Cisco Zone-Based Firewall

Here's a Zone-Based Firewall configuration proof-of-concept I put together for one of my clients. They needed to segment their PCI environment from their non-PCI environment with existing Cisco 2821 routers. This configuration requires the router to have an IOS with the firewall feature set included.

!BEGIN CONFIG

access-list 100 permit icmp any any
access-list 100 permit tcp host 10.0.4.132 host 10.0.2.132 eq www
access-list 100 permit udp host 10.0.4.132 host 10.0.2.132 eq tftp
access-list 100 permit tcp host 10.0.4.132 host 10.0.5.132 eq 139
access-list 100 permit tcp host 10.0.4.132 host 10.0.5.132 eq 445
access-list 100 permit tcp host 10.0.4.132 host 10.0.5.132 eq ftp

access-list 101 permit icmp any any
access-list 101 permit tcp host 10.0.5.132 host 10.0.4.132 eq 139
access-list 101 permit tcp host 10.0.5.132 host 10.0.4.132 eq 445
access-list 101 permit tcp host 10.0.2.132 host 10.0.4.132 eq 139
access-list 101 permit tcp host 10.0.2.132 host 10.0.4.132 eq 445


zone security pci_zone
description pci_network

zone security non_pci_zone
description non_pci_network

int fa0/1
zone-member security pci_zone

int fa0/0
zone-member security non_pci_zone

int s0/0/0
zone-member security non_pci_zone

class-map type inspect match-any store-protocols-class
match protocol ftp
match protocol dns
match protocol http
match protocol tcp
match protocol udp
match protocol icmp

class-map type inspect match-all store-protocols-acl-outbound-class
match class-map store-protocols-class
match access-group 100

class-map type inspect match-all store-protocols-acl-inbound-class
match class-map store-protocols-class
match access-group 101

policy-map type inspect store-outbound-policy
class type inspect store-protocols-acl-outbound-class
inspect

policy-map type inspect store-inbound-policy
class type inspect store-protocols-acl-inbound-class
inspect

zone-pair security pci-non_pci source pci_zone destination non_pci_zone
service-policy type inspect store-outbound-policy

zone-pair security non_pci-pci source non_pci_zone destination pci_zone
service-policy type inspect store-inbound-policy

!END CONFIG

Hope this helps someone out when trying to segment their PCI environments.

Cisco Router IOS Upgrade

I know the process for upgrading a Cisco router is very well documented, so this is just so I can find it next time without having to search the Internet.

From the router type:

config t

copy tftp: flash:

Then, enter the tftp server's IP Address when requested [10.0.0.1] without brackets

Enter the IOS binary name when requested [c3640-ik9o3s-mz.124-25d.bin] without brackets

File will copy and will probably ask to erase flash. I say ok, with the knowledge the existing image will be deleted. I'm ok with that, so I confirm it.

The image is copied to the router's flash memory.

Now I want to verify the image's integrity so I type the following command:

verify flash:c3640-ik9o3s-mz.124-25d.bin

As long as the image is ok, then I set the router system boot:

boot system flash:c3640-ik9o3s-mz.124-25d.bin

Then I save the configuration:

wr mem

Finally, I reload the router:

reload

Finished.