Skip to main content

Zone Base Firewall Policy - self zone

In my last post I tested some features of ZBFP and how traffic is processed by the firewall and some interfaces are not part of ZBFP configuration. Today I’d like to test ‘self-zone’ because it works a bit different. I’m going to work on a configuration from my last post.

zbfp1.jpg

As you remember I created policy for traffic from R2 to R3. I also tested connection from R2 to R4 and it didn’t work (R4 is not a member of any zone) but traffic from R5 to R4 is allowed (both are not members of any zone).

With 'self-zone’ is works a bit different. Let’s do one test:

R2->R1:
 
R2#ping 2.2.2.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 64/95/128 ms
R2#

R5->R1:
 
R5#ping 5.5.5.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 92/122/132 ms
R5#

As you see both flows are permitted despite a self-zone exists but I don’t have any policy for any zone pair.

I added following configuration:
 
class-map type inspect match-any CM-TCP
 match protocol tcp

policy-map type inspect PM-TCP
 class type inspect CM-TCP
  inspect

zone-pair security INS->SELF source INSIDE destination self
 service-policy type inspect PM-TCP

it means I should be able telnet from R2 to R1 but I can’t ping:
 
R2#telnet 2.2.2.1
Trying 2.2.2.1 ... Open


Password required, but none set

[Connection to 2.2.2.1 closed by foreign host]
R2#

On R1 I can see:
 
Zone-pair: INS->SELF

  Service-policy inspect : PM-TCP

    Class-map: CM-TCP (match-any)
      Match: protocol tcp
        2 packets, 48 bytes
        30 second rate 0 bps
      Inspect
        Established Sessions
         Session 6672BF70 (2.2.2.2:44315)=>(2.2.2.1:23) tcp SIS_OPEN
          Created 00:00:00, Last heard 00:00:00
          Bytes sent (initiator:responder) [24:49]

    Class-map: class-default (match-any)
      Match: any
      Drop (default action)
        5 packets, 400 bytes
R1#

Let’s test a ping now:
 
R2#ping 2.2.2.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2#

On R1 we can see 10 packets dropped matched by the class-default:
 
 Zone-pair: INS->SELF

  Service-policy inspect : PM-TCP

    Class-map: CM-TCP (match-any)
      Match: protocol tcp
        2 packets, 48 bytes
        30 second rate 0 bps
      Inspect

    Class-map: class-default (match-any)
      Match: any
      Drop (default action)
        10 packets, 800 bytes
R1#

Let’s do the same tests but from R1 to R2:
 
R1#ping 2.2.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1#telnet 2.2.2.2
Trying 2.2.2.2 ...
% Connection timed out; remote host not responding

R1#

As you see both failed what means that despite lack of SELF-INS policy the returning packets are matched by INS-SELF policy. The policy action is 'inspect’ and ZBFP checks if such session exists. In my case they didn’t exist and it was dropped. Once I change the action from 'inspect’ to 'pass’ one of them should work:
 
R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#policy-map type inspect PM-TCP
R1(config-pmap)# class type inspect CM-TCP
R1(config-pmap-c)#no inspect
R1(config-pmap-c)#pass
R1(config-pmap-c)#end
R1#
R1#ping 2.2.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1#telnet 2.2.2.2
Trying 2.2.2.2 ... Open


Password required, but none set

[Connection to 2.2.2.2 closed by foreign host]
R1#

So ping doesn’t work as there is no policy in place for icmp. Telnet works fine as it is allowed in INS->SELF policy and the action 'pass’ doesn’t check a sessions table.

From R1 I can ping and telnet others:
 
R1#telnet 5.5.5.4
Trying 5.5.5.4 ... Open


Password required, but none set

[Connection to 5.5.5.4 closed by foreign host]
R1#
R1#ping 5.5.5.4

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/68/96 ms
R1#ping 4.4.4.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/107/128 ms
R1#telnet 4.4.4.3
Trying 4.4.4.3 ... Open


Password required, but none set

[Connection to 4.4.4.3 closed by foreign host]
R1#

Let’s summarize what we learned so far (from previous post too):

Self-zone:
  • without any policy traffic is allowed from and to ZBFP device
  • once we define a zone pair (with self zone) in one direction, it has an impact on traffic to and from the firewall
  • if one protocol is not allowed in one direction, you can’t connect in the opposite direction as well as returning packets are dropped
  • if one protocol is allowed in one direction and the action is 'inspect’, the opposite direction is not allowed as well as the policy will check if such session exists in the session table. Once you change the action to 'pass’ it will work
  • traffic from and to hosts connected to different interfaces is not restricted
  • for routing protocols action 'inspect’ is not allowed, you can only 'pass’ (due to the multicast protocol)
Standard zone:
  • if you have interfaces that are members of zones, traffic from/to interface that is not part of any zone and such zone pair doesn’t exist, is not allowed
  • if you have a ZBFP configured on router, traffic between interfaces that are not members of any zone is not controlled by the ZBFP and by default is permitted.

Comments

Popular posts from this blog

What should you know about HA 'override enabled' setting on Fortigate?

High availability is mandatory in most of today's network designs. Only very small companies or branches can run their business without redundancy. When you have Fortigate firewall in your network you have many options to increase network availability. You can use Fortigate Clustering Protocol ( FGCP ) or Virtual Router Redundancy Protocol ( VRRP ). FGCP has two modes: 'override' disabled (default) and 'override' enabled . I'm not going to explain how to set up HA as you can find many resources on Fortinet websites: https://cookbook.fortinet.com/high-availability-two-fortigates-56/ https://cookbook.fortinet.com/high-availability-with-fgcp-56/ Let's recap what is the main difference between them. The default HA setting is 'override' disabled and this is an order of selection an active unit: 1) number of monitored interfaces - when both units have the same number of working (up) interfaces check next parameter 2) HA uptime - an

MAC Authentication Bypass

One of the method to control your network is using MAB feature. It is helpful in case you have devices without dot1x functionality. Today I will try to implement basic configuration and analyze log messages. There is only one switch SW1 and one device attached to port Fa1/0/2.   ! aaa new - model aaa authentication dot1x default group radius ! ! int Fas1 / 0 / 2 authentication host - mode single - host authentication port - control auto mab ! I haven’t configured ACS yet but let’s see what error message I receive:   SW1 ( config - if ) # mab - ev ( Fa1 / 0 / 2 ): Received MAB context create from AuthMgr mab - ev ( Fa1 / 0 / 2 ): Created MAB client context 0x1100000F mab : initial state mab_initialize has enter mab - ev ( Fa1 / 0 / 2 ): Sending create new context event to EAP from MAB for 0x1100000F ( 0000.0000 . 0000 ) mab - sm ( Fa1 / 0 / 2 ): Received event 'MAB_START' on handle 0x1100000F mab : during state mab_initia

Inpection of asymmetric sessions on FortiGate

There is one feature available on FortiGate, and I think you should know it, as it modifies a bit what we know about stateful firewalls. In past every packet was treated individually and you had to create policies in both directions. With stateful firewalls we can track connections, and by checking couple of attributes, we can treat them as part of the same session. For example when you initiate connection from a host1 to host2, the returning connection from host2 to host1 will be treated as part of the same connection (session). They have to have the same source/destination and destination/source IPs, port numbers and interfaces.There is an exception from this rule and FortiGate in some specific cases can accept connections on port which was not used in the initial connection. Let me explain how it works on the below example:      The host1 has a default gateway on R1 (10.0.1.2), but you may notice that it is not the optimal path to host2 subnet. When we analyze the packet flo