Cisco 881 Zone Firewall issues

[martinbuffleo]

I'm having issues with an 881 that I have configured as a zone based firewall.

I have allowed HTTP(s) and DNS on the DMZ but my user is saying he cannot access the internet.

On the corporate side the user complains that some websites fail, such as Linked in.

I have been using CCP to configure the device. What am I doing wrong?

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.03.15 11:49:00 =~=~=~=~=~=~=~=~=~=~=~=

sh run

Building configuration...

Current configuration : 22210 bytes

!

! Last configuration change at 15:30:21 UTC Tue Mar 12 2013 by SpecIS

! NVRAM config last updated at 14:12:39 UTC Thu Mar 7 2013 by specis

! NVRAM config last updated at 14:12:39 UTC Thu Mar 7 2013 by specis

version 15.1

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

hostname -Rt

!

boot-start-marker

boot-end-marker

!

!

security authentication failure rate 10 log

security passwords min-length 6

logging buffered 51200

logging console critical

enable secret 5

enable password 7

!

aaa new-model

!

!

aaa authentication login local_auth local

!

!

!

!

!

aaa session-id common

!

memory-size iomem 10

crypto pki token default removal timeout 0

!

crypto pki trustpoint TP-self-signed-3066996233

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-3066996233

revocation-check none

rsakeypair TP-self-signed-3066996233

!

!

crypto pki certificate chain TP-self-signed-3066996233

certificate self-signed 01

quit

no ip source-route

no ip gratuitous-arps

!

!

!

ip dhcp excluded-address 10.0.2.2

ip dhcp excluded-address 10.0.2.1

!

ip dhcp pool Trusted

import all

network 10.0.2.0 255.255.255.0

default-router 10.0.2.1

domain-name spectra.local

dns-server 10.0.2.2 10.0.1.6

option 150 ip 10.1.1.10 10.1.1.20

!

ip dhcp pool Guest

import all

network 192.168.112.0 255.255.255.0

default-router 192.168.112.1

dns-server 4.2.2.2 4.2.2.3

!

!

ip cef

no ip bootp server

ip domain name yourdomain.com

ip name-server 10.0.2.2

ip name-server 4.2.2.2

login block-for 5 attempts 3 within 2

no ipv6 cef

!

!

multilink bundle-name authenticated

vpdn enable

!

vpdn-group 1

!

parameter-map type inspect global

log dropped-packets enable

log summary flows 256 time-interval 30

parameter-map type regex ccp-regex-nonascii

pattern [^\x00-\x80]

parameter-map type protocol-info yahoo-servers

server name scs.msg.yahoo.com

server name scsa.msg.yahoo.com

server name scsb.msg.yahoo.com

server name scsc.msg.yahoo.com

server name scsd.msg.yahoo.com

server name cs16.msg.dcn.yahoo.com

server name cs19.msg.dcn.yahoo.com

server name cs42.msg.dcn.yahoo.com

server name cs53.msg.dcn.yahoo.com

server name cs54.msg.dcn.yahoo.com

server name ads1.vip.scd.yahoo.com

server name radio1.launch.vip.dal.yahoo.com

server name in1.msg.vip.re2.yahoo.com

server name data1.my.vip.sc5.yahoo.com

server name address1.pim.vip.mud.yahoo.com

server name edit.messenger.yahoo.com

server name messenger.yahoo.com

server name http.pager.yahoo.com

server name privacy.yahoo.com

server name csa.yahoo.com

server name csb.yahoo.com

server name csc.yahoo.com

parameter-map type protocol-info msn-servers

server name messenger.hotmail.com

server name gateway.messenger.hotmail.com

server name webmessenger.msn.com

parameter-map type protocol-info aol-servers

server name login.oscar.aol.com

server name toc.oscar.aol.com

server name oam-d09a.blue.aol.com

license udi pid CISCO881-SEC-K9 sn FCZ1703C01Y

!

!

archive

log config

logging enable

username S privilege 15 secret 4

username ed privilege 15 password 7

!

!

!

