Cisco IOS Firewall Fundamentals

The final section of this chapter describes the Cisco IOS Firewall suite which can also be used to protect the data plane. While most network environments typically employ dedicated appliances, such as the Cisco Adaptive Security Appliance (ASA) Firewall and a Network-based Intrusion Prevention System (NIPS) such as the Cisco IPS 4200 Sensors, Cisco IOS software also provides in-built firewall and intrusion prevention capabilities with which, as a network engineer, you should be familiar with.

The Cisco IOS Firewall suite provides a single point of protection at the network perimeter, making security policy enforcement and inherent component of the network. The Cisco IOS Firewall is comprised of the following functions and technologies:

1. Cisco IOS Stateful Packet Inspection
2. Context-Based Access Control
3. Intrusion Prevention System
4. Authentication Proxy
5. Port-to-Application Mapping
6. Network Address Translation
7. Zone-Based Policy Firewall

NOTE: Keep in mind that this is not a security exam. While it is an expectation that you are familiar with the basic Cisco IOS Firewall fundamentals, we will not be going into advanced detail on this feature or other related security features.

Cisco IOS Stateful Packet Inspection

Cisco IOS Stateful Packet Inspection, or SPI, provides firewall capabilities designed to protect networks against unauthorized traffic and to control legitimate business-critical data.  Cisco IOS SPI maintains state information and counters of connections, as well as the total connection rate through the firewall and intrusion prevention software.

Stateful firewalls perform Stateful Packet Inspection (SPI) or Stateful Inspection and keep track of the state of network connections, such as TCP, UDP streams traveling across them. The Cisco IOS Firewall is a Stateful firewall that uses the inherent Stateful inspection engine of Cisco IOS Software for maintaining the detailed session database, which is referred to as the state table.

Stateful firewalls are able to hold a significant amount of attributes for each connection in their memory, from start to finish. These attributes, which are known as connection state, may include such details as the IP addresses and port numbers involved in the connection, as well as the sequence numbers of the packets traversing the connection. When running Cisco IOS Classic Firewall, which is described later in this chapter, you can use the show ip inspect sessioncommand to view the state table. Following is a sample output of this command:

Context-Based Access Control

Context-Based Access Control, or CBAC, is a Stateful inspection firewall engine that provides dynamic traffic filtering capabilities. CBAC, which is also known as the Classic IOS Firewall, provides and advanced firewall engine which provides advanced traffic-filtering functionality to Cisco IOS routers. The main features of Context-Based Access Control are:

1. It protects the internal network from external intrusion or other threats
2. It provides Denial of Service (DoS) protection
3. It provides per-application control mechanisms
4. It examines Layer 3 and Layer 4, as well as Application Layer information
5. It maintains state information for every connection
6. It generates real-time event alert failures and log messages
7. It provides enhanced audit trail features

CBAC inspects all traffic that traverses the firewall and maintains state information for all TCP and UDP sessions. This state information is then used to create temporary (dynamic) ACL openings through the firewall to allow returning traffic that was originated internally access. These temporary openings are maintained for the duration of the session. Packets that enter the firewall are subject to inspection only if they first pass the inbound ACL at the input interface and outbound ACL at the output interface. If a packet is denied by the ACL, the router will simply drop it without CBAC inspection. Figure 8-3 illustrates basic Cisco IOS CBAC operation:

Fig. 8-3. Understanding CBAC Operation

Referencing Figure 8-3, traffic from the internal (trusted) network is permitted by an ACL that is statically configured on the router allowing host 10.1.1.1 to communicate with host 172.1.1.1 on the external network (untrusted). This information is stored in the state table. CBAC then creates a dynamic ACL entry allowing return traffic from external host 172.1.1.1 to internal host 10.1.1.1. This dynamic ACL is maintained only for the duration of the session. Because a dynamic ACL is created for return traffic, only traffic originating from the internal network is allowed back by the firewall. In other words, if host 172.1.1.1 simply attempted to initiate a connection to host 10.1.1.1, the connection would be dropped.

You can use the show ip inspect sessions detail command to view detailed session inspection when troubleshooting CBAC problems. Following is a sample output of this command which shows an ICMP Echo request which was sent by host 10.1.1.1 to 172.1.1.1:

Referencing the output above, CBAC creates a dynamic ACL entry named CBAC-ACL which allows return traffic, i.e. the ICMP Echo response, from host 172.1.1.1 to host 10.1.1.1. This dynamic entry is based on the static ACL applied to the internal or trusted router interface. Another useful command when troubleshooting CBAC issues is the show ip inspect interfacescommand. This command shows the internal (trusted) and external (untrusted) interfaces. The internal interface should have an inbound CBAC inspection rule applied to it while the external interface should have an outbound CBAC inspection rule applied to it. This allows the router to inspect traffic ingressing the trusted interface and destined out the untrusted interface; which in turn allows it to create a dynamic entry for the return traffic as it was originated behind the trusted interface. Following is a sample output of this command:

Referencing the output above, the inbound inspection rule named TSHOOT-CBAC has been applied in the inbound direction to the FastEthernet0/0 interface (trusted) while the same outbound inspection rule has been applied in the outbound direction to the Serial0/0 interface (untrusted). An ACL named CBAC-ACL is used to permit or deny traffic.

NOTE: You are not expected to perform any CBAC configuration in the TSHOOT exam. In addition, you are not expected to perform any advanced CBAC troubleshooting.

