topic ZBF and VRF in Network Security

ZBF and VRF

Krasnoperov — Mon, 11 Mar 2019 23:45:47 GMT

Hello, I'v got simple config, like this

ip vrf LINE

rd 65000:1

zone security LINE

interface GigabitEthernet0/1.206

description -=LINE_UPLINK_ISP=-

encapsulation dot1Q 206

ip vrf forwarding LINE

zone-member security LINE

ip address 195.23x.x.182 255.255.255.252

end

interface GigabitEthernet0/1.207

description -=LINE_PA_SPACE=-

encapsulation dot1Q 207

ip vrf forwarding LINE

zone-member security LINE

ip address 195.23x.x.185 255.255.255.248

ip route vrf LINE 0.0.0.0 0.0.0.0 195.239.108.181

No zone-pair for this zone line, no inspection rules configured.

However when user in vlan 207 with address

ip 195.23x.x.186

mask 255.255.255.248

gw 195.23x.x.185

try to connect to Internet, or someone ping from internet to this user, all traffic is denied, when I do

interface GigabitEthernet0/1.207

no zone-member security LINE

interface GigabitEthernet0/1.206

no zone-member security LINE

traffic is passing?

why? I always think that in same zone all traffic allowed

ZBF and VRF

Julio Carvajal — Thu, 23 Aug 2012 18:35:02 GMT

Hello Kras,

Would you mind to take the logs from the ZBFW

-Ip inspect log drop-pkt

Then just try to connect with the ZBFW configuration in place ofcourse and provide me the logs

Regards,

Rate all the helpful posts

ZBF and VRF

Krasnoperov — Fri, 24 Aug 2012 08:19:42 GMT

here is the log message with ZBF config in place, I tried to connect via ssh to this host

Aug 24 2012 12:16:27.204 MSK: %FW-6-DROP_PKT: Dropping tcp session 95.16x.x.54:51245 195.23x.x.186:22 due to policy match failure with ip ident 0

ZBF and VRF

Krasnoperov — Fri, 24 Aug 2012 09:34:11 GMT

Also, I want to say that rule for ZBF:

As soon as an interface is assigned to a zone, traffic will only flow to interfaces in the same zone.

Works without VRF just fine, but inside VRF it not works for me.

might be it's an IOS bug for:

(C3900-UNIVERSALK9-M), Version 15.2(1)T1, RELEASE SOFTWARE (fc1)

ZBF and VRF

Julio Carvajal — Fri, 24 Aug 2012 16:27:15 GMT

Hello,

And what happens if you leave the VRF setup and you set them on different zones and create an inspection policy to inspect traffic?

Regards,

Julio

ZBF and VRF

Krasnoperov — Sat, 25 Aug 2012 13:37:40 GMT

strange thing happens, when I create second zone and create zone-pair policy, put second interface to this zone and back it to same zone LINE it starts work as I expect, now all config that I post works!

why so?

Re: ZBF and VRF

Julio Carvajal — Sat, 25 Aug 2012 17:19:34 GMT

Hello Krasnoperov,

At least is good that is currently working, we could try to perform an upgrade to avoid a bug.

Can I have the version you are running to look for a bug because as you have explained the problem, the behavior does not make sense.

Regards,

Julio

ZBF and VRF

Krasnoperov — Mon, 27 Aug 2012 07:19:38 GMT

Yep, we have two router with identical IOS and identical behavior

System image file is "flash:c3900-universalk9-mz.SPA.152-1.T1.bin"

Cisco CISCO3945-CHASSIS (revision 1.0) with C3900-SPE150/K9 with 1835264K/261888K

Technology Package License Information for Module:'c3900'

-----------------------------------------------------------------

Technology Technology-package Technology-package

Current Type Next reboot

------------------------------------------------------------------

ipbase ipbasek9 Permanent ipbasek9

security securityk9 Permanent securityk9

uc None None None

data None None None

ZBF and VRF

Julio Carvajal — Mon, 27 Aug 2012 19:40:09 GMT

Hello,

I have been doing my homework with this threath and as I knew the implementation of Intra-Zone policies has been available since 15.1

Here is what I have found interesting so far:

Intrazone Support in the Zone-Based Firewall Application

Intrazone support allows a zone configuration to include users both inside and outside a network. Intrazone support allows traffic inspection between users belonging to the same zone but different networks. Depending on your release, traffic within a zone was allowed to pass uninspected by default. To configure a zone pair definition with the same zone for source and destination, use the zone-pair security command. This allows the functionality of attaching a policy map and inspecting the traffic within the same zone.

http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_zbf/configuration/15-2mt/sec-zone-pol-fw.html#GUID-08BAB3A9-DD8A-4656-A887-A38C1EF13512

So It looks like on the newest version in order to allow traffic from a 2 interfaces on the same zone we need to create an intra-zone policy.

I also found the following from the great website of Packetlife.com

http://packetlife.net/blog/2012/jan/30/ios-zone-based-firewall/

In early versions of IOS zone-based firewall, traffic flowing from one interface to another within the same security zone was allowed to pass by default. In recent versions, however, even intra-zone traffic requires a zone pair definition (with a single zone as both the source and destination).

So it will make sense why after I asked you to configure the zone pair it worked

Can you configure an intra-zone pair policy and let me know how it goes

Remember to rate all the helpful posts

Julio

ZBF and VRF

Krasnoperov — Wed, 29 Aug 2012 10:22:00 GMT

thanks, Julio

I made zone pair with a policy which pass traffi (just pass no inspection) something like this

zone-pair security LINE->LINE source LINE destination LINE

and traffic starts passing, so I thiks you're right about new IOS and intra-zone pair relations.

It would be grate if I could change this behaviour to default, where rule was:

As soon as an interface is assigned to a zone, traffic will only flow to interfaces in the same zone.

Is it posible?

ZBF and VRF

Julio Carvajal — Wed, 29 Aug 2012 15:25:03 GMT

Hello Krasnoperov,

If you only have a zone-pair for the intra zone traffic then only traffic from the same zone will be allowed so that should do it for you

Regards,

Julio

Rate all the helpful posts