!

ip tcp synwait-time 10

ip tcp path-mtu-discovery

ip ssh time-out 60

ip ssh authentication-retries 2

!

class-map type inspect match-any SDM_BOOTPC

match access-group name SDM_BOOTPC

class-map type inspect imap match-any ccp-app-imap

match invalid-command

class-map type inspect match-any ccp-cls-protocol-p2p

match protocol edonkey signature

match protocol gnutella signature

match protocol kazaa2 signature

match protocol fasttrack signature

match protocol bittorrent signature

class-map type inspect match-any SDM_DHCP_CLIENT_PT

match class-map SDM_BOOTPC

class-map type inspect match-any SDM_AH

match access-group name SDM_AH

class-map type inspect match-any ccp-skinny-inspect

match protocol skinny

class-map type inspect http match-any ccp-app-nonascii

match req-resp header regex ccp-regex-nonascii

class-map type inspect match-any sdm-cls-bootps

match protocol bootps

class-map type inspect match-any TFTP

match protocol tftp

class-map type inspect match-any SDM_ESP

match access-group name SDM_ESP

class-map type inspect match-any SDM_VPN_TRAFFIC

match protocol isakmp

match protocol ipsec-msft

match class-map SDM_AH

match class-map SDM_ESP

class-map type inspect match-all SDM_VPN_PT

match access-group 105

match class-map SDM_VPN_TRAFFIC

class-map type inspect match-all ccp-cls-ccp-permit-outside-in-1

match access-group name Any-From-HO

class-map type inspect match-any Skinny

match protocol skinny

class-map type inspect match-all ccp-cls-ccp-permit-outside-in-2

match class-map Skinny

match access-group name Hostcom-Skinny

class-map type inspect match-any ccp-h323nxg-inspect

match protocol h323-nxg

class-map type inspect match-any ccp-cls-icmp-access

match protocol icmp

class-map type inspect match-any ccp-cls-protocol-im

match protocol ymsgr yahoo-servers

match protocol msnmsgr msn-servers

match protocol aol aol-servers

class-map type inspect match-any Pings

match protocol icmp

class-map type inspect match-any Ping-

match class-map Pings

class-map type inspect match-all ccp-cls-ccp-inspect-2

match class-map Ping-

match access-group name Ping-

class-map type inspect match-any DNS

match protocol dns

class-map type inspect match-all ccp-cls-ccp-inspect-3

match class-map DNS

match access-group name Any-any

class-map type inspect match-all ccp-protocol-pop3

match protocol pop3

class-map type inspect match-any ccp-h225ras-inspect

match protocol h225ras

class-map type inspect match-all ccp-cls-ccp-inspect-1

match access-group name Any/Any

class-map type inspect match-any https

match protocol https

class-map type inspect match-all ccp-cls-ccp-inspect-4

match class-map https

match access-group name any-any

class-map type inspect match-any UDP

match protocol udp

match protocol tcp

class-map type inspect match-all ccp-cls-ccp-inspect-5

match class-map UDP

match access-group name InsideOut

class-map type inspect match-any ccp-h323annexe-inspect

match protocol h323-annexe

class-map type inspect match-any SDM_SSH

match access-group name SDM_SSH

class-map type inspect pop3 match-any ccp-app-pop3

match invalid-command

class-map type inspect match-any SDM_HTTPS

match access-group name SDM_HTTPS

class-map type inspect match-all ccp-protocol-p2p

match class-map ccp-cls-protocol-p2p

class-map type inspect match-all ccp-cls-ccp-permit-2

match class-map Pings

match access-group name RespondtoSomePings

class-map type inspect match-any RemoteMgt

match protocol ssh

match protocol https

class-map type inspect match-all ccp-cls-ccp-permit-1

match class-map RemoteMgt

match access-group name Spectra-RemoteMgt

class-map type inspect match-any SDM_SHELL

match access-group name SDM_SHELL

class-map type inspect match-any ccp-h323-inspect

match protocol h323

class-map type inspect match-all ccp-protocol-im

match class-map ccp-cls-protocol-im

class-map type inspect match-all ccp-icmp-access

class-map type inspect match-all ccp-invalid-src

match access-group 103

class-map type inspect http match-any ccp-app-httpmethods

match request method bcopy

match request method bdelete

match request method bmove

match request method bpropfind

match request method bproppatch

match request method connect

match request method copy

match request method delete

match request method edit

match request method getattribute

match request method getattributenames

match request method getproperties

match request method index

match request method lock

match request method mkcol

match request method mkdir

match request method move

