ZBF Logging (dropped packets) on IOS-XE

Heinz Schwarzfeuer — Tue, 12 Mar 2019 09:22:13 GMT

Hi,

I´ve configured a Cisco 4331 with the Zone Based Firewall (ZBF) features. Everything works fine so far, but when I wanted to take a closer look to the dropped packets I noticed that not all are shown.

I switched it on globally using:

parameter-map type inspect global
log dropped-packets

Afterwards I tried to "attack" the routers protected "self" zone doing a telnet and a portscan, which was all blocked as intended, but none of these blocked pakets have been shown in the routers log (nor on the terminal monitor), whereas other blocked packets (going to different zones) are shown.

Any ideas?

Here is my configuration:

parameter-map type inspect global
log dropped-packets

class-map type inspect match-any CM-INSPECT_GUESTS-TO-SELF
match access-group name CLM-ACL_INSPECT_GUESTS-TO-SELF

class-map type inspect match-any CM-PASS_GUESTS-TO-SELF
match access-group name CLM-ACL_PASS_GUESTS-TO-SELF_DHCP

class-map type inspect match-any CM-PASS_SELF-TO-GUESTS
match access-group name CLM-ACL_PASS_SELF-TO-GUESTS_DHCP

policy-map type inspect PM_SELF-TO-GUESTS
class type inspect CM-PASS_SELF-TO-GUESTS
pass
class class-default
drop log

policy-map type inspect PM_GUESTS-TO-SELF
class type inspect CM-INSPECT_GUESTS-TO-SELF
inspect
class type inspect CM-PASS_GUESTS-TO-SELF
pass
class class-default
drop log

ip access-list extended CLM-ACL_INSPECT_GUESTS-TO-SELF
permit icmp 192.168.51.0 0.255.255.255 host 192.168.51.1 echo
permit icmp 192.168.51.0 0.255.255.255 host 192.168.51.1 echo-reply

ip access-list extended CLM-ACL_PASS_GUESTS-TO-SELF_DHCP
permit udp any eq bootpc any eq bootps

ip access-list extended CLM-ACL_PASS_SELF-TO-GUESTS_DHCP
permit udp any eq bootps any eq bootpc

zone-pair security ZP_GUESTS-TO-SELF source ZN_GUESTS destination self
service-policy type inspect PM_GUESTS-TO-SELF

zone-pair security ZP_SELF-TO-GUESTS source self destination ZN_GUESTS
service-policy type inspect PM_SELF-TO-GUESTS

Many thanks!

Re: ZBF Logging (dropped packets) on IOS-XE

Heinz Schwarzfeuer — Thu, 26 Oct 2017 06:26:59 GMT

No one any idea?

Re: ZBF Logging (dropped packets) on IOS-XE

m.markocevic — Fri, 16 Nov 2018 23:21:23 GMT

I have the same problem. Any help is appreciated?

Re: ZBF Logging (dropped packets) on IOS-XE

fblackfire — Tue, 21 May 2019 10:06:25 GMT

Ever solved it?

Re: ZBF Logging (dropped packets) on IOS-XE

rhbmcse — Fri, 11 Oct 2019 19:25:03 GMT

Mine works - try splitting out this section into two policy maps.

You have an inspect and a pass both contained within a single PM (one for each CM) and finally a drop log.

The drop log is most probably applying to the latter 'pass' rule and thus not logging anything as everything has erm...passed! 🙂

Happy to help.

Rob.

policy-map type inspect PM_GUESTS-TO-SELF
class type inspect CM-INSPECT_GUESTS-TO-SELF
inspect
class type inspect CM-PASS_GUESTS-TO-SELF
pass
class class-default
drop log

topic Re: ZBF Logging (dropped packets) on IOS-XE in Network Security

ZBF Logging (dropped packets) on IOS-XE

Re: ZBF Logging (dropped packets) on IOS-XE

Re: ZBF Logging (dropped packets) on IOS-XE

Re: ZBF Logging (dropped packets) on IOS-XE

Re: ZBF Logging (dropped packets) on IOS-XE