Thanks! That helped, but encountered some strange behaviour of the router. For instance, when I add the commands above from the CLI (via ssh), the new policies are not displayed when accessing the router via WebUI. So I reverted back to the previous configuration and tried to configure everything via webui. The layout of my network is as follows:
|ISP|---(DHCP)----|Router|---(DHCP)---|Clients|
On the router, interface g0/0/0 (and later possibly g0/0/1, once I get fiber) are the external interfaces. They need to be able to acquire an IP via DHCP (as the ISP is handing them out this way), but every unsolicited traffic should be blocked. In particular, traffic to the webui or the ssh port should be blocked.
The router is acting as a DHCP server for the clients, who should be able to access the internet (using any protocol), but any unsolicited traffic originating on the outside/internet should be dropped at the router.
I have managed to restrict access to the webui/ssh on the external interfaces, but despite my configuration, dhcp seems also to be blocked and the router does not acquire an IP from the ISP. Please see below for my config:
version 17.6
!
!
ip name-server 8.8.8.8 8.8.4.4
ip domain name localdomain.local
ip dhcp excluded-address 192.168.1.0 192.168.1.99
!
ip dhcp pool LAN
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
lease 7
!
!
vlan internal allocation policy ascending
!
!
class-map type inspect match-any DHCP_app
match protocol udp
class-map type inspect match-any IN-TO-OUT
match access-group name IN-TO-OUT_acl
match protocol http
match protocol ftp
match protocol icmp
match protocol https
match protocol dns
match protocol smtp
match protocol pop3
match protocol tcp
match protocol udp
class-map type inspect match-all Drop_but_DHCP
match access-group name Drop_but_DHCP_acl
class-map match-any DHCP_nbar_app
match protocol dhcp
class-map type inspect match-all DHCP
match class-map DHCP_app
match access-group name DHCP_acl
!
policy-map type inspect avc DHCP_app_policy
class DHCP_nbar_app
allow
class class-default
allow
policy-map type inspect OUTSIDE-SELF-POLICY
class type inspect DHCP
inspect
service-policy avc DHCP_app_policy
class type inspect Drop_but_DHCP
drop
class class-default
drop log
policy-map type inspect INSIDE-OUTSIDE-POLICY
class type inspect IN-TO-OUT
inspect
class class-default
drop log
!
zone security INSIDE
description Zone for inside interfaces
zone security OUTSIDE
description Zone for outside interfaces
zone security default
zone-pair security INSIDE-OUTSIDE source INSIDE destination OUTSIDE
service-policy type inspect INSIDE-OUTSIDE-POLICY
zone-pair security OUTSIDE-SELF source OUTSIDE destination self
service-policy type inspect OUTSIDE-SELF-POLICY
!
!
interface GigabitEthernet0/0/0
ip dhcp client client-id ascii XXXX
ip address dhcp
ip nbar protocol-discovery
ip nat outside
zone-member security OUTSIDE
negotiation auto
!
interface GigabitEthernet0/0/1
no ip address
zone-member security OUTSIDE
shutdown
negotiation auto
!
interface GigabitEthernet0/1/0
zone-member security INSIDE
!
interface GigabitEthernet0/1/1
zone-member security INSIDE
!
[...]
interface GigabitEthernet0/1/7
zone-member security INSIDE
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
zone-member security INSIDE
!
ip http server
ip http authentication local
ip http secure-server
ip http client source-interface GigabitEthernet0/0/0
ip forward-protocol nd
ip dns server
ip nat inside source route-map track-primary-if interface GigabitEthernet0/0/0 overload
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 dhcp
!
!
ip access-list extended DHCP_acl
10 permit ip any any
ip access-list extended Drop_but_DHCP_acl
10 permit ip any any
ip access-list extended IN-TO-OUT_acl
10 permit ip any any
!
ip access-list standard 1
11 permit 192.168.1.0 0.0.0.255
!
route-map track-primary-if permit 1
match ip address 197
set interface GigabitEthernet0/0/0
!