match request method notify

match request method options

match request method poll

match request method post

match request method propfind

match request method proppatch

match request method put

match request method revadd

match request method revlabel

match request method revlog

match request method revnum

match request method save

match request method search

match request method setattribute

match request method startrev

match request method stoprev

match request method subscribe

match request method trace

match request method unedit

match request method unlock

match request method unsubscribe

class-map type inspect match-any ccp-dmz-protocols

match protocol http

match protocol dns

match protocol https

class-map type inspect match-any WebBrowsing

match protocol http

match protocol https

class-map type inspect match-any DNS2

match protocol dns

class-map type inspect match-any ccp-sip-inspect

match protocol sip

class-map type inspect http match-any ccp-http-blockparam

match request port-misuse im

match request port-misuse p2p

match request port-misuse tunneling

match req-resp protocol-violation

class-map type inspect match-all ccp-protocol-imap

match protocol imap

class-map type inspect match-all ccp-cls-ccp-permit-dmzservice-1

match class-map WebBrowsing

match access-group name DMZ-Out

class-map type inspect match-all ccp-cls-ccp-permit-dmzservice-2

match class-map DNS2

match access-group name DMZtoAny

class-map type inspect match-all ccp-protocol-smtp

match protocol smtp

class-map type inspect match-all ccp-protocol-http

match protocol http

!

!

policy-map type inspect ccp-permit-icmpreply

class type inspect sdm-cls-bootps

pass

class type inspect ccp-icmp-access

inspect

class class-default

pass

policy-map type inspect imap ccp-action-imap

class type inspect imap ccp-app-imap

log

reset

policy-map type inspect pop3 ccp-action-pop3

class type inspect pop3 ccp-app-pop3

log

reset

policy-map type inspect ccp-inspect

class type inspect ccp-cls-ccp-inspect-2

inspect

class type inspect ccp-cls-ccp-inspect-1

inspect

class type inspect ccp-cls-ccp-inspect-5

pass log

class type inspect TFTP

inspect

class type inspect ccp-invalid-src

drop log

class type inspect ccp-cls-ccp-inspect-4

inspect

class type inspect ccp-protocol-http

inspect

class type inspect ccp-protocol-smtp

inspect

class type inspect ccp-cls-ccp-inspect-3

inspect

class type inspect ccp-protocol-imap

inspect

service-policy imap ccp-action-imap

class type inspect ccp-protocol-pop3

inspect

service-policy pop3 ccp-action-pop3

class type inspect ccp-protocol-p2p

drop log

class type inspect ccp-protocol-im

drop log

class type inspect ccp-sip-inspect

inspect

class type inspect ccp-h323-inspect

inspect

class type inspect ccp-h323annexe-inspect

inspect

class type inspect ccp-h225ras-inspect

inspect

class type inspect ccp-h323nxg-inspect

inspect

class type inspect ccp-skinny-inspect

inspect

class class-default

drop log

policy-map type inspect ccp-permit-outside-in

class type inspect ccp-cls-ccp-permit-outside-in-2

inspect

class type inspect ccp-cls-ccp-permit-outside-in-1

pass

class class-default

drop log

policy-map type inspect http ccp-action-app-http

class type inspect http ccp-http-blockparam

log

reset

class type inspect http ccp-app-httpmethods

log

reset

class type inspect http ccp-app-nonascii

log

reset

policy-map type inspect ccp-permit

class type inspect SDM_VPN_PT

pass

class type inspect ccp-cls-ccp-permit-2

inspect

class type inspect ccp-cls-ccp-permit-1

pass

class type inspect SDM_DHCP_CLIENT_PT

pass

class class-default

drop log

policy-map type inspect ccp-permit-dmzservice

class type inspect ccp-cls-ccp-permit-dmzservice-1

inspect

class type inspect ccp-cls-ccp-permit-dmzservice-2

inspect

class class-default

drop

!

zone security in-zone

zone security out-zone

zone security dmz-zone

zone-pair security ccp-zp-in-out source in-zone destination out-zone

service-policy type inspect ccp-inspect

zone-pair security ccp-zp-out-self source out-zone destination self

service-policy type inspect ccp-permit

zone-pair security ccp-zp-out-in source out-zone destination in-zone

service-policy type inspect ccp-permit-outside-in

zone-pair security Spec-zp-dmz-out source dmz-zone destination out-zone

service-policy type inspect ccp-permit-dmzservice

!

!

crypto isakmp policy 2

encr aes 256

authentication pre-share

group 5

lifetime 28800

crypto isakmp key Y address x.x.x.x

crypto isakmp key o1 address x.x.x.x

!

