Good Morning
Before I continue researching this particular avenue, I want to make sure I am on the right path.
As we already know, I have 8 Static IP W/ 5 Usable;
1 - Email Server (Only)
1 - Web Site (Only)
1 - Home Router (for anything from surfing to torrent to streaming Netflix)
1 - Vacant
1 - Vacant
With this setup, am I abe to create, let’s say, 4 Zones.. INCOMING/OUTGOING with general purpose, a EMAIL Zone which allows only incoming/outgoing pertaining to Email Ports and then a WWW Zone which only allows incoming/outgoing for Web Server.
Zone INCOMING
Zone OUTGOING
Zone EMAIL
Zone WEBSERVER
Then associate the Interfaces accordingly...to the Zone.. and then associating each INTERFACES (Zone really, as I will treat the specific Interface as a Zone as they will be “hard wired” to their destination) for inter network traffic.
So very generically, being that x.x.121.182 is Router and x.x.121.180 is Email... And that my .176 Wireless Router will be using the basic Incoming/Outoung Zone.
#zone security INSIDE
#zone security OUTSIDE
#zone security EMAIL
#interface Vlan1
#zone-member security INSIDE
#interface Dialer1
#zone-member security OUTSIDE
#interface gigabitEthernet4
#zone-member security EMAIL
#zone-pair security IN-TO- OUT source INSIDE destination OUTSIDE
#zone-pair security OUT- TO-IN source OUTSIDE destination INSIDE
#zone-pair security OUT- TO-EMAIL source OUTSIDE destination EMAIL
#zone-pair security IN-TO- EMAIL source INSIDE destination EMAIL
—- Would I even need this? Sending email from home to myself isn’t something I do..
#ip access-list extended INSIDE-TO-OUTSIDE
#permit tcp 207.108.121.0 0.0.0.255 any eq www
#permit icmp 207.108.121.0 0.0.0.255 any icmp
#class-map type inspect match-all INSIDE-TO-OUTSIDE-CLASS
#match access-group name INSIDE-TO-OUTSIDE
———This means anyone on the block of IP’s 207.108.121.x will have said access out?
#ip access-list extended OUTSIDE-TO-INSIDE
#permit icmp any 207.108.121.0.0.0.255
#class-map type inspect match-all OUTSIDE-TO-INSIDE-CLASS
#match access-group name OUTSIDE-TO-INSIDE
——— This means any IP in the Block can get incoming ICMP Requests?
#ip access-list extended OUTSIDE-TO-EMAIL
#permit tcp any 207.108.121.180 0.0.0.0 eq imap
#class-map type inspect match-all OUTSIDE-TO-EMAIL-CLASS
#match access-group name OUTSIDE-TO-EMAIL
——— This mean that IP ending in .180 is the only recipient on the Block accepting incoming IMAP (993)?
——— or is the IP irrelevant because the Zone is going to be associated with the Interface, which only goes ——— to .180.
#ip access-list extended INSIDE-TO-EMAIL
#permit tcp 207.108.121.0 0.0.0.0 eq imap
#permit icmp 207.108.121.0 0.0.0.255
#class-map type inspect match-all INSIDE-TO-EMAIL-CLASS
#match access-group name INSIDE-TO-EMAIL
——— I assume the same concept as Outside to In?
#ip access-list extended EMAIL-TO-OUTSIDE
#permit tcp 207.108.121.180 0.0.0.0 eq smtp
#permit tcp 207.108.121.180 eq www
#permit icmp 207.108.121.0 0.0.0.255
#class-map type inspect match-all INSIDE-TO-EMAIL-CLASS
#match access-group name INSIDE-TO-EMAIL
——— I assume this allows me to send to the Internet using SMTP (25)
#policy-map type inspect INSIDE-TO-OUTSIDE-POLICY
#class type inspect INSIDE-TO-OUTSIDE-CLASS
#inspect
#class class-default
#drop log
#policy-map type inspect OUTSIDE-TO-INSIDE-POLICY
#class type inspect OUTSIDE-TO-INSIDE-CLASS
#pass
#class class-default
#drop log
#policy-map type inspect OUTSIDE-TO-EMAIL-POLICY
#class type inspect OUTSIDE-TO-EMAIL-CLASS
#inspect
#class class-default
#drop log
#policy-map type inspect INSIDE-TO-EMAIL-POLICY
#class type inspect INDISE-TO-EMAIL-CLASS
#Pass
#class class-default
#drop log
#zone-pair security IN-TO- OUT source INSIDE destination OUTSIDE
#service- policy type inspect INSIDE-TO-OUTSIDE- POLICY
#zone-pair security OUT- TO-IN source OUTSIDE destination INSIDE
#service- policy type inspect OUTSIDE-TO-INSIDE- POLICY
#zone-pair security OUT- TO-EMAIL source OUTSIDE destination EMAIL
#service- policy type inspect OUTSIDE-TO-EMAIL- POLICY
#zone-pair security IN-TO- EMAIL source INSIDE destination EMAIL
#service- policy type inspect INSIDE-TO-EMAIL- POLICY
Or did I just make this all out of control.
