When I enable basic firewall through SDM it breaks DHCP

[slerbeton79]

First I apologise if this is in wrong location but I am stumped.   Using SDM when I go through the firewall wizard and choose basic firewall, and choose low security, even though it detects my WAN outside interace as dhcp client and prompts to allow DHCP traffic I am unable to receive an IP from my ISP.

My full config is attached

[Giuseppe Larosa]

Hello Sheldon,

SDM implements a zone based firewall: there is an in-zone = internal interface an out zone = interface  to ISP and self = router

The lines that specify how to behave are:

zone-zone security out-zone
zone security in-zone
pair security sdm-zp-self-out source self destination out-zone
service-policy type inspect sdm-permit-icmpreply
zone-pair security sdm-zp-out-self source out-zone destination self
service-policy type inspect sdm-permit
zone-pair security sdm-zp-in-out source in-zone destination out-zone
service-policy type inspect sdm-inspect

referenced objects:

policy-map type inspect sdm-permit-icmpreply
class type inspect sdm-icmp-access
  inspect
class class-default
  pass

class-map type inspect match-all sdm-icmp-access
match class-map sdm-cls-icmp-access

class-map type inspect match-any sdm-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp

!the DHCP request should be able to go out on WAN FE that  is in out zone.

!traffic coming back from out zone to router is verified by  the following line:

zone-pair security sdm-zp-out-self source out-zone destination self
service-policy type inspect sdm-permit

! going on invoked objects:

policy-map type inspect sdm-permit
class class-default
  drop
!

traffic coming from out zone and directed to router is dropped add on the CLI:

get enabled access via console or telnet on internal interface

config t

access-list 111 permit udp any any eq bootp

class-map type inspect match-all dhcp-return
match access-group 111

rewrite the policy as:

no policy-map type inspect sdm-permit

! to delete current policy-map

! then add

policy-map type inspect sdm-permit
class dhcp-return
pass
class class-default
  drop

Hope  to help
Giuseppe

[slerbeton79]

Well this change certainly allows dhcp to pass thorugh and I can get an IP from my ISP but it also completely disable the firewall as well... I am trying to keep firewall with the config I have but change it so DHCP traffic is allowed.  The SDM provides a prompt to allow dhcp but doesn't work...

[Giuseppe Larosa]

Hello Sheldon,

>> but it also completely disable the firewall as well.

this is not correct your zone based firewall should be still there just relaxed on bootp traffic.

>> The SDM provides a prompt to allow dhcp but doesn't work...

a workaround has been proposed feel free to not implement it.

Hope to help

Giuseppe

[slerbeton79]

Okay I made a mistake on CLI... the new commands were added but still didn't work, attached is

the new error from dhcp i get....

[Giuseppe Larosa]

Hello Sheldon,

I would say that these error messages demonstrate that now the router can receive bootp packets on the WAN interface associated to out-zone.

It should be interesting to see if your router is able to send out its own DHCP requests.

if you access the router from console you can do the following:

enable the dhcp debugging

shut the WAN fastethernet

enable it again

let's see if shows its own packets sent out

also check with sh interface fasx/y what MAC address is on your interface to see if really these messages are out of context.

where fasx/y is the WAN facing interface

Hope to help

Giuseppe

[slerbeton79]

Okay so here's the screen shot of the dhcp log and result of sh int as well as the new config file

[Giuseppe Larosa]

Hello Sheldon,

I don't see applied the new service-policy sdm-permit:

zone-pair security sdm-zp-out-self source out-zone destination self

it should be changed in:

zone-pair security sdm-zp-out-self source out-zone destination self
service-policy type inspect sdm-permit

Hope to help

Giuseppe

[slerbeton79]

okay attached is updated config, but still getting the received bootrep pkt Not for US error.  Any more ideas?