Hostname: DISABLED
Truncate Script-parameters: DISABLED
Maximum number of cache entries: 5000
Maximum number of packet buffers: 200
Maximum outstanding requests: 1000

• ZFW URL Filtering

ZFW offers URL filtering capabilities to limit access to web content to that specified by a white- or black-list defined on the router, or by forwarding domain names to a URL filtering server to verify access to specific domains. 

For server-based URL filtering, you must define a parameter-map that describes the urlfilter server configuration:

 parameter-map type urlfilter websense-parmap
 server vendor [n2h2 | websense] 10.1.1.2

If static white- or black-lists are preferred, you can define a list of domains or subdomains that are specifically allowed or denied, while the inverse action is applied to traffic that does not match the list:

 parameter-map type urlfilter websense-parmap
 exclusive-domain deny .disallowed.com
 exclusive-domain permit .cisco.com

If a URL black-list is defined using deny options in the exclusive-domain definitions, all other domains will be allowed. If any “permit” definitions are defined, all domains that will be allowed must be explicitly specified, similar to the function of IP access-control lists.

Set up a class-map that will match HTTP traffic:

 class-map type inspect match-any http-cmap
 match protocol http

Define a policy-map that associates your class-map with inspect and urlfilter actions:

 policy-map type inspect http-filter-pmap
 class type inspect http-cmap
  inspect
  urlfilter websense-parmap

Transparent Firewall - CBAC vs. ZFW

• CBAC Transparent Firewall

The transparent Firewall is a Layer 2 bridge acting as a Firewall, with the capability of filtering IP-based packets using Context-Based Access Control (CBAC).

A Layer 2 Firewall has the advantage of being able to insert a transparent Firewall into a pre-existing subnet without having to readdress or reconfigure the attached devices.

Configuring a Bridge Group

The first step in configuring a transparent Firewall is to configure transparent bridging on two of the interfaces

bridge irb
interface FastEthernet1/0
 no ip address
 bridge-group 1
!
interface FastEthernet1/1
 no ip address
 bridge-group 1
!
interface BVI1
 ip address 10.1.1.3 255.255.255.0
!
bridge 1 protocol ieee
bridge 1 route ip

Configuring Inspection and ACLs

ip inspect name INSPECT icmp
interface FastEthernet1/0
 ip inspect INSPECT in
 ip access-group DENY in
interface FastEthernet1/1
 ip access-group DENY in
ip access-list extended DENY
 deny   ip any any

• ZFW Transparent Firewall

To configure ZFW, simply apply zone names to the interfaces configured for

Ethernet bridging

Any BVI interfaces on the router automatically belong to the “self” zone, and the

policy should be configured appropriately

Configuring a Bridge Group

The first step in configuring a transparent Firewall is to configure transparent bridging on two of the interfaces

bridge irb
interface FastEthernet1/0
 no ip address
 bridge-group 1
 bridge-group 1 input-type-list 201
zone-member security inside
!
interface FastEthernet1/1
 no ip address
 bridge-group 1
 bridge-group 1 input-type-list 201
zone-member security outside
!
interface BVI1
 ip address 10.1.1.3 255.255.255.0
!
bridge 1 protocol ieee
bridge 1 route ip

Configuring Zones and Policies

zone security inside
zone security outside
class-map type inspect match-all CMAP_INSIDE_TO_OUTSIDE_TRAFFIC
 match protocol http
!
!
policy-map type inspect PMAP_INSIDE_TO_OUTSIDE
 class type inspect CMAP_INSIDE_TO_OUTSIDE_TRAFFIC
  inspect
 class class-default
  drop log
zone-pair security INSIDE_TO_OUTSIDE source inside destination outside
 service-policy type inspect PMAP_INSIDE_TO_OUTSIDE

IOS - Zone Based Firewall - Part II

• ZFW Rate Limiting

1. Capability to police traffic matching the definitions of a specific class-map as it traverses the firewall from one security zone to another.  (Traffic-rate policing is not supported with the zone self)   

policy-map type inspect PMAP_INSIDE_TO_OUTSIDE
class type inspect CMAP_INSIDE_TO_OUTSIDE_TRAFFIC
inspect
police rate 1024000 burst 64000    

Verification:

R1#show policy-map type inspect zone-pair INSIDE_TO_OUTSIDE
 Zone-pair: INSIDE_TO_OUTSIDE
      Police
      rate 1024000 bps,64000 limit
      conformed 7083 packets, 3573091 bytes; actions: transmit
      exceeded 8937 packets, 12913808 bytes; actions: drop
      conformed 0 bps, exceed 0 bps

      2.  Session control to limit the session count (the maximum number and/or rate of the half-open connections for TCP/UDP sessions) for traffic in a policy-map matching a class-map.

