1

I've found Cisco docs to be extremely vague and confusing regarding the appropriate way to configure access policies in Cisco IOS-based zone-based firewall (ZBFW).

Say I want to permit ongoing TCP connections from interface A to interface B. These interfaces are allocated each in a different security zone.

I only want to permit TCP sessions that are initiated from interface A over interface B, that is, a A-to-B zone-pair is necessary where it indicates that traffic sourced from zone A to zone B will be permitted/inspected.

So my concern is the return traffic (ie. SYN-ACK packets from zone B). Is this traffic by default permitted conn-table-style? If my access policy (policy-map action) is set to inspect will I be permitting that return traffic? Or will I need a B-to-A zone-pair to allow that traffic?

I'm pretty sure I do not need to create an additional zone-pair solely for the return traffic but I do not have an IOS router available as of now to test this.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Feb 21, 2018 at 18:28

1 Answer 1

Reset to default
1

The firewall is stateful. It understands that you are creating bidirectional a connection, and it permits return traffic for the outbound traffic. If you try to create a TCP connection from Zone A to Zone B, as permitted by the firewall, then the host in Zone B will be able to use the connection to send to the host in Zone A that created the connection, even if Zone B cannot initiate a TCP connection to Zone A.

TCP is easy for the firewall because TCP creates bidirectional connections. It is harder for connectionless protocols, like UDP, but the firewall will create states for that too, and there are parameters, e.g. timeouts, which you can adjust.

Improve this answer
2
  • Thanks for confirming what I initially thought was the correct flow. Although I feel a bit conflicted over you using the word "firewall" when this is an IOS router running ZBFW feature but if that's what you meant then OK. So is this achieved by using the 'permit' action only or do I need to use 'inspect' ? What is punctually the difference? By using 'inspect' how does the router inspect this traffic?
    – Eduardo Barreto Rosales
    Commented Dec 3, 2017 at 18:16
  • It is a firewall, albeit software in a router. You should probably start another question or ask in Network Engineering Chat because this is not a discussion forum. The actions that the firewall can perform are: Drop, Pass, and Inspect. Drop and Pass are absolute, but Inspect gives you state-based traffic control, application inspection and control, and an audit trail. You use class and policy maps to configure the firewall.
    – Ron Maupin ♦
    Commented Dec 3, 2017 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.