!

crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac

!

crypto map SDM_CMAP_1 1 ipsec-isakmp

description Tunnel to x.x.x.x

set peer x.x.x.x

set transform-set ESP-AES256-SHA

match address 100

crypto map SDM_CMAP_1 2 ipsec-isakmp

description Tunnel to x.x.x.x

set peer x.x.x.x

set security-association lifetime kilobytes 128000

set security-association lifetime seconds 28800

set transform-set ESP-AES256-SHA

match address 102

!

!

!

!

!

interface FastEthernet0

description B

switchport access vlan 2

no ip address

spanning-tree portfast

!

interface FastEthernet1

description Docker

switchport access vlan 2

no ip address

spanning-tree portfast

!

interface FastEthernet2

description Phone

switchport access vlan 2

no ip address

spanning-tree portfast

!

interface FastEthernet3

description Guest

switchport access vlan 3

no ip address

spanning-tree portfast

!

interface FastEthernet4

description External $FW_OUTSIDE$

bandwidth inherit

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat outside

ip virtual-reassembly in

ip verify unicast source reachable-via rx allow-default 104

duplex auto

speed auto

pppoe-client dial-pool-number 1

hold-queue 224 in

!

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip tcp adjust-mss 1452

shutdown

!

interface Vlan2

description Trusted Network$FW_INSIDE$

ip address 10.0.2.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly in

zone-member security in-zone

ip tcp adjust-mss 1440

!

interface Vlan3

description Guest Network$FW_DMZ$

ip address 192.168.112.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly in

zone-member security dmz-zone

!

interface Dialer0

ip address negotiated

no ip redirects

no ip unreachables

ip directed-broadcast

no ip proxy-arp

ip flow ingress

ip nat outside

ip virtual-reassembly in

ip verify unicast reverse-path

encapsulation ppp

load-interval 30

dialer pool 1

dialer-group 1

ppp authentication chap pap callout

ppp chap hostname

ppp chap password 7

ppp pap sent-username password 7

no cdp enable

!

interface Dialer1

ip address negotiated

no ip redirects

no ip unreachables

ip directed-broadcast

no ip proxy-arp

ip flow ingress

ip nat outside

ip virtual-reassembly in

ip verify unicast reverse-path

zone-member security out-zone

encapsulation ppp

load-interval 30

dialer pool 1

dialer-group 1

ppp authentication chap pap callin

ppp chap hostname

ppp chap password 7

ppp pap sent-username password 7

ppp ipcp route default

ppp ipcp address accept

no cdp enable

crypto map SDM_CMAP_1

!

ip forward-protocol nd

no ip http server

ip http access-class 23

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

!

ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload

!

ip access-list standard SSH-Management

permit x.x.x.x log

permit 10.0.2.0 0.0.0.255 log

permit 10.0.1.0 0.0.0.255 log

!

ip access-list extended Any-From-HO

remark CCP_ACL Category=128

permit ip 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255

permit ip 10.1.1.0 0.0.0.255 10.0.2.0 0.0.0.255

ip access-list extended Any-any

remark CCP_ACL Category=128

permit ip any any

ip access-list extended Any/Any

remark CCP_ACL Category=128

permit ip host 10.0.2.0 host 10.0.1.0

ip access-list extended DMZ-Out

remark CCP_ACL Category=128

permit ip 192.168.112.0 0.0.0.255 any

ip access-list extended DMZtoAny

remark CCP_ACL Category=128

permit ip 192.168.112.0 0.0.0.255 any

ip access-list extended Hostcom-Skinny

remark CCP_ACL Category=128

permit ip 10.1.1.0 0.0.0.255 10.0.2.0 0.0.0.255

ip access-list extended InsideOut

remark CCP_ACL Category=128

permit ip 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255

ip access-list extended Ping-Hostcom

remark CCP_ACL Category=128

permit ip host 10.0.2.2 any

ip access-list extended RespondtoSomePings

remark CCP_ACL Category=128

permit ip 10.0.1.0 0.0.0.255 any

permit ip host x.x.x.x any

permit ip host 37.0.96.2 any

ip access-list extended SDM_AH

remark CCP_ACL Category=1

permit ahp any any

ip access-list extended SDM_BOOTPC

remark CCP_ACL Category=0

permit udp any any eq bootpc

ip access-list extended SDM_ESP

remark CCP_ACL Category=1

permit esp any any

ip access-list extended SDM_HTTPS

remark CCP_ACL Category=1

permit tcp any any eq 443

ip access-list extended SDM_SHELL

remark CCP_ACL Category=1

permit tcp any any eq cmd

ip access-list extended SDM_SSH

remark CCP_ACL Category=1

permit tcp any any eq 22

ip access-list extended RemoteMgt

remark CCP_ACL Category=128

permit ip host x.x.x.x any

permit ip 10.0.1.0 0.0.0.255 any

ip access-list extended any-any

remark CCP_ACL Category=128

permit ip any any

!

