topic Zone Based Firewall inspection question in Network Security

Zone Based Firewall inspection question

Mr Brightside — Tue, 12 Mar 2019 03:24:06 GMT

Hi Everyone,

I am thinking on best way of doing class-map for inspection of traffic coming on a not well-known TCP port.

My question is whether do it via an access-list only, like

access-list in-traff permit tcp host x.x.x.x host y.y.y.y eq 2085

class-map type inspect match-any IN-cmap

match access-group name in-traff

Or, it would be better to do it like this:

access-list in-traff permit tcp host x.x.x.x host y.y.y.y eq 2085

class-map type inspect match-all IN-cmap

match protocol tcp

match access-group name in-traff

Since I have tcp mentioned on ACL already, I am wondering if match protcol tcp would really do any deeper inspection.

Thanks!

Zone Based Firewall inspection question

Julio Carvajal — Fri, 03 Jan 2014 08:45:53 GMT

Hello Farhad,

I will go with the First option (ACL only).

There is no need to go any further as there will be no advantages of a deeper inspection as this is not a well known protocol (And just for you to know on both the match protocol TCP and match access-group name you are matching at layer 4 so it's redundant)

Looking for some Networking Assistance?
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Zone Based Firewall inspection question

Marius Gunnerud — Fri, 03 Jan 2014 10:04:32 GMT

I agree with jcarvaja, the first option you posted is the better option. you are already defining that the protocol is TCP in the ACL so no need to define it again in the class map.

--
Please remember to rate and select a correct answer