topic Re: allowing only http from zone1 to zone2 in Network Security

allowing only http from zone1 to zone2

ibtissamshukor — Mon, 11 Mar 2019 18:54:38 GMT

I'm still new to firewall & zone-base firewall using packet tracer (version 5.3.0.0088)

I need to allow ONLY http protocol between zone1 & zone2, below is the code I'm using on the router

(zones are initialized properly on the interfaces)

config t

class-map type inspect match-any cm1

match protocol http

policy-map type inspect pm1

class type inspect cm1

inspect

as soon as I write inpect the following message appears:

%No specific protocol configured in class cm1 for inspection. All protocols will be inspected

please if some-one can help me

N.B. any protocol other than the http doesn't give the above message

thank you very much

Re: allowing only http from zone1 to zone2

Kureli Sankar — Fri, 15 Oct 2010 12:31:19 GMT

I just tried it and I did not get that error.

What code are you running on the router? I tried it in 12.4(24)T3.

-KS

Re: allowing only http from zone1 to zone2

Panos Kampanakis — Fri, 15 Oct 2010 14:58:24 GMT

There were some issues with the syntax in earlier 12.4 version.

As kusankar mentioned in latest versions your syntax will work ok.

The inspection you are trying to do is L4 and can also be done like this

access-list 101 permit tcp any any eq 80

class-map type inspect match-any cm1

match access-group 101

I hope it helps.

Re: allowing only http from zone1 to zone2

ibtissamshukor — Sat, 16 Oct 2010 07:39:47 GMT

thank you guys for your reply

actually the version of packet tracer I'm running is 12.4(15)T1

Re: allowing only http from zone1 to zone2

ibtissamshukor — Mon, 18 Oct 2010 10:09:49 GMT

hey guys

I'm using applying the commands on packet tracer (the software), is there a way to upgrade the IOS image on the router of the software???

thanks

Re: allowing only http from zone1 to zone2

Maykol Rojas — Mon, 18 Oct 2010 21:05:21 GMT

Hello Shukor!

This is Mike, I hope you are doing great. Yup, you can do upgrade to the IOS of the routers, but only with the ones that appear as per default (This is from packet tracer 5)

Just drag/drop a Server PT on the topology, click on the tab config and then TFTP, you will be able to see the images that you are allow to run.

Hope it helps.

Mike

Re: allowing only http from zone1 to zone2

ibtissamshukor — Wed, 20 Oct 2010 07:36:39 GMT

thanks Mike for your reply

but the only IOS images I can find in the TFTP of the server-PT are .T1

so I want to know whether the T1 IOS version has a "bug" related to the code I wrote above (concerning the http protocol) ???

thank you