C8200-1N-4T Router. ZBFW passing SCTP

[Karma0]

Hello,

Does anybody knows how I can pass/allow just SCTP traffic between two different security zones?

zone security ZONE_OUTSIDE

zone security ZONE_INSIDE

I also have an extended ACL in which it is not possible to allow only the sctp protocol.

I only get it to work if I allow IP traffic in the ACL (it is not feasible to allow all IP traffic for security reasons)

class-map type inspect match-any CMAP_PROTOCOLS_INSPECT_OUTSIDE_TO_IN

    match protocol sctp

ip access-list extended ACL_OUTSIDE_IN

   permit sctp ip_1 ip_2

   permit ip ip_1 ip_2 (This option is not secure)

PD. We are trying with IOS XE 17.12.3a firmware but this does not work. ¿Any workaround?

[MHM Cisco World]

This all config ?

Where is config of policy and zone pair?

Check this 

https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html

MHM

[Karma0]

Hi MHM, please see the rest of configuration I am posting later.

Checking the arcticle you linked, SCTP is nos mentioned at all, and it states that configuring ZBFW class-maps are specified for layer 4 protocols (TCP UDP and ICMP). No mention for SCTP protocol. 

[MHM Cisco World]

the guide is how you config zone class/policy/pair 
and if your router support match protocol sctp then it can filter it 
what you need is 
1- class match all 

A- match sctp protcol 

B- match acl 

2- policy use class above and action inspect 
3- zone pair from IN to OUT use policy above <<- you can other direction from OUT to IN 
MHM

[paul driver]

Hello
fyi the protocol match needs to before any  match on a acl

can you post the following :
sh policy-firewall config all

Edited - have you checked if sctp is listed as an application protocol ?

[Karma0]

Hi, the configuration include policy-maps class-maps, zpairs... and it works if matching protocols different than SCTP. Configuration is as follows:

!!!!!!!!!!!ASIGNING INTERFACES TO ZONES !!!!!!!!!!!!!

interface GigabitEthernet0/0/0

      zone-member security ZONE_OUTSIDE

interface GigabitEthernet0/0/1

      zone-member security ZONE_INSIDE

!!!!!!!!!!!!!DEFINING SECURITY ZONES!!!!!!!!!!!!!!!!!!

zone security ZONE_OUTSIDE

zone security ZONE_INSIDE

!!!!!!!!!!!!!DEFINING CLASS-MAP!!!!!!!!!!!!!!!!!!!

class-map type inspect match-any CMAP_PROTOCOLS_INSPECT_INSIDE_TO_OUT

     match protocol h323

     match protocol sctp

class-map type inspect match-any CMAP_PROTOCOLS_INSPECT_OUTSIDE_TO_IN

     match protocol h323

     match protocol sctp

class-map type inspect match-all CMAP_INSIDE_TO_OUT

     match access-group name ACL_INSIDE_OUT

class-map type inspect match-all CMAP_OUTSIDE_TO_IN

     match access-group name ACL_OUTSIDE_IN

 !!!!!!!!!!!!DEFINING POLICY-MAPS!!!!!!!!!!!!!!!!!!!!

policy-map type inspect PMAP_INSIDE_TO_OUT

    class type inspect CMAP_PROTOCOLS_INSPECT_INSIDE_TO_OUT

        pass

    class type inspect CMAP_INSIDE_TO_OUT

       inspect

    class class-default

       drop log

policy-map type inspect PMAP_OUTSIDE_TO_IN

    class type inspect CMAP_PROTOCOLS_INSPECT_OUTSIDE_TO_IN

        inspect

    class type inspect CMAP_OUTSIDE_TO_IN

       inspect

   class class-default

 !!!!!!!! DEFINING ZONE-PAIRS!!!!!!!!!

zone-pair security ZPAIR_OUTSIDE_TO_IN source ZONE_OUTSIDE destination ZONE_INSIDE

      service-policy type inspect PMAP_OUTSIDE_TO_IN

zone-pair security ZPAIR_INSIDE_TO_OUT source ZONE_INSIDE destination ZONE_OUTSIDE

     service-policy type inspect PMAP_INSIDE_TO_OUT

 !!!!!!!! DEFINING ACL!!!!!!!!!

ip access-list standard ACL_INSIDE_OUT

      permit any

ip access-list extended ACL_OUTSIDE_IN

     “Permit only sctp protocol”

[MHM Cisco World]

FW#sh policy-map type insp zone-pair PMAP_INSIDE_TO_OUT/PMAP_OUTSIDE_TO_IN

share these output 

MHM 

[MHM Cisco World]

any update?

MHM

[paul driver]

Hello

---

@Karma0 wrote:.
and it works if matching protocols different than SCTP.

 No mention for SCTP protocol. 

Apologies for keep asking this, but is sctp actually showing as a application protocol, if it doesn't them you WILL need to used an ACL to specify the port number and obtain a match for it traffic??
Alternatively you could try downloading a newer PDLM for the rtr to see if that includes a SCTP application?