 In order to apply connection-based limits to a particular class applied under a policy map you need to define an inspect parameter-map first.                                                                                                                                                                                                

parameter-map type inspect OUTSIDE_TRAFFIC_PARAMS
 max-incomplete low  50
 max-incomplete high 100
 one-minute low 10
 one-minute high 50
 tcp max-incomplete host 10 block-time 1
 sessions maximum 3000

R1#show parameter-map type inspect default
 parameter-map type inspect default values
  audit-trail off
  alert on
  max-incomplete low  unlimited
  max-incomplete high unlimited
  one-minute low  unlimited
  one-minute high unlimited
  udp idle-time 30
  icmp idle-time 10
  dns-timeout 5
  tcp idle-time 3600
  tcp finwait-time 5
  tcp synwait-time 30
  tcp max-incomplete host unlimited block-time 0
  sessions maximum 2147483647

R1#show parameter-map type inspect
 parameter-map type inspect OUTSIDE_TRAFFIC_PARAMS
  audit-trail off
  alert on
  max-incomplete low  50
  max-incomplete high 100
  one-minute low  10
  one-minute high 50
  udp idle-time 30
  icmp idle-time 10
  dns-timeout 5
  tcp idle-time 3600
  tcp finwait-time 5
  tcp synwait-time 30
  tcp max-incomplete host 10 block-time 1
  sessions maximum 3000

R1#show policy-map type inspect PMAP_INSIDE_TO_OUTSIDE
  Policy Map type inspect PMAP_INSIDE_TO_OUTSIDE
    Class CMAP_INSIDE_TO_OUTSIDE_TRAFFIC
      Inspect OUTSIDE_TRAFFIC_PARAMS
      Police rate 1024000 burst 64000

• ZFW Application Inspection 

         Cisco IOS Software ZFW offers application inspection and control on these application services:

• HTTP
• SMTP
• POP3
• IMAP
• Sun RPC
• P2P Application Traffic
•  IM Applications

Application inspection and control (AIC) varies in capability per service.

HTTP Application Inspection:
 -Application inspection can be applied on HTTP traffic to control unwanted use of HTTP’s service port for other applications such as IM, P2P file sharing, and tunneling applications that can redirect otherwise firewalled applications through TCP 80
- Ability to permit, deny, and monitor requests and responses based on header name and header values. This is useful to block requests and responses that carry vulnerable header fields.
-Ability to limit the sizes of different elements in the HTTP request and response headers such as maximum URL length, maximum header length, maximum number of headers, maximum header-line length, etc. This is useful to prevent buffer overflows.
- Ability to block requests and responses that carry multiple headers of the same type; for instance, a request with two content-length headers.
- Ability to block requests and responses with non-ASCII headers. This is useful to prevent various attacks that use binary and other non-ASCII characters to deliver worms and other malicious contents to web servers.
-Ability to group HTTP methods into user-specified categories and flexibility to block/allow/monitor each of the group is offered. The HTTP RFC allows a restricted set of HTTP methods. Some of the standard methods are considered unsafe because they can be used to exploit vulnerabilities on a web server. Many of the non-standard methods have a bad security record. 
- Method to block specific URIs based on a user configured regular expression. This feature gives a user the capability to block custom URIs and queries.  
- Ability to spoof header types (especially server header type) with user customizable strings. This is useful in a case where an attacker analyzes web server responses and learns as much information as possible, then launches an attack that exploits weaknesses in that particular web server. 
-Ability to block or issue an alert on an HTTP connection if one or more HTTP parameter values match values entered by the user as a regular expression. Some of the possible HTTP value contexts include header, body, username, password, user agent, request line, status line, and decoded CGI variables.

Instant Messaging and Peer-to-Peer Application Control

IM services:
AOL Instant Messenger
MSN Messenger
Yahoo! Messenger


P2P application protocols:

BitTorrent
eDonkey
FastTrack
Gnutella
KaZaA / KaZaA2
WinMX

Example:

parameter-map type regex REGEX_TORRENT
 pattern .*\.([tT][oO][rR]|[rR][eE][nN]|[tT])
parameter-map type regex REGEX_ALL_DOT_COM
 pattern .*\.[cC][oO][mM]
class-map type inspect http match-all CMAP_TORRENT
 match  request header host regex REGEX_ALL_DOT_COM
 match  request uri regex REGEX_TORRENT
class-map type inspect match-all CMAP_INSIDE_TO_OUTSIDE_HTTP
 match protocol http
 match access-group name FROM_INSIDE_NETWORK
policy-map type inspect http PMAP_HTTP_POLICY
 class type inspect http CMAP_TORRENT
  reset
  log
policy-map type inspect PMAP_INSIDE_TO_OUTSIDE
class type inspect CMAP_INSIDE_TO_OUTSIDE_HTTP
  inspect
  service-policy http PMAP_HTTP_POLICY

This config will block files downloads that match the extension *.torrent from all ".com" sites 

Verification:

*Apr  1 21:52:38.246: %APPFW-4-HTTP_HDR_FIELD_REGEX_MATCHED: Header field (^[Hh][Oo][Ss][Tt]:.*\.[cC][oO][mM]) matched - resetting session 10.1.1.2:41425 208.95.172.130:80 on zone-pair INSIDE_TO_OUTSIDE class CMAP_INSIDE_TO_OUTSIDE_HTTP appl-class CMAP_TORRENT
*Apr  1 21:52:38.246: %APPFW-4-HTTP_URI_REGEX_MATCHED: URI regex (.*\.([tT][oO][rR]|[rR][eE][nN]|[tT])) matched - resetting session 10.1.1.2:41425 208.95.172.130:80 on zone-pair INSIDE_TO_OUTSIDE class CMAP_INSIDE_TO_OUTSIDE_HTTP appl-class CMAP_TORRENT

   

IOS - Zone Based Firewall - Part I

Zone-Based Policy Firewall (also known as Zone-Policy Firewall, or ZFW) changes the firewall configuration from the older interface-based model to a more flexible, more easily understood zone-based model. Interfaces are assigned to zones, and inspection policy is applied to traffic moving between the zones. Inter-zone policies offer considerable flexibility and granularity, so different inspection policies can be applied to multiple host groups connected to the same router interface.

