IOS zone-pair 防火墙的配置解析

最新推荐文章于 2023-05-29 11:58:28 发布

weixin_34331102

最新推荐文章于 2023-05-29 11:58:28 发布

阅读量641

点赞数

CC 4.0 BY-SA版权

文章标签：运维网络

原文链接：https://yq.aliyun.com/articles/452044

本文详细介绍了Cisco IOS路由器中Zone-Pair防火墙的概念及其配置方法。通过将接口划分为不同的安全区域，并使用策略地图来控制不同区域间的流量，实现精细的网络访问控制。示例展示了如何设置特定的服务访问策略。

关于zone-pair 防火墙是把ios路由器的接口分为若干个区域，不同区域之间的流量是不能通讯的，这点类似与ASA的接口类型！这里我们要注意一下几点

1.确定相同的安全接口划分到同一zone。

2.运用class-map 抓住不同zone之间的流量，可以提供3-7层的流量检测

ZBF(config-pmap-c)#?
Policy-map class configuration commands:
drop            Drop the packet
exit            Exit from class action configuration mode
inspect         Context-based Access Control Engine
no              Negate or set default values of a command
pass            Pass the packet
police          Police                       对流量执行限速
service-policy Deep Packet Inspection Engine 深度包检测
urlfilter       URL Filtering Engine    URL过滤

3.对于那个方向没有流量就不用配置了，因为默认的就是不同zone之间不允许通讯

4.policy-map service-map的运用

我们就结合下面的例子说下

要求：

Hosts in Internet zone can reach DNS, SMTP, and SSH services on one server in the DMZ. The other server
will offer SMTP, HTTP, and HTTPS services. The firewall policy will restrict access to the specific services
available on each host.
 The DMZ hosts cannot connect to hosts in any other zone.
 Hosts in the client zone can connect to hosts in the server zone on all TCP, UDP, and ICMP services.
 Hosts in the server zone cannot connect to hosts in the client zone, except a UNIX-based application server
can open X Windows client sessions to X Windows servers on desktop PCs in the client zone on ports 6900 to
6910.
 All hosts in the private zone (combination of clients and servers) can access hosts in the DMZ on SSH, FTP,
POP, IMAP, ESMTP, and HTTP services, and in the Internet zone on HTTP, HTTPS, and DNS services and
ICMP. Furthermore, application inspection will be applied on HTTP connections from the private zone to the
Internet zone in order to assure that supported instant messaging and P2P applications are not carried on port
80. (See Figure 3.)

配置

class-map type inspect match-any pr-to-DMZ-class
match protocol ssh
match protocol http
match protocol pop3
match protocol imap
class-map type inspect match-any pr-to-bublic
match protocol http
match protocol https
match protocol dns
match protocol icmp
class-map type inspect match-any dns-http-class
match protocol dns
match protocol http
class-map type inspect match-any smtp-class
match protocol smtp
class-map type inspect match-all smtp-acl-class
match access-group 111
match class-map smtp-class
class-map type inspect match-any x-class
match protocol uucp
class-map type inspect match-all client-to-server-class
match protocol tcp
match protocol udp
match protocol icmp
class-map type inspect match-all dns-http-acl-class
match access-group 110
match class-map dns-http-class
!
!
policy-map type inspect server-to-client-policy
class type inspect x-class
class class-default
policy-map type inspect clinet-to-server-policy
class type inspect client-to-server-class
inspect
class class-default
policy-map type inspect pr-to-public-policy
class type inspect pr-to-bublic
inspect
class class-default
policy-map type inspect pr-to-DMZ-policy
class type inspect pr-to-DMZ-class
inspect
class class-default
policy-map type inspect internet-dmz-policy
class type inspect dns-http-acl-class
inspect
class type inspect smtp-acl-class
inspect
class class-default
!
zone security DMZ
zone security pr
zone security public
zone security server
zone security client
zone-pair security pr-to-public source pr destination public
service-policy type inspect pr-to-public-policy
zone-pair security pr-to-DMZ source pr destination DMZ
service-policy type inspect pr-to-DMZ-policy
zone-pair security public-to-DMZ source public destination DMZ
service-policy type inspect internet-dmz-policy
zone-pair security servers-clients source server destination client
service-policy type inspect server-to-client-policy
zone-pair security client-to-server source client destination server
service-policy type inspect clinet-to-server-policy

interface FastEthernet0/0
ip address 172.16.1.1 255.255.255.0
zone-member security public
duplex auto
speed auto
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
interface FastEthernet1/0
!
interface FastEthernet1/1
!
interface FastEthernet1/2
!
interface FastEthernet1/3
!
interface FastEthernet1/4
!
interface FastEthernet1/5
!
interface FastEthernet1/6
!
interface FastEthernet1/7
!
interface FastEthernet1/8
!
interface FastEthernet1/9
!
interface FastEthernet1/10
!
interface FastEthernet1/11
!
interface FastEthernet1/12
!
interface FastEthernet1/13
no switchport
ip address 172.16.2.1 255.255.255.0
zone-member security DMZ
!
interface FastEthernet1/14
switchport access vlan 2
!
interface FastEthernet1/15
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
zone-member security server
!
interface Vlan2
ip address 192.168.2.1 255.255.255.0
zone-member security client
!
router rip
version 2
network 172.16.0.0
network 192.168.1.0
network 192.168.2.0
no auto-summary
!
ip route 0.0.0.0 0.0.0.0 172.16.1.2
!
!
ip http server
no ip http secure-server
!
access-list 110 permit ip any host 172.16.2.2
access-list 111 permit ip any host 172.16.2.3