Intrusion Prevention System

The Cisco IOS Intrusion Prevention System (IPS) is an inline intrusion detection and prevention sensor that scans packets and sessions flowing through the router to identify any of the Cisco IPS signatures that protect the network from internal and external threats. Some key features of the Cisco IOS Intrusion Prevention System are:

1. It protects the network from viruses, worms and a large variety of threats and exploits
2. It eliminates the need for a standalone IPS device
3. It provides integrated inline deep-packet inspection
4. It complements the Cisco IOS Firewall and VPN solutions for superior threat protection
5. It supports about 2000 attack signatures
6. It uses Cisco IOS routing capabilities to deliver integrated functionality
7. It enables distributed network-wide threat mitigation
8. It sends a Syslog message or an alarm in SDEE format when a threat is detected

NOTE: SDEE (Security Device Event Exchange) specifies the format of messages and protocols used to communicate events generated by security devices. SDEE specifies that events can be transported using the HTTP or HTTP over SSL and TLS protocols. SDEE is the default protocol used by Cisco IPS Sensor software, as well as by the Cisco IOS IPS feature set used on Cisco IOS routers. SDEE can also be used by tools such as Cisco Router and Security Device Manager (SDM) to pull event logs from Cisco IOS software routers.

When a Cisco IOS router will be acting as an IPS device, it needs to have a place to store the signature files, referred to as Signature Definition Files (SDFs) that it will use to identify malicious traffic. A Signature Definition File is a file, usually in XML format, that contains signature definitions that can be used to load signatures on the Cisco IOS router.  In most cases, the SDF is located in the router Flash Memory; however, Cisco IOS routers also have the capability to reference multiple Signature Definition Files located on network servers, such as on TFTP servers for example, for increased signature coverage.

NOTE: IOS IPS troubleshooting is beyond the scope of the current TSHOOT exam and will not be included in this guide.

Authentication Proxy

The Authentication Proxy feature, also known as Proxy Authentication, allows administrators to enforce security policy on a per-user basis. With this feature, administrators can authenticate and authorize users on a per-user policy with access control customized to an individual level. The Authentication Proxy feature intercepts HTTP or HTTPS sessions and prompts the user for a username and password if the user has not been previously authenticated.  Authentication Proxy configuration and detailed knowledge is beyond the scope of the TSHOOT requirements and will not be described in detail in this guide.

Port-to-Application Mapping

Port-to-Application Mapping, or PAM, allows administrators to customize TCP or UDP ports numbers for network services or applications to non-standard ports. For example, administrators could use PAM to configure standard HTTP traffic, which uses TCP port 80 by default, to use TCP port 8080. PAM is also used by CBAC, which uses this information to examine non-standard Application Layer protocols. PAM configuration and troubleshooting is beyond the scope of the TSHOOT and will not be described in detail in this guide.

Network Address Translation

Network Address Translation, or NAT, is used to hide internal addresses, which are typically private address (i.e. RFC 1918 addresses) from networks that are external to the firewall. The primary purpose of NAT is address conservation for networks that use RFC 1918 addressing due to the shortage of globally routable IP (i.e. public) address space. NAT provides a lower level of security by hiding the internal network from the outside world. NAT configuration is described in additional detail later in this guide.

Zone-Based Policy Firewall

Zone-Based Policy Firewall, or ZPF, is a new Cisco IOS Firewall feature designed to replace and address some of the limitations of CBAC, the Classic Firewall. ZPF allows Stateful inspection to be applied on a zone-based model, which provides greater granularity, flexibility, scalability, and ease-of-use over the Classic Firewall.

ZPF provides greater granularity, flexibility, scalability, as well as an easy-to-use zone-based security approach. With a zone-based inspection model, varying policies can be applied to multiple groups of hosts connected to the same interface. The security zones used in ZPF establish the security boundaries of the network where traffic is subjected to policy restrictions as it crosses to another zone within the network. As is the case with CBAC, the Cisco IOS ZPF configuration is beyond the scope of the TSHOOT exam. For this reason, detailed troubleshooting steps are also not included in this guide. Instead, when troubleshooting ZPF issues, consider the following configuration guidelines and caveats:

1. A zone must be configured before interfaces can be assigned to the zone. In other words, an interface cannot be assigned to a zone that does not exist
2. An interface can be assigned to only one security zone. This same concept is applicable in CBAC. Assigning an interface to multiple zones would result in confusing the router
3. All traffic to and from a given interface is implicitly blocked when the interface is assigned to a zone, except traffic to and from other interfaces in the same zone, and traffic to any interface on the router, e.g. Loopback interfaces
4. Traffic is implicitly allowed to flow by default among interfaces that are members of the same zone. In other words, if two or more interfaces are in the same zone, all hosts connected to those interfaces can communicate with each other by default
5. In order to permit traffic to and from a zone member interface, a policy allowing or inspecting traffic must be configured between that zone and any other zone
6. The self zone is the only exception to the default “deny all” policy. The self zone controls traffic sent to the router itself or originated by the router. Therefore, all traffic to any router interface or traffic originated by the router allowed until explicitly denied
7. Traffic cannot flow between a zone member interface and any interface that is not a zone member, by default. Pass, inspect, and drop actions can only be applied between two configured zones. For example, if interface FastEthernet0/0 is a member of Zone A and interface FastEthernet0/1 is not affiliated with any zones, traffic from FastEthernet0/0 cannot flow to FastEthernet0/1, and vice-versa
8. Interfaces that have not been assigned to a zone function as classical router ports and can still use classic Stateful inspection/CBAC configuration. However, interfaces that have been configured for zones cannot be configured for CBAC
9. If it is required that an interface on the router not be part of the zone-based firewall policy, it might still be necessary to put that interface in a zone and configure a pass all policy, which is sort of a dummy policy, between that zone and any other zone to which traffic flow is desired. Otherwise, that interface will not be able to communicate with other interfaces that have been assigned to zones, and vice-versa, as described earlier