Firewall policies are configured with the Cisco Policy Language (CPL), which employs a hierarchical structure to define inspection for network protocols and the groups of hosts to which the inspection will be applied.

Rules For Applying Zone-Based Policy Firewall

Router network interfaces’ membership in zones is subject to several rules that govern interface behavior, as is the traffic moving between zone member interfaces:

• A zone must be configured before interfaces can be assigned to the zone.
• An interface can be assigned to only one security zone.
• All traffic to and from a given interface is implicitly blocked when the interface is assigned to a zone, except traffic to and from other interfaces in the same zone, and traffic to any interface on the router.
• Traffic is implicitly allowed to flow by default among interfaces that are members of the same zone.
• In order to permit traffic to and from a zone member interface, a policy allowing or inspecting traffic must be configured between that zone and any other zone.
• The self zone is the only exception to the default deny all policy. All traffic to any router interface is allowed until traffic is explicitly denied.
• Traffic cannot flow between a zone member interface and any interface that is not a zone member. Pass, inspect, and drop actions can only be applied between two zones.
• Interfaces that have not been assigned to a zone function as classical router ports and might still use classical stateful inspection/CBAC configuration.
• If it is required that an interface on the box not be part of the zoning/firewall policy. It might still be necessary to put that interface in a zone and configure a pass all policy (sort of a dummy policy) between that zone and any other zone to which traffic flow is desired.
• From the preceding it follows that, if traffic is to flow among all the interfaces in a router, all the interfaces must be part of the zoning model (each interface must be a member of one zone or another).
• The only exception to the preceding deny by default approach is the traffic to and from the router, which will be permitted by default. An explicit policy can be configured to restrict such traffic.

Cisco Policy Language (CPL) Configuration

1. Define zones.
2. Define zone-pairs.
3. Define class-maps that describe traffic that must have policy applied as it crosses a zone-pair.
4. Define policy-maps to apply action to your class-maps’ traffic.
5. Apply policy-maps to zone-pairs.
6. Assign interfaces to zones.

Configuring Zone-Based Policy Firewall Class-Maps

Class-maps define the traffic that the firewall selects for policy application. Layer 4 class-maps sort the traffic based on these criteria listed here. These criteria are specified using the match command in a class-map:

• Access-group—A standard, extended, or named ACL can filter traffic based on source and destination IP address and source and destination port.
• Protocol—The Layer 4 protocols (TCP, UDP, and ICMP) and application services such as HTTP, SMTP, DNS, etc. Any well-known or user-defined service known to Port-Application Mapping can be specified.
• Class-map—A subordinate class-map that provides additional match criteria can be nested inside another class-map.
• Not—The not criterion specifies that any traffic that does not match a specified service (protocol), access-group or subordinate class-map will be selected for the class-map.

Class-maps can apply match-any or match-all operators to determine how to apply the match criteria. If match-any is specified, traffic must meet only one of the match criteria in the class-map. If match-all is specified, traffic must match all of the class-map’s criteria in order to belong to that particular class.

Configuring Zone-Based Policy Firewall Policy-Maps

The policy-map applies firewall policy actions to one or more class-maps to define the service-policy that will be applied to a security zone-pair. When an inspect-type policy-map is created, a default class named class class-default is applied at the end of the class. The class class-default’s default policy action is drop, but can be changed to pass. The log option can be added with the drop action. Inspect cannot be applied on class class-default.

Zone-Based Policy Firewall Actions:

• Drop—This is the default action for all traffic, as applied by the "class class-default" that terminates every inspect-type policy-map. Other class-maps within a policy-map can also be configured to drop unwanted traffic. Traffic that is handled by the drop action is "silently" dropped by the ZFW, as opposed to an ACL's behavior of sending an ICMP “host unreachable” message to the host that sent the denied traffic. Currently, there is not an option to change the "silent drop" behavior. The log option can be added with drop for syslog notification that traffic was dropped by the firewall.
• Pass—This action allows the router to forward traffic from one zone to another. The pass action does not track the state of connections or sessions within the traffic. Pass only allows the traffic in one direction. A corresponding policy must be applied to allow return traffic to pass in the opposite direction. The pass action is useful for protocols such as IPSec ESP, IPSec AH, ISAKMP, and other inherently secure protocols with predictable behavior. However, most application traffic is better handled in the ZFW with the inspect action.
• Inspect—The inspect action offers state-based traffic control.Also, inspect can provide application inspection and control for certain service protocols that might carry vulnerable or sensitive application traffic. Audit-trail can be applied with a parameter-map to record connection/session start, stop, duration, the data volume transferred, and source and destination addresses.

Controlling Access to the Router

The self zone is a zone created by default by the router. It has a permit policy by default, and it used to manage traffic directed to or generated by the router.

To control traffic to and from the IP addresses on the router itself one or many policies are needed.

If a policy is configured from any zone to the self zone, and no policy is configured from self zone to the router’s user-configurable interface-connected zones, all router-originated traffic encounters the connected-zone to self-zone policy on its return the router and is blocked. Thus, router-originated traffic must be inspected to allow its return to the self zone.

Self-zone policy has limited functionality as compared to the policies available for transit-traffic zone-pairs:

• As was the case with classical stateful inspection, router-generated traffic is limited to TCP, UDP, ICMP, and complex-protocol inspection for H.323.
• Application Inspection is not available for self-zone policies.
• Session and rate limiting cannot be configured on self-zone policies.

