Hello,
I have a network which the topology is similar to the following:
In the topology there are two tunnels with ISAKMP and IPSec configured between the Client router and the Prov router.
The client asked me to configure ZBFW in the MID router, with the idea of letting the administrator to access from the MID router, or the Prov router, to the Client router using Ping o ssh, with the condition that nobody can use ssh or ping from the Client router to the MID router or from the Client router to the Prov router.
To do this, I have tried to configure the MID routers by two different ways, but in both situations the tunnels go down. I cannot understand why this is happening, and what should I do to solve it.
The following are the two ways to configure the router that I have tried:
First
class-map type inspect match-any Prov-TO-Client-CLASS
match protocol udp
match protocol tcp
match protocol ssh
match protocol icmp
match protocol isakmp
match protocol pptp
!
class-map type inspect match-any Client-TO-Prov-CLASS
match protocol udp
match protocol tcp
match protocol isakmp
match protocol pptp
!
ip access-list extended ISAKMP_IPSEC
permit gre any any
permit udp any any eq isakmp
permit ahp any any
permit esp any any
permit udp any any eq non500-isakmp
!
class-map type inspect match-all CLASS-ACL-Prov-TO-Client
match access-group name ISAKMP_IPSEC
!
class-map type inspect match-all Client-TO-Prov-CLASS-ACL
match access-group name ISAKMP_IPSEC
!
policy-map type inspect Client-TO-Prov-POLICY
class type inspect Client-TO-Prov-CLASS
inspect
class type inspect Client-TO-Prov-CLASS-ACL
pass
class class-default
drop
!
policy-map type inspect Prov-TO-Client-POLICY
class type inspect Prov-TO-Client-CLASS
inspect
class type inspect CLASS-ACL-Prov-TO-Client
pass
class class-default
drop
!
zone security Prov
zone security Client
zone-pair security Prov-TO-Client source Prov destination Client
service-policy type inspect Prov-TO-Client-POLICY
!
zone-pair security Client-TO-Prov source Client destination Prov
service-policy type inspect Client-TO-Prov-POLICY
!
interface Ethernet0/0
zone-member security Client
!
interface Ethernet0/1
zone-member security Prov
!
Second
class-map type inspect match-any Prov-TO-Client-PROTO
match protocol udp
match protocol tcp
match protocol ssh
match protocol icmp
match protocol isakmp
match protocol pptp
!
class-map type inspect match-any Client-TO-Prov-PROTO
match protocol udp
match protocol tcp
match protocol isakmp
match protocol pptp
!
ip access-list extended ISAKMP_IPSEC
permit gre any any
permit udp any any eq isakmp
permit ahp any any
permit esp any any
permit udp any any eq non500-isakmp
!
class-map type inspect match-all CLASS-Prov-TO-Client
match access-group name ISAKMP_IPSEC
match class-map Prov-TO-Client-PROTO
!
class-map type inspect match-all CLASS-Client-TO-Prov
match access-group name ISAKMP_IPSEC
match class-map Client-TO-Prov-PROTO
!
policy-map type inspect Client-TO-Prov-POLICY
class type inspect CLASS-Client-TO-Prov
inspect
class class-default
drop
!
policy-map type inspect Prov-TO-Client-POLICY
class type inspect CLASS-Prov-TO-Client
inspect
class class-default
drop
!
zone security Prov
zone security Client
zone-pair security Prov-TO-Client source Prov destination Client
service-policy type inspect Prov-TO-Client-POLICY
!
zone-pair security Client-TO-Prov source Client destination Prov
service-policy type inspect Client-TO-Prov-POLICY
!
interface Ethernet0/0
zone-member security Client
!
interface Ethernet0/1
zone-member security Prov
!
Thank you for your support,
Franco Riggio
