IOS Zone Based Firewall : match ports which have no protocol

[Marcel Tempelman]

Hi all,

I'm trying to setup a IOS(-XE) based ZFB-firewall to filter and block traffic between 2 LAN-segments. I have a list of ports which I want to allow but I find it hard to find an example to match a port in a class map if the port does not match a known protocol. Every example is like this:

class-map type inspect match-any DMZ-SERVER-ALLOWED-PROTOCOLS
 match protocol http
 match protocol https
exit
class-map type inspect match-all DMZ-SERVER-ALLOWED-TRAFFIC
 match access-group name DMZ-SERVER-FROM-OUTSIDE
 match class-map DMZ-SERVER-ALLOWED-PROTOCOLS

But what to use if you need for example port range tcp/7011-7050 ? Is using an ACL like this the proper way ?

ip access-list extended ACL-Allowed-Ports

 permit tcp any any range 7011 7050

!

class-map type inspect match-any DMZ-SERVER-ALLOWED-PROTOCOLS
 match protocol http
 match protocol https

 match access-group name ACL-Allowed-Ports

!

If this works, can I extend this ACL with other ports or do I need a seperate ACL per port/port range ?

What about Object-Groups ? Are they usable ?

I have so many questions and there is so little documentation outside the simple http/https/ssh and VPN-examples.

With kind regards,

Marcel Tempelman

[Marius Gunnerud · Accepted solution]

Well, as you have already mentioned, and actually answered your own question, yes, the way to do this is through ACL and match that ACL in the class-map.  You can have as many ACL entries in the ACL you create as you require.

You can ofcourse use an object group to group IPs and subnets that require the same type of access, there is no reason why you should not do this.