Zone-Based Firewall on ASR 1000 Series With Virtual Template

[FaisalAlBandar2523]

Hello everyone,

I am trying to implement ZBF on an ASR 1001-X device, which is used as a subscriber gateway. The end result I have in mind, is to limit the number of concurrent sessions (per user) that a certain protocol is allowed to make.

The device has a Virtual-Template configured. I've made the necessary configurations to enable the ZBF, along with the session limit.

Then I added the Virtual-Template interface to the appropriate zone.

It worked! But not as I intended. Now the limit is applied across all users - so if one user exhausts the allowed number of concurrent sessions, other users have to wait, because the number is shared among them.

I've attached a file which contains the relevant pieces of configuration. In this example, I aim to make each user be able to perform 5 pings at the same time. The undesired result which I'm getting, is that all users have 5 concurrent pings which they share between them. So if one user is pinging 5 devices at the same time, all the other users cannot ping. This is not what I want to achieve.

How can I ensure that the limit is applied per user, and not across all users?

[Aref Alsouqi]

Good question. I don't think that is possible, unless the router is proxying for user authentications, and receiving some attributes from the authentication server that would allow it to map specific users to a specific group. Then, that group reference could be used in the match condition on the class-map.

[FaisalAlBandar2523]

Hello Aref, and thank you for your reply.

The router is indeed relaying user authentication requests to an authentication server, which then replies back with the appropriate attributes. In this case, should one of the attributes be the zone to which the user belongs? Can the router (ASR) create zones on the fly, or should they be pre-configured in anticipation of user connections? We're talking about hundreds to possible thousands of subscribers, all connecting via virtual-access ports, which get their config from the aforementioned virtual-template.