ZFW

ZFW

• Interface마다 Zone을 구분
• (서로 다른 Zone은 통신 불가능)
• Zone들 사이의 통신은 관리자의 설정을 통해서 가능
• CPL(cisco policy Language)기반
• Stateful

 

• 작업의 순서

1. Zone 생성
2. Interface에 zone 할당(중복 할당 가능)
3. Zone-pair 생성 (하나의 zone에서 다른zone을 전송되는 흐름)
4. Class-map / policy-map생성
5. Zone-pair에 policy-map 적용

 

 

Vm2 10.10.2.10 windown 2000

Windown XP

 

R2

Config-sec-zone

Zone security INSIDE

OUTSIDE

DMZ

Int f 0/0

Zone-meber security OUTSIDE

 

Int f 0/1

Zone-member security INSIDE

F 1/0

Zon-member security DMZ

 

Show zeon

 

Conf t

Zon-pair se in->out se INSIDE de OUTSIDE

 

ACCE

CLASS0MAP TYPE INSPECT ALL_T

 

 

MATCH PROTOCOL HTTP

SLASS-MAP DNS_T

 

MATCH-ALL

MATCH ACCESS-GROUP 101

MATCH PROTOCOL HTTP

MATCH CLASS-MAP DNS_T

 

POLICY-MAP TYPE INS SPECT IN->OUT_P

CLASS TPE INSPECT ALL_T

 

INSPECT

 

POLICY-MAP TYPE INSPECT IN->DMZ_P

 

CLASS TYPE INSPECT HTTP_DNS_T

INSPECT

 

POLICY-MAP TYPE INSPECT OUT->DMZ-P

CLASS TYPE INSPECT HTTP_DNS_T

INSPECT

 

CLASS TYPE INSPECT SSH_T

INSPECT

 

 POLICY-MAP TYPE INSPECT DMZ->OUT_P

INSPECT

 

 

ZONE-PAIR SE IN->OUT

 

SERVICE-POLICY TY INS IN->OUT_P

 

SECURITY IN->DMZ

SERVI-POLICY TYE INS IN->DMZ_P

 

ZONE-PAIR SECURITY DMZ->OUT

SERVI -POLICY TY INS DMZ-OUT_P

 

SHOW ZONE-PAIR SECURITY