cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1360
Views
0
Helpful
2
Replies
lcaruso
Frequent Contributor

ZBF vs. interface ACL

Hi,

I know interface ACLs are not applicable with ZBF, so a different implementation is used. That's documented elsehwere.

What I don't know is, given the outside interface ACL for my router (below), how do I implement some of those features? For example, the Guide to Harden Cisco IOS Devices recommends dropping fragments. How would I do that with ZBF?

Another question is with ZBF are some of these ACEs shown below no longer necessary?

ip access-list extended outside_in

deny   tcp any any fragments

deny   udp any any fragments

deny   icmp any any fragments

deny   ip any any fragments

deny   ip host 0.0.0.0 any

deny   ip host 255.255.255.255 any

deny   ip 0.0.0.0 0.255.255.255 any

deny   ip 10.0.0.0 0.255.255.255 any

deny   ip 127.0.0.0 0.255.255.255 any

deny   ip 169.254.0.0 0.0.255.255 any

deny   ip 172.16.0.0 0.15.255.255 any

deny   ip 192.0.0.0 0.0.0.255 any

deny   ip 192.0.2.0 0.0.0.255 any

deny   ip 192.168.0.0 0.0.255.255 any

deny   ip 198.18.0.0 0.1.255.255 any

deny   ip 198.51.100.0 0.0.0.255 any

deny   ip 203.0.113.0 0.0.0.255 any

deny   ip 224.0.0.0 31.255.255.255 any

Thanks.

1 ACCEPTED SOLUTION

Accepted Solutions
Maykol Rojas
Cisco Employee

Hi Larry,

Fragments are not entire bad on an IP network, it is common that if the packets are too big it will fragment them. ZBF has a queue for the fragments and it the packet has an anomaly, it will drop it. Now, if you want to control the IP fragments coming into your network, you can use the command IP virtual reassembly, that way you can limit the amount of fragments that come in to the network.

Fragmentation attacks should not be a problem if you have Stateful firewall such as zone based firewall.

Hope this helps.

Mike

Mike

View solution in original post

2 REPLIES 2
Maykol Rojas
Cisco Employee

Hi Larry,

Fragments are not entire bad on an IP network, it is common that if the packets are too big it will fragment them. ZBF has a queue for the fragments and it the packet has an anomaly, it will drop it. Now, if you want to control the IP fragments coming into your network, you can use the command IP virtual reassembly, that way you can limit the amount of fragments that come in to the network.

Fragmentation attacks should not be a problem if you have Stateful firewall such as zone based firewall.

Hope this helps.

Mike

Mike
lcaruso
Frequent Contributor

Hi Mike,

Thanks for the information. I'm using RBE on an 887VA dsl interface, and I was informed that turning off ip virtual reassembly was recommended for this scenario. However, when I tried that on v15.1 it took the command but displayed nothing even in show run all. So I don't know if it is on or off or even exists.

When it is used, how does ip virtural reassembly control fragments?

I like the ZBF. I'm just not very comfortable with how to accomplish certain tasks yet.

Create
Recognize Your Peers
Content for Community-Ad