topic Zone-Based Policy Firewall (Packet tracer) in Network Security

Zone-Based Policy Firewall (Packet tracer)

isaiahhavocc — Sat, 28 Sep 2019 02:22:50 GMT

I'm testing out a zone-based policy in Packet Tracer for a project but I want to verify that my commands are correct... Here is my topology.

What I'm trying to accomplish:

The R1 router should add a new network, which will be a DMZ. Policy is as follows: You should allow web traffic (HTTP and HTTPS ONLY) to get to the Server in the DMZ of R1.

You will add a server to G0/0 of R1. Assign following addresses: R1 G0/0 – 192.168.2.1 / 24 Server 192.168.2.3/24 with appropriate gateway

Add a new static route on R2 to get to the new network 192.168.2.0/24

The zone-based firewall policy will be done on R1. Implement the commands on R1. Success would be for PC-C to be able to successfully browse to the 192.168.2.3 server but PC-C should NOT be able to ping 192.168.2.3

Once you have THAT working, a new policy needs to be added. You should allow pings to the DMZ server as well. Success would mean that PC-C would be able to browse AND ping 192.168.2.3.

Just looking for the appropriate commands to implement. Thanks everyone.

Re: Zone-Based Policy Firewall (Packet tracer)

Marius Gunnerud — Sun, 29 Sep 2019 12:40:25 GMT

This is a duplicate question to the one further up in the list that I have already answered, but I will post the config here also.

ip access-list extended web-to-dmzServer-acl

permit tcp any host 192.168.2.3 80

permit tcp any host 192.168.2.3 443

class-map type inspect match-any web-to-dmzServer-cmap

match access-group web-to-dmzServer-acl

policy-map type inspect web-to-dmzServer-pmap

class type inspect web-to-dmzServer-cmap

inspect

zone security dmz

description DMZ services

zone security web

description Internet

zone-pair security web-to-dmz-pair source web destination dmz

interface Gig0/0/0

description Internet

zone-member security web

interface Gig0/0/1

description DMZ

zone-member security dmz

Verification:

show policy-map type inspect zone web

show policy-map type inspect zone dmz

show policy-map type inspect zone-pair web-to-dmz-pair