logging trap debugging

logging facility local2

access-list 1 remark CCP_ACL Category=2

access-list 1 permit 10.0.2.0 0.0.0.255

access-list 1 permit 192.168.112.0 0.0.0.255

access-list 23 remark HTTPS Access

access-list 23 permit 10.0.2.1

access-list 23 permit x.x.x.x

access-list 23 permit 10.0.2.0 0.0.0.255

access-list 23 permit 10.0.1.0 0.0.0.255

access-list 100 remark CCP_ACL Category=4

access-list 100 remark IPSec Rule

access-list 100 permit ip 10.0.2.0 0.0.0.255 10.1.1.0 0.0.0.255

access-list 101 remark CCP_ACL Category=2

access-list 101 remark IPSec Rule

access-list 101 deny ip 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255

access-list 101 remark IPSec Rule

access-list 101 deny ip 10.0.2.0 0.0.0.255 10.1.1.0 0.0.0.255

access-list 101 permit ip 192.168.112.0 0.0.0.255 any

access-list 101 permit ip 10.0.2.0 0.0.0.255 any

access-list 102 remark CCP_ACL Category=4

access-list 102 remark IPSec Rule

access-list 102 permit ip 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255

access-list 103 remark CCP_ACL Category=128

access-list 103 permit ip host 255.255.255.255 any

access-list 103 permit ip 127.0.0.0 0.255.255.255 any

access-list 104 permit udp any any eq bootpc

access-list 105 remark CCP_ACL Category=128

access-list 105 permit ip host x.x.x.x any

access-list 105 permit ip host x.x.x.x any

dialer-list 1 protocol ip permit

no cdp run

!

!

!

!

route-map SDM_RMAP permit 1

!

route-map SDM_RMAP_1 permit 1

match ip address 101

!

!

!

!

control-plane

!

banner exec ^C

% Password expiration warning.

-----------------------------------------------------------------------

Cisco Configuration Professional (Cisco CP) is installed on this device

and it provides the default username "cisco" for one-time use. If you have

already used the username "cisco" to login to the router and your IOS image

supports the "one-time" user option, then this username has already expired.

You will not be able to login to the router with this username after you exit

this session.

It is strongly suggested that you create a new username with a privilege level

of 15 using the following command.

username <myuser> privilege 15 secret 0 <mypassword>

Replace <myuser> and <mypassword> with the username and password you

want to use.

-----------------------------------------------------------------------

^C

banner login ^C

-----------------------------------------------------------------------

Authorised Access Only

If your not supposed to be here. Close the connection

-----------------------------------------------------------------------

^C

banner motd ^C

-----------------------------------

-----------------------------------

Access Is Restricted To  Personel ONLY^C

!

line con 0

exec-timeout 5 0

login authentication local_auth

transport output telnet

line aux 0

exec-timeout 15 0

login authentication local_auth

transport output telnet

line vty 0 4

access-class SSH-Management in

privilege level 15

logging synchronous

login authentication local_auth

transport input telnet ssh

!

scheduler interval 500

end

[jocamare]

Apply the "ip inspect log drop-pkt" command, run tests and check the logs.

[Julio Carvajal]

Hello Martin,

Please apply the following changes and let us know:

ip access-list extend DMZtoAny

1 permit udp 192.168.12.0 0.0.0.255 any eq 53

no permit ip 192.168.112.0 0.0.0.255 any

Ip access-list extended DMZ-Out

1 permit tcp 192.168.12.0 0.0.0.255 any eq 80

2 permit tcp 192.168.12.0 0.0.0.255 any eq 443

no permit ip 192.168.112.0 0.0.0.255 any

Change that, try and if it does not work post the configuration with the changes applied,

Regards,

Remember to rate all of the helfpul posts, that is as important as a thanks

Julio