RE: zone-based FW: "pass" means one-way or two?

Hi Andrew,
 
Yes - With no ACLs, the traffic is passed forwards, (using my example,
onwards to BB1).
 
On interaction with ACLs, my understanding is that if present, the traffic
must be allowed through both the inbound list on the ingress interface and
outbound list on the egress interface, before ZBFW can process the packet.
 

 
  _____

From: ALL From_NJ [mailto:all.from.nj_at_gmail.com]
Sent: 06 November 2009 20:45
To: Gavin Schokman
Cc: Piotr Matusiak; ccielab_at_groupstudy.com
Subject: Re: zone-based FW: "pass" means one-way or two?

In addition to what has been written ...

I may be mistaken, however, I believe the pass option means that this
particular traffic will be permitted or filtered by an access list or other
means. Traffic will not simply pass from one zone to the other, ... but
will be checked with another means ... - access lists.

If you have pass listed for a class and no access-lists, will it simply
allow the traffic between zones? ... I do not think so. I may be wrong about
this as I only labbed this a few weeks ago and may be getting this confused
in my head. I would be interested to hear anyone's thoughts ...

Andrew Lee Lissitz

On Fri, Nov 6, 2009 at 3:38 PM, Gavin Schokman <g_schokman_at_yahoo.com.au>
wrote:

Nice one, Piotr. That's the one bit of information that is missing from
anywhere in the DocCD config guides, command references, etc.
Shame it's quite an important bit :|

Thanks for the help!

Cheers,
Gavin

 _____

From: Piotr Matusiak [mailto:piotr_at_ccie1.com]
Sent: 06 November 2009 20:31
To: Gavin Schokman
Cc: ccielab_at_groupstudy.com
Subject: Re: zone-based FW: "pass" means one-way or two?

Gavin,

The "pass" action does not have any stateful capability, so that it won't
open any dynamic holes for returning traffic.
It is useful when you use SELF zone and want to "pass" traffic destined or
originated from the router without any inspection.

HTH,

--
Piotr Matusiak
CCIE #19860 (R&S, SEC)
Technical Instructor
MicronicsTraining.com
"If you can't explain it simply, you don't understand it well enough" -
Albert Einstein
2009/11/6 Gavin Schokman <g_schokman_at_yahoo.com.au>
Hi GS'ers,
Doing a lab excerise and hitting some unexpected behaviour here with
zone-based firewall.
I've got the following config defined on my firewall router
!! traffic def's
class-map typ inspect match-all HTTP
 match protocol http
class-map type inspect FTP
 match protocol ftp
class-map type inspect DNS
 match protocol DNS
class-map type inspect H323
 match protocol h323
class-map type inspect TELNET
 match protocol telnet
! policies
policy-map type inspect INSIDE->OUTSIDE
 class type inspect HTTP
 pass
 class type inspect FTP
 pass
 class type inspect DNS
 pass
 class type inspect H323
 pass
 class type inspect TELNET
 inspect
 class class-default
 drop
policy-map type inspect OUTSIDE->INSIDE
 class class-default
 no drop
zone security INSIDE
zone sec OUTSIDE
zone-pair sec OUTSIDE->INSIDE sou OUTSIDE dest INSIDE
 service-p type inspect OUTSIDE->INSIDE
zone-pair sec INSIDE->OUTSIDE sou INSIDE dest OUTSIDE
 service-p type inspect INSIDE->OUTSIDE
!! bind interfaces
int se1/0
 zone-m sec OUTSIDE
int fa0/0
 zone-m sec INSIDE
R5 -----  R6 ----- BB1
R5 is inside, R6 is the firewall router & BB1 on the outside
BB1 is has telnet & http server enabled.
Trying to telnet to BB1 from R5 works with the "inspect" option configured.
The forward traffic is allowed through, as is the return traffic.
However, http connections (which has the "pass" option) are not working.
Traffic in the forward direction, i.e. R5 -> BB1 works (witnessed via "deb
ip packet" on BB1), but it seems the return traffic is being blocked by R6.
My understanding of the "pass" & "inspect" options in zone-based FW, is that
they both allow forward traffic out and dynamically create a rule to allow
the return traffic. Also, DocCD states:
-- quote
If a policy is not configured between a pair of zones, traffic is dropped.
However, it is not necessary to configure a zone-pair and a service policy
solely for return traffic. Return traffic is allowed, by default, if a
service policy permits the traffic in the forward direction. In the above
example, it is not mandatory that you configure a zone-pair source Z2
destination Z1 solely for allowing return traffic from Z2 to Z1. The service
policy on the Z1-Z2 zone-pair takes care of it.
-- end quote
Can someone help shed some light on what is expected behaviour for the
"pass" option?
Thanks
Kind regards,
Gavin
Blogs and organic groups at http://www.ccie.net