Hi guys,
as i very recently figured out that a router (ISR4k, IOS-XE 17.09) finally supports FQDN-based objects it raised my hope i could use it to adjust the network, for helping us with our microsoft pain. Since you cannot be recent enough about their "to be unblocked" IP-lists, which are never complete.
The given challenge is as follows:
We have on lots of locations well defined access-lists, which we cannot just throw overboard because of ideas from the garage boys in Redmond.
My idea was that i could use the new feature in a way that it checks via ZBFW some FQDNs given by Microsoft, resolvable by DNS from the router itself, and after enabling communication to these, proceeds with working through the old access-lists with all the other restrictions.
But i seem not to understand how to use it properly.
Let´s do an example, so maybe you get better what i mean...as you can see, the hosts in this example shall not talk directly to outside, just ONE host, the proxy. In my example the 192.168.1.222.
My idea was to let ZBFW do the FQDN-work, making Microsoft-users happy, and still preserve the partly HUGE ACLs.
class-map type inspect match-any ALLOWED-FROM-OUTSIDE
match protocol tcp
match protocol udp
match protocol ntp
class-map type inspect match-any ALLOWED-PROTOCOLS
match protocol tcp
match protocol udp
match protocol ntp
!
object-group fqdn MICROSOFT-FQDNS
pattern .*\.microsoft\.com
pattern microsoft\.de
!
object-group service MICROSOFT-SERVICES
icmp
tcp eq 80
!
ip access-list extended ALLOW-MICROSOFT
permit object-group MICROSOFT-SERVICES any fqdn-group MICROSOFT-FQDNS
deny ip any any
!
class-map type inspect match-any ALLOW-MICROSOFT-CLASS
match access-group name ALLOW-MICROSOFT
!
policy-map type inspect WAN2INSIDE
class type inspect ALLOWED-FROM-OUTSIDE
inspect
class class-default
!
policy-map type inspect FIREWALL4MICROSOFT
class type inspect ALLOW-MICROSOFT-CLASS
inspect
class type inspect ALLOWED-PROTOCOLS
inspect class
class-default
drop
!
ip access-list extended WAN-IN
.
.
.
!
ip access-list extended LAN-IN
permit ip host 192.168.1.222 any
deny 192.168.1.0 0.0.0.255 any
!
int gi1
ip access-group WAN-IN
zone-member security OUTSIDE
ip nat outside
!
int gi2
ip access-group LAN-IN
zone-member security INSIDE
ip address 192.168.1.1 255.255.255.0
ip nat inside
In my understanding ZBFW checks before the ACL is processed (?), and therefore it should be possible somehow to use the new FQDN-object-group to enable talking to the vast bunch of everchanging microsoft addresses, using the FQDNs.
I simply cannot make it work, i also tried to use the object-group in a normal ACL-line, i could put it in, but it had no effect and also no matches.
ip access-list extended LAN-IN
5 permit object-group MICROSOFT-SERVICES any fqdn-group MICROSOFT-FQDNS
Can someone give me a kick in the right direction, about what i am doing wrong here?
Many thanks in advance,
Andreas