Scenario

Requirements:

• Define 3 security zones: inside, outside, dmz

zone security inside
zone security outside
zone security dmz

• Protocols allowed from INSIDE to OUTSIDE: http, https, ftp, icmp, dns, ssh, telnet, ntp, ymsgr

 class-map type inspect match-any CMAP_INSIDE_TO_OUTSIDE_PROTOCOLS
 match protocol http
 match protocol https
 match protocol ftp
 match protocol icmp
 match protocol dns
 match protocol ssh
 match protocol telnet
 match protocol ntp
 match protocol ymsgr

• Protocols allowed from OUTSIDE to DMZ: http, https, ftp, tacacs

class-map type inspect match-any CMAP_OUTSIDE_TO_DMZ_PROTOCOLS
 match protocol http
 match protocol https
 match protocol ftp
 match protocol tacacs

• Protocols allowed from INSIDE to DMZ: http, https, ftp, icmp, tacacs, ssh 

class-map type inspect match-any CMAP_INSIDE_TO_DMZ_PROTOCOLS
 match protocol http
 match protocol https
 match protocol ftp
 match protocol icmp
 match protocol tacacs
 match protocol ssh

• Match only traffic generated from inside zone(to outside)

class-map type inspect match-all CMAP_INSIDE_TO_OUTSIDE_TRAFFIC
 match access-group name FROM_INSIDE_NETWORK
 match class-map CMAP_INSIDE_TO_OUTSIDE_PROTOCOLS

• Match only traffic generated to dmz zone(from outside)

class-map type inspect match-all CMAP_OUTSIDE_TO_DMZ_TRAFFIC
 match access-group name TO_DMZ_NETWORK
 match class-map CMAP_OUTSIDE_TO_DMZ_PROTOCOLS

• Match only traffic generated from inside zone to dmz

class-map type inspect match-all CMAP_INSIDE_TO_DMZ_TRAFFIC
 match access-group name FROM_INSIDE_NETWORK
 match access-group name TO_DMZ_NETWORK
 match class-map CMAP_INSIDE_TO_DMZ_PROTOCOLS

ip access-list extended FROM_INSIDE_NETWORK
 permit ip 10.1.1.0 0.0.0.255 any
ip access-list extended TO_DMZ_NETWORK
 permit ip any 192.168.223.0 0.0.0.255

• Configure policy-map for every zone-pair security

policy-map type inspect PMAP_INSIDE_TO_OUTSIDE
 class type inspect CMAP_INSIDE_TO_OUTSIDE_TRAFFIC
  inspect
 class class-default
  drop log
policy-map type inspect PMAP_INSIDE_TO_DMZ
 class type inspect CMAP_INSIDE_TO_DMZ_TRAFFIC
  inspect
 class class-default
  drop log
policy-map type inspect PMAP_OUTSIDE_TO_DMZ
 class type inspect CMAP_OUTSIDE_TO_DMZ_TRAFFIC
  inspect
 class class-default
  drop log

• Apply policies to security zone-pairs

zone-pair security INSIDE_TO_OUTSIDE source inside destination outside
 service-policy type inspect PMAP_INSIDE_TO_OUTSIDE
zone-pair security INSIDE_TO_DMZ source inside destination dmz
 service-policy type inspect PMAP_INSIDE_TO_DMZ
zone-pair security OUTSIDE_TO_DMZ source outside destination dmz
 service-policy type inspect PMAP_OUTSIDE_TO_DMZ

• Assign interfaces to zones

interface Ethernet1/0
 ip address 10.1.1.1 255.255.255.0
 zone-member security inside
interface Ethernet1/1
 ip address 192.168.223.100 255.255.255.0
 zone-member security dmz
interface FastEthernet2/0
 ip address 172.20.1.2 255.255.255.0
 zone-member security outside

• Permit traceroute traffic from inside to outside

ip access-list extended UDP_TRACEROUTE_PORTS
 permit udp any any range 33434 33464
ip access-list extended ICMP_TRACEROUTE
 permit icmp any any time-exceeded
 permit icmp any any port-unreachable

class-map type inspect match-all CMAP_INSIDE_TO_OUTSIDE_TRACEROUTE
 match access-group name UDP_TRACEROUTE_PORTS
class-map type inspect match-all CMAP_OUTSIDE_TO_INSIDE_TRACEROUTE
 match access-group name ICMP_TRACEROUTE

policy-map type inspect PMAP_INSIDE_TO_OUTSIDE
 class type inspect CMAP_INSIDE_TO_OUTSIDE_TRAFFIC
  inspect
 class type inspect CMAP_INSIDE_TO_OUTSIDE_TRACEROUTE
  pass
 class class-default
  drop log
policy-map type inspect PMAP_OUTSIDE_TO_INSIDE
 class type inspect CMAP_OUTSIDE_TO_INSIDE_TRACEROUTE
  pass
 class class-default
  drop log

•  Allow  only SSH and HTTPs access to router from zones outside and dmz.

ip access-list extended SSH_HTTPS_TRAFFIC
permit tcp any any eq 22
permit tcp any any eq 443
class-map type inspect match-all CMAP_HTTPS_SSH
match access-group name SSH_HTTPS_TRAFFIC
match protocol tcp
 policy-map type inspect PMAP_OUTSIDE_TO_SELF
class CMAP_HTTPS_SSH
inspect
policy-map type inspect PMAP_DMZ_TO_SELF
class CMAP_HTTPS_SSH
inspect
zone-pair security ZP_OUTSIDE_TO_SELF source outside destination self
service-policy type inspect PMAP_OUTSIDE_TO_SELF
!
zone-pair security ZP_DMZ_TO_SELF source dmz destination self
service-policy type inspect PMAP_DMZ_TO_SELF

