ZBF Logging (dropped packets) on IOS-XE

[Heinz Schwarzfeuer]

Hi,

I´ve configured a Cisco 4331 with the Zone Based Firewall (ZBF) features. Everything works fine so far, but when I wanted to take a closer look to the dropped packets I noticed that not all are shown.

I switched it on globally using:

parameter-map type inspect global
 log dropped-packets

Afterwards I tried to "attack" the routers protected "self" zone doing a telnet and a portscan, which was all blocked as intended, but none of these blocked pakets have been shown in the routers log (nor on the terminal monitor), whereas other blocked packets (going to different zones) are shown.

Any ideas?

Here is my configuration:

parameter-map type inspect global
 log dropped-packets

class-map type inspect match-any CM-INSPECT_GUESTS-TO-SELF
match access-group name CLM-ACL_INSPECT_GUESTS-TO-SELF

class-map type inspect match-any CM-PASS_GUESTS-TO-SELF
match access-group name CLM-ACL_PASS_GUESTS-TO-SELF_DHCP

class-map type inspect match-any CM-PASS_SELF-TO-GUESTS
match access-group name CLM-ACL_PASS_SELF-TO-GUESTS_DHCP

policy-map type inspect PM_SELF-TO-GUESTS
class type inspect CM-PASS_SELF-TO-GUESTS
pass
class class-default
drop log

policy-map type inspect PM_GUESTS-TO-SELF
class type inspect CM-INSPECT_GUESTS-TO-SELF
inspect
class type inspect CM-PASS_GUESTS-TO-SELF
pass
class class-default
drop log

ip access-list extended CLM-ACL_INSPECT_GUESTS-TO-SELF
permit icmp 192.168.51.0 0.255.255.255 host 192.168.51.1 echo
permit icmp 192.168.51.0 0.255.255.255 host 192.168.51.1 echo-reply


ip access-list extended CLM-ACL_PASS_GUESTS-TO-SELF_DHCP
permit udp any eq bootpc any eq bootps

ip access-list extended CLM-ACL_PASS_SELF-TO-GUESTS_DHCP
permit udp any eq bootps any eq bootpc

zone-pair security ZP_GUESTS-TO-SELF source ZN_GUESTS destination self
service-policy type inspect PM_GUESTS-TO-SELF

zone-pair security ZP_SELF-TO-GUESTS source self destination ZN_GUESTS
service-policy type inspect PM_SELF-TO-GUESTS

Many thanks!

[Heinz Schwarzfeuer]

No one any idea?

[m.markocevic]

I have the same problem. Any help is appreciated?

[fblackfire]

Ever solved it?

[rhbmcse]

Mine works - try splitting out this section into two policy maps.

You have an inspect and a pass both contained within a single PM (one for each CM) and finally a drop log.

The drop log is most probably applying to the latter 'pass' rule and thus not logging anything as everything has erm...passed!  :)

Happy to help.

Rob.

policy-map type inspect PM_GUESTS-TO-SELF
class type inspect CM-INSPECT_GUESTS-TO-SELF
inspect
class type inspect CM-PASS_GUESTS-TO-SELF
pass
class class-default
drop log