Module 10 Flashcards
There are two configuration models for Cisco IOS Firewall:
Classic Firewall - The traditional configuration model in which firewall policy is applied on interfaces.
Zone-based Policy Firewall (ZPF) - The configuration model in which interfaces are assigned to security zones, and firewall policy is applied to traffic moving between the zones.
There are several benefits of a ZPF:
It is not dependent on ACLs.
The router security posture is to block unless explicitly allowed.
Policies are easy to read and troubleshoot with the Cisco Common Classification Policy Language (C3PL). C3PL is a structured method to create traffic policies based on events, conditions, and actions. This provides scalability because one policy affects any given traffic, instead of needing multiple ACLs and inspection actions for different types of traffic.
Virtual and physical interfaces can be grouped into zones.
Policies are applied to unidirectional traffic between zones.
Designing ZPFs involves several steps:
Step 1. Determine the zones
Step 2. Establish policies between zones
Step 3. Design the physical infrastructure
Step 4. Identify subsets within zones and merge traffic requirements
examples of ZPF designs.
LAN-to-Internet
Firewall with public servers - 1
Firewall with public servers - 2
Redundant Firewalls
Complex Firewall
Three possible actions can be configured to process traffic by protocol, source and destination zones (zone pairs), and other criteria.
Inspect - This performs Cisco IOS stateful packet inspection.
Drop - This is analogous to a deny statement in an ACL. A log option is available to log the rejected packets.
Pass - This is analogous to a permit statement in an ACL. The pass action does not track the state of connections or sessions within the traffic.
Zone-Based Policy Firewall Configuration Steps
Step 1: Create the zones.
Step 2: Identify traffic with a class-map.
Step 3: Define an action with a policy-map.
Step 4: Identify a zone pair and match it to a policy-map.
Step 5: Assign zones to the appropriate interfaces.
Which statement accurately describes Cisco IOS zone-based policy firewall operation?
The pass action in CCP is similar to the permit parameter in an ACL entry. Pass allows traffic only in one direction.
How does ZPF handle traffic between an interface that is a zone member and another interface that does not belong to any zone?
The rules for a zone based policy firewall to handle transit traffic depend on whether or not the ingress and egress interfaces are members of zones. If one interface is a zone member, but the other is not, then the resulting action is to drop the traffic regardless of whether a zone-pair exists.
Which statement describes a factor to be considered when configuring a zone-based policy firewall?
An interface cannot belong to multiple zones. A firewall never filters traffic between interfaces that have been configured for the same zone. The way that a zone-based policy firewall coexists with a class firewall configuration is that interfaces that are not members of a security zone can still have the classic firewall ip inspect command applied and operational.
Which statement describes one of the rules that govern interface behavior in the context of implementing a zone-based policy firewall configuration?
An interface can belong to only one zone. Creating a zone is the first step in configuring a zone-based policy firewall. A zone cannot be assigned to an interface if the zone has not been created. Traffic can never flow between an interface that is assigned to a zone and an interface that has not been assigned to a zone.
Designing a ZPF requires several steps. Which step involves defining boundaries where traffic is subjected to policy restrictions as it crosses to another region of the network?
Designing ZPFs involves several steps:
Step 1. Determine the zones - The administrator focuses on the separation of the network into zones. Zones establish the security borders of a network.
Step 2. Establish policies between zones - For each pair of "source-destination" zones, define the sessions that clients in the source zones can request from servers in destination zones.
Step 3. Design the physical infrastructure - After the zones have been identified, and the traffic requirements between them documented, the administrator must design the physical infrastructure. This includes dictating the number of devices between most-secure and least-secure zones and determining redundant devices.
Step 4. Identify subsets within zones and merge traffic requirements - For each firewall device in the design, the administrator must identify zone subsets that are connected to its interfaces and merge the traffic requirements for those zones.
When a Cisco IOS zone-based policy firewall is being configured, which two actions can be applied to a traffic class? (Choose two.)
The three actions that can be applied are inspect, drop,and pass. The inspect CCP action is similar to the classic firewall ip inspect command in that it inspects traffic going through the firewall and allowing return traffic that is part of the same flow to pass through the firewall. The drop action is similar to the deny parameter in an ACL. This action drops whatever traffic fits the defined policy. The pass action is similar to a permit ACL statement–traffic is allowed to pass through because it met the criteria of the defined policy statement.
Which three statements describe zone-based policy firewall rules that govern interface behavior and the traffic moving between zone member interfaces? (Choose three.)
Some of the rules that govern interfaces in zones are as follows:
Create a policy allowing or inspecting traffic so that traffic can flow between that zone and any other zone.
Create zones before assigning to an interface.
If traffic is to flow between all interfaces in a router, each interface must be a member of a zone.
Traffic cannot flow between an interface that has been assigned to a zone and one that has not been assigned to a zone. The actions of pass, inspect, or drop can only be applied between two zones.
Interfaces that belong to the same zone allow traffic flow between them by default.
Which statement describes a feature of a zone-based policy firewall?
A zone-based policy firewall (ZPF) does not require the use of complex ACLs. By default, traffic traveling between zones is blocked unless specifically permitted, and different types of traffic can be inspected differently even on the same interface. ZPF uses C3PL for policy configuration, which is hierarchical and allows for easier configuration and troubleshooting.
In what step of zone-based policy firewall configuration is traffic identified for policy application?
During the class maps configuration stage, interesting traffic is identified for later policy application.