• Permit icmp from router to any destination

class-map type inspect match-all CMAP_ICMP
match protocol icmp
policy-map type inspect PMAP_SELF_TO_ANY
class CMAP_ICMP
inspect
zone-pair security ZP_SELF_TO_OUTSIDE source self destination outside
service-policy type inspect PMAP_SELF_TO_ANY
zone-pair security ZP_SELF_TO_DMZ source self destination dmz
service-policy type inspect PMAP_SELF_TO_ANY

Verification

R1#show zone security  

zone self
  Description: System defined zone
zone inside
  Member Interfaces:
    Ethernet1/0
zone outside
  Member Interfaces:
    FastEthernet2/0
zone dmz
  Member Interfaces:
    Ethernet1/1

 R1#show zone-pair security     

Zone-pair name INSIDE_TO_OUTSIDE
    Source-Zone inside  Destination-Zone outside
    service-policy PMAP_INSIDE_TO_OUTSIDE
Zone-pair name INSIDE_TO_DMZ
    Source-Zone inside  Destination-Zone dmz
    service-policy PMAP_INSIDE_TO_DMZ
Zone-pair name OUTSIDE_TO_DMZ
    Source-Zone outside  Destination-Zone dmz
    service-policy PMAP_OUTSIDE_TO_DMZ
Zone-pair name OUTSIDE_TO_INSIDE
    Source-Zone outside  Destination-Zone inside
    service-policy PMAP_OUTSIDE_TO_INSIDE
Zone-pair name ZP_OUTSIDE_TO_SELF
    Source-Zone outside  Destination-Zone self
    service-policy PMAP_OUTSIDE_TO_SELF
Zone-pair name ZP_DMZ_TO_SELF
    Source-Zone dmz  Destination-Zone self
    service-policy PMAP_DMZ_TO_SELF
Zone-pair name ZP_SELF_TO_OUTSIDE
    Source-Zone self  Destination-Zone outside
    service-policy PMAP_SELF_TO_ANY
Zone-pair name ZP_SELF_TO_DMZ
    Source-Zone self  Destination-Zone dmz
    service-policy PMAP_SELF_TO_ANY

R1#show policy-map type inspect zone-pair INSIDE_TO_OUTSIDE

 Zone-pair: INSIDE_TO_OUTSIDE
  Service-policy inspect : PMAP_INSIDE_TO_OUTSIDE
    Class-map: CMAP_INSIDE_TO_OUTSIDE_TRAFFIC (match-all)
      Match: access-group name FROM_INSIDE_NETWORK
      Match: class-map match-any CMAP_INSIDE_TO_OUTSIDE_PROTOCOLS
        Match: protocol http
          14 packets, 560 bytes
          30 second rate 0 bps
        Match: protocol ftp
          0 packets, 0 bytes
          30 second rate 0 bps
        Match: protocol icmp
          1 packets, 64 bytes
          30 second rate 0 bps
        Match: protocol dns
          64 packets, 2967 bytes
          30 second rate 0 bps
        Match: protocol ssh
          0 packets, 0 bytes
          30 second rate 0 bps
        Match: protocol telnet
          0 packets, 0 bytes
          30 second rate 0 bps
        Match: protocol ymsgr
          2 packets, 80 bytes
          30 second rate 0 bps
        Match: protocol https
          23 packets, 920 bytes
          30 second rate 0 bps
        Match: protocol ntp
          105 packets, 5880 bytes
          30 second rate 0 bps
      Inspect
        Packet inspection statistics [process switch:fast switch]
        tcp packets: [2:1782]
        udp packets: [0:338]
        icmp packets: [0:6]
        im-yahoo packets: [0:85]
        Session creations since subsystem startup or last reset 208
        Current session counts (estab/half-open/terminating) [4:0:0]
        Maxever session counts (estab/half-open/terminating) [27:4:5]
        Last session created 00:00:03
        Last statistic reset never
        Last session creation rate 3
        Maxever session creation rate 33
        Last half-open session total 0
    Class-map: CMAP_INSIDE_TO_OUTSIDE_TRACEROUTE (match-all)
      Match: access-group name UDP_TRACEROUTE_PORTS
      Pass
        84 packets, 3360 bytes
    Class-map: class-default (match-any)
      Match: any
      Drop
        93 packets, 3800 bytes

IOS ACL -CBAC

• Traffic Filtering

CBAC ( Context-Based Access Control) inspects traffic that travels through the firewall to discover and manage state information for TCP and UDP sessions. This state information is used to create temporary openings in the firewall's access lists to allow return traffic and additional data connections for permissible sessions.

CBAC does not provide intelligent filtering for all protocols; it only works for the protocols that you specify. If you do not specify a certain protocol for CBAC, the existing access lists will determine how that protocol is filtered. No temporary openings will be created for protocols not specified for CBAC inspection.

ip inspect name INSPECT icmp
ip inspect name INSPECT dns
ip inspect name INSPECT http
ip inspect name INSPECT https
ip inspect name INSPECT ftp

interface FastEthernet2/0
 ip address 172.20.1.2 255.255.255.0
 ip access-group TRAFFIC-IN in
 ip inspect INSPECT out

ip access-list extended TRAFFIC-IN
 deny   ip any any log

Verification:

