0

I have Cisco 891F configured with ZBF from CBAC. Right now, router is wide-open SSH/443 or anything my public address is listening on, which is not what I intended. My intention was to only allow IMCP in. Is there somewhere else I need to apply a restrictions?

Parakoopa891F#show run
ip ssh version 2
!
class-map type inspect match-any INSIDE-TO-OUTSIDE-CLASS
  description Allowed_Protocols_From_INSIDE_to_OUTSIDE
 match protocol http
 match protocol https
 match protocol dns
 match protocol udp
 match protocol tcp
 match protocol icmp
class-map type inspect match-any OUTSIDE-TO-INSIDE-CLASS
  description Allowed_Protocols_From_OUTSIDE_to_INSIDE
 match protocol icmp
!
policy-map type inspect INSIDE-TO-OUTSIDE-POLICY
 class type inspect INSIDE-TO-OUTSIDE-CLASS
  inspect 
 class class-default
  drop log
policy-map type inspect OUTSIDE-TO-INSIDE-POLICY
 class type inspect OUTSIDE-TO-INSIDE-CLASS
  pass
 class class-default
  drop log
!
zone security INSIDE
zone security OUTSIDE
zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
 service-policy type inspect INSIDE-TO-OUTSIDE-POLICY
zone-pair security OUT-TO-IN source OUTSIDE destination INSIDE
 service-policy type inspect OUTSIDE-TO-INSIDE-POLICY
! 
interface Loopback0
 ip address 172.16.1.1 255.255.255.255
!
interface GigabitEthernet8
 description Outside
 ip address dhcp
 ip nat outside
 ip virtual-reassembly in
 zone-member security OUTSIDE
 duplex auto
 speed auto
!
interface Virtual-Template1
 ip unnumbered Loopback0
 ip nat inside
 ip virtual-reassembly in
 zone-member security INSIDE
!
interface Vlan1
 description Internal
 ip address 10.69.69.254 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 zone-member security INSIDE
ip nat inside source list ACLNATOVERLOAD interface GigabitEthernet8 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet8
!
ip access-list extended ACLNATOVERLOAD
 permit ip 10.69.69.0 0.0.0.255 any
!
end

Any insight would be greatly appreciated.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 20:08
1

After looking more through the config (show zone security) I found the self zone. Can create outside - to - Self zone.

  • 1
    Yes you were preventing outside-to-inside traffic, but the router itself is not inside. In fact, you are using the NAPT version of NAT (Cisco calls it PAT), and RFC 3022, Traditional IP Network Address Translator (Traditional NAT) explains that for NAPT "All inbound sessions (including TCP, UDP and ICMP query sessions) are assumed to be directed to the NAT router as the end node, unless the target service port is statically mapped to a different node in the local network." That is why NAPT is not used as a firewall, but on a firewall. – Ron Maupin Nov 11 '19 at 6:00
  • If the NAPT router/firewall is compromised, it has full knowledge of the internal network, and your entire network is then compromised. – Ron Maupin Nov 11 '19 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.