R1#show ip inspect sessions
Established Sessions
 Session 6696A4D4 (10.1.1.2:44279)=>(8.8.8.8:53) dns SIS_OPEN
 Session 6696CE8C (10.1.1.2:8)=>(8.8.8.8:0) icmp SIS_OPEN
 Session 669616FC (10.1.1.2:54196)=>(173.194.39.120:443) https SIS_OPEN
 Session 6696AFF4 (10.1.1.2:34012)=>(173.194.39.145:443) https SIS_OPEN
 Session 6696CBC4 (10.1.1.2:33813)=>(8.8.8.8:53) dns SIS_OPEN
 Session 6696BDDC (10.1.1.2:59747)=>(8.8.8.8:53) dns SIS_OPEN
 Session 6696C0A4 (10.1.1.2:53093)=>(192.168.223.129:21) ftp SIS_OPEN
 Session 669696EC (10.1.1.2:37786)=>(8.8.8.8:53) dns SIS_OPEN
 Session 6696A20C (10.1.1.2:50251)=>(8.8.8.8:53) dns SIS_OPEN
 Session 6696BB14 (10.1.1.2:51174)=>(8.8.8.8:53) dns SIS_OPEN
 Session 6696AD2C (10.1.1.2:48128)=>(109.100.26.54:80) http SIS_OPEN

By default, CBAC do not apply to router-generated traddic.

ip inspect name INSPECT icmp router-traffic

R1#show ip inspect sessions
Established Sessions
 Session 6696AFF4 (172.20.1.2:8)=>(192.168.223.129:0) icmp SIS_OPEN

• Traffic inspection

Inspecting packets at the application layer, and maintaining TCP and UDP session information, provides CBAC with the ability to detect and prevent certain types of network attacks such as SYN-flooding.
A SYN-flood attack occurs when a network attacker floods a server with a barrage of requests for connection and does not complete the connection. The resulting volume of half-open connections can overwhelm the server, causing it to deny service to valid requests. Network attacks that deny access to a network device are called denial-of-service (DoS) attacks.

CBAC helps to protect against DoS attacks in other ways. CBAC inspects packet sequence numbers in TCP connections to see if they are within expected ranges—CBAC drops any suspicious packets. You can also configure CBAC to drop half-open connections, which require firewall processing and memory resources to maintain. Additionally, CBAC can detect unusually high rates of new connections and issue alert messages.

Packets entering the firewall are inspected by CBAC only if they first pass the inbound access list at the input interface and outbound access list at the output interface. If a packet is denied by the access list, the packet is simply dropped and not inspected by CBAC.

CBAC inspection tracks sequence numbers in all TCP packets, and drops those packets with sequence numbers that are not within expected ranges.

When CBAC suspects an attack, the DoS feature can take several actions:
•Generate alert messages
•Protect system resources that could impede performance
•Block packets from suspected attackers

CBAC uses timeout and threshold values to manage session state information, helping to determine when to drop sessions that do not become fully established.

CBAC provides three thresholds against DoS attacks:
•The total number of half-open TCP or UDP sessions
•The number of half-open sessions based upon time
•The number of half-open TCP-only sessions per host

If a threshold is exceeded, CBAC has two options:
•Send a reset message to the end points of the oldest half-open session, making resources available to service newly arriving SYN packets.
•In the case of half open TCP only sessions, CBAC blocks all SYN packets temporarily for the duration configured by the threshold value. When the router blocks a SYN packet, the TCP three-way handshake is never initiated, which prevents the router from using memory and processing resources needed for valid connections.

ip inspect max-incomplete low 20
ip inspect max-incomplete high 30
ip inspect one-minute low 100
ip inspect one-minute high 120
ip inspect tcp max-incomplete host 10 block-time 5

Verification:

R1#show ip inspect config
Session audit trail is disabled
Session alert is enabled
one-minute (sampling period) thresholds are [100 : 120] connections
max-incomplete sessions thresholds are [20 : 30]
max-incomplete tcp connections per host is 10. Block-time 5 minutes.
tcp synwait-time is 30 sec -- tcp finwait-time is 5 sec
tcp idle-time is 3600 sec -- udp idle-time is 30 sec
tcp reassembly queue length 16; timeout 5 sec; memory-limit 1024 kilo bytes
dns-timeout is 5 sec
Inspection Rule Configuration
 Inspection name INSPECT
    dns alert is on audit-trail is off timeout 30
    http alert is on audit-trail is off timeout 3600
    https alert is on audit-trail is off timeout 3600
    ftp alert is on audit-trail is off timeout 3600
    icmp alert is on audit-trail is off timeout 10

*Mar 14 16:58:46.322: %FW-4-ALERT_ON: getting aggressive, count (2/30) current 1-min rate: 11

• Alerts and Audit Trails

CBAC also generates real-time alerts and audit trails. Enhanced audit trail features use SYSLOG to track all network transactions; recording time stamps, source host, destination host, ports used, and the total number of transmitted bytes, for advanced, session-based reporting. Real-time alerts send SYSLOG error messages to central management consoles upon detecting suspicious activity. Using CBAC inspection rules, you can configure alerts and audit trail information on a per-application protocol basis. For example, if you want to generate audit trail information for HTTP traffic, you can specify that in the CBAC rule covering HTTP inspection.

CBAC does not provide intelligent filtering for all protocols; it only works for the protocols that you specify. If you do not specify a certain protocol for CBAC, the existing access lists will determine how that protocol is filtered. No temporary openings will be created for protocols not specified for CBAC inspection.

ip inspect alert-off
ip inspect name INSPECT icmp alert on
no ip inspect audit-trail
ip inspect name INSPECT tcp audit-trail on

Verification

 R1#show ip inspect config
Session audit trail is disabled
Session alert is disabledone-minute (sampling period) thresholds are [5 : 10] connections
max-incomplete sessions thresholds are [20 : 30]
max-incomplete tcp connections per host is 10. Block-time 5 minutes.
tcp synwait-time is 30 sec -- tcp finwait-time is 5 sec
tcp idle-time is 3600 sec -- udp idle-time is 30 sec
tcp reassembly queue length 16; timeout 5 sec; memory-limit 1024 kilo bytes
dns-timeout is 5 sec
Inspection Rule Configuration
 Inspection name INSPECT
    dns alert is off audit-trail is off timeout 30
    http alert is off audit-trail is off timeout 3600
    https alert is off audit-trail is off timeout 3600
    ftp alert is off audit-trail is off timeout 3600
    icmp alert is on audit-trail is off timeout 10    tcp alert is off audit-trail is on timeout 3600

*Mar 14 17:07:19.650: %FW-6-SESS_AUDIT_TRAIL_START: Start tcp session: initiator (10.1.1.2:33675) -- responder (172.20.1.1:23)
*Mar 14 17:08:08.390: %FW-6-SESS_AUDIT_TRAIL: Stop tcp session: initiator (10.1.1.2:33675) sent 67 bytes -- responder (172.20.1.1:23) sent 117 bytes

• Manual Port Mappings

ip port-map user-custom port tcp 65000 description CUSTOM_APPLICATION

ip inspect name INSPECT user-custom

IOS ACL - Part 1 Extended ACL, Reflexive ACL and Dynamic ACL

1. Basic ACL
Standard ACLs
Standard ACLs control traffic by the comparison of the source address of the IP packets to the addresses configured in the ACL.

access-list access-list-number {permit|deny} {host|source source-wildcard|any}

 access-list-number can be anything from 1 to 99
After the ACL is defined, it must be applied to the interface (inbound or outbound).

interface
ip access-group number {in|out}

Extended ACLs
Extended ACLs control traffic by the comparison of the source and destination addresses of the IP packets to the addresses configured in the ACL.

IP

access-list access-list-number
     [dynamic dynamic-name [timeout minutes]]
     {deny|permit} protocol source source-wildcard
     destination destination-wildcard [precedence precedence]
     [tos tos] [log|log-input] [time-range time-range-name]

ICMP

access-list access-list-number
     [dynamic dynamic-name [timeout minutes]]
     {deny|permit} icmp source source-wildcard
     destination destination-wildcard
     [icmp-type [icmp-code] |icmp-message]
     [precedence precedence] [tos tos] [log|log-input]
     [time-range time-range-name]

TCP

access-list access-list-number
     [dynamic dynamic-name [timeout minutes]]
     {deny|permit} tcp source source-wildcard [operator [port]]
     destination destination-wildcard [operator [port]]
     [established] [precedence precedence] [tos tos]
     [log|log-input] [time-range time-range-name]

UDP

access-list access-list-number
     [dynamic dynamic-name [timeout minutes]]
     {deny|permit} udp source source-wildcard [operator [port]]
     destination destination-wildcard [operator [port]]
     [precedence precedence] [tos tos] [log|log-input]
     [time-range time-range-name]

 access-list-number can be 100 to 199

Named ACLs
 IP named ACLs allows standard and extended ACLs to be given names instead of numbers.

ip access-list {extended|standard} name

2.Reflexive ACL

Reflexive access lists contain only temporary entries; these entries are automatically created when a new IP session begins (for example, the reflexive ACL is triggered by an outbound packet), and the entries are removed when the session ends. Reflexive access lists are not themselves applied directly to an interface, but are "nested" within an extended named IP access list that is applied to the interface.

Restrictions on Using Reflexive Access Lists
Reflexive access lists do not work with some applications that use port numbers that change during a session. For example, if the port numbers for a return packet are different from the originating packet, the return packet will be denied, even if the packet is actually part of the same session.

The TCP application of FTP is an example of an application with changing port numbers. With reflexive access lists, if you start an FTP request from within your network, the request will not complete. Instead, you must use Passive FTP when originating requests from within your network.

ip access-list extended nameA
   permit protocol any any reflect nameB [timeoutseconds]
ip access-list extended nameC
   evaluate nameB
interface
  ip access-group nameA out
  ip access-group nameC in

3.Dynamic ACL

Dynamic ACL is dependent on Telnet, authentication (local or remote), and extended ACLs.
Dynamic ACL configuration starts with the application of an extended ACL to block traffic through the router. Users that want to traverse the router are blocked by the extended ACL until they Telnet to the router and are authenticated. The Telnet connection then drops and a single-entry dynamic ACL is added to the extended ACL that exists. This permits traffic for a particular time period; idle and absolute timeouts are possible.

access-list access-list-number dynamic name {permit|deny} [protocol]
{source source-wildcard|any} {destination destination-wildcard|any}
[precedence precedence][tos tos][established] [log|log-input]
[operator destination-port|destination port]

4. Scenario 

A. Basic ACL

Requirements inside to outside
-permit outside DNS
-permit www access
-permit https access
-permit FTP access (active mode)
-permit ping and traceroute

Requirements outside to inside
-permit www access to server 10.1.1.2
-protect for fragmented packets

Note: FTP is a TCP based service exclusively. A typical FTP session operates using two channels: a command (or control - port 21) channel and a data channel.The port used for the data channel can differ depending on which data transfer mode is used. For Active mode the data channel port is 20. For Passive mode the data channel port is a random port >1023. In Active mode an user connects from a random port on a file transfer client to port 21 on the server. It sends the PORT command, specifying what client-side port the server should connect to. This port will be used later on for the data channel and is different from the port used in this step for the command channel.In Pasive mode client still initiates a command channel connection to the server.In this case instead of sending the PORT command, it sends the PASV command, which is a request for a server port to connect to for data transmission. When the FTP server replies, it indicates what port number it has opened for the ensuing data transfer. 

ip access-list extended TRAFFIC-IN
 deny   ip any any fragments
 permit tcp any any established
 permit udp any eq domain any
 permit udp any eq ntp any
 permit tcp any eq ftp-data any
 permit icmp any any echo-reply
 permit icmp any any time-exceeded
 permit icmp any any port-unreachable
 permit tcp any host 10.1.1.2 eq www
 deny   ip any any log
ip access-list extended TRAFFIC-OUT
 permit udp any any eq domain
 permit tcp any any eq www
 permit tcp any any eq 443
 permit udp any eq ntp any
 permit tcp any any eq ftp
 permit tcp any any eq ftp-data
 permit icmp any any echo
 permit udp any any range 33434 33464
 permit tcp host 10.1.1.2 eq www any
 deny   ip any any log

interface FastEthernet2/0
 ip address 172.20.1.2 255.255.255.0
 ip access-group TRAFFIC-IN in
 ip access-group TRAFFIC-OUT out

Verification

R1#show ip access-lists
Extended IP access list TRAFFIC-IN
    5 deny ip any any fragments
    10 permit tcp any any established (5859 matches)
    20 permit udp any eq domain any (213 matches)
    50 permit tcp any eq ftp-data any (1 match)
    60 permit icmp any any echo-reply (17 matches)
    70 permit icmp any any time-exceeded (325 matches)
    80 permit icmp any any port-unreachable (43 matches)
    90 permit tcp any host 10.1.1.2 eq www (1 match)
    9999 deny ip any any log (53 matches)
Extended IP access list TRAFFIC-OUT
    10 permit udp any any eq domain (213 matches)
    20 permit tcp any any eq www (3228 matches)
    30 permit tcp any any eq 443 (1032 matches)
    50 permit tcp any any eq ftp (43 matches)
    60 permit tcp any any eq ftp-data (3 matches)
    70 permit icmp any any echo (17 matches)
    80 permit udp any any range 33434 33464
    90 permit tcp host 10.1.1.2 eq www any (6 matches)
    9999 deny ip any any log (56 matches)

B.Reflexive ACL
Requirements
-permit all traffic (TCP,UDP,ICMP) from inside to outside

Note: for this task remove all previous configured ACL

ip access-list extended TRAFFIC-OUT
 permit tcp any any reflect MIRROR
 permit udp any any reflect MIRROR
 permit icmp any any reflect MIRROR
 deny   ip any any log
ip access-list extended TRAFFIC-IN
 evaluate MIRROR
 deny   ip any any log

interface FastEthernet2/0
 ip address 172.20.1.2 255.255.255.0
 ip access-group TRAFFIC-IN in
 ip access-group TRAFFIC-OUT out

Verification

R1#show ip access-lists                
Reflexive IP access list MIRROR
     permit tcp host 173.194.34.79 eq 443 host 10.1.1.2 eq 36798 (45 matches) (time left 269)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 56413 (2 matches) (time left 179)
     permit tcp host 173.194.41.79 eq 443 host 10.1.1.2 eq 32899 (24 matches) (time left 268)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 50338 (2 matches) (time left 178)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 34574 (2 matches) (time left 178)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 42713 (2 matches) (time left 178)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 38732 (2 matches) (time left 178)
     permit tcp host 173.194.39.184 eq 443 host 10.1.1.2 eq 45214 (336 matches) (time left 269)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 58391 (2 matches) (time left 176)
     permit tcp host 173.194.39.145 eq 443 host 10.1.1.2 eq 33936 (24 matches) (time left 266)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 41884 (2 matches) (time left 176)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 48723 (2 matches) (time left 171)
     permit udp host 8.8.8.8 eq domain host 10.1.1.2 eq 35283 (2 matches) (time left 171)
     permit icmp host 8.8.8.8 host 10.1.1.2  (1037 matches) (time left 299)
Extended IP access list TRAFFIC-IN
    10 evaluate MIRROR
    9999 deny ip any any log (29 matches)
Extended IP access list TRAFFIC-OUT
    10 permit tcp any any reflect MIRROR (215 matches)
    20 permit udp any any reflect MIRROR (38 matches)
    30 permit icmp any any reflect MIRROR (545 matches)
    40 deny ip any any log

C. Dynamic ACL
Requirements
-permit ping traffic from outside (authenticated IP) to the inside

aaa new-model
aaa authentication login CONSOLE none
aaa authorization exec default local
username CISCO autocommand access-enable host timeout 10
username CISCO password 0 test_ping
ip access-list extended TRAFFIC-IN
 evaluate MIRROR
 permit tcp any host 172.20.1.2 eq telnet
 dynamic PING_ACCESS permit icmp any any
 deny   ip any any log

Verification:

Extended IP access list TRAFFIC-IN
    10 evaluate MIRROR
    15 permit tcp any host 172.20.1.2 eq telnet (342 matches)
    20 Dynamic PING_ACCESS permit icmp any any
       permit icmp host 192.168.223.129 any (4 matches) (time left 595)
       permit icmp host 172.20.1.1 any (5 matches) (time left 315)
    9999 deny ip any any log (57 matches)