Zone-based policy firewall on Cisco IOS: zones, zone pairs and inspection policies

Why zones?

Access control lists on a router filter packets one at a time and must be written for every interface and direction. In a small branch or lab, you often want the router itself to act as a stateful firewall, so that replies to inside users are allowed back automatically while new connections from the internet are blocked. Cisco IOS provides this with the zone-based policy firewall (ZPF), which replaced the older Context-Based Access Control (CBAC).

Instead of thinking about interfaces, you think about zones of trust, such as INSIDE, OUTSIDE and DMZ, and write policies for traffic moving from one zone to another.

The default rules

• Traffic between two interfaces in the same zone is allowed.
• Traffic between different zones is dropped unless a zone pair with a policy allows it.
• An interface that is in a zone cannot talk to an interface that is in no zone. Once you start, put every interface in a zone.
• The self zone is the router itself (management, routing protocols). Traffic to and from it is allowed until you define a zone pair that involves it.
• Policies are one-way. A zone pair from INSIDE to OUTSIDE does not allow new sessions from OUTSIDE to INSIDE.

The building blocks

A simple configuration

This example lets inside users browse the web and use DNS, and drops and logs everything else from inside to outside. Return traffic is allowed because the action is inspect.

zone security INSIDE
zone security OUTSIDE
!
class-map type inspect match-any WEB-DNS
 match protocol http
 match protocol https
 match protocol dns
!
policy-map type inspect IN-TO-OUT
 class type inspect WEB-DNS
  inspect
 class class-default
  drop log
!
zone-pair security IN-OUT source INSIDE destination OUTSIDE
 service-policy type inspect IN-TO-OUT
!
interface GigabitEthernet0/0
 zone-member security INSIDE
interface GigabitEthernet0/1
 zone-member security OUTSIDE

Check the result with these commands:

show zone security
show zone-pair security
show policy-map type inspect zone-pair sessions

Tip: if you add a DMZ zone for a web server, you need a separate zone pair from OUTSIDE to DMZ that inspects only HTTPS to the server's address, and you never need a pair from DMZ to INSIDE for normal operation.

Real-world example: a branch office router

A charity's branch office had a single router connecting eight staff PCs to a broadband line, with only an outbound NAT and no filtering. During a review, the IT volunteer configured INSIDE and OUTSIDE zones with an inspect policy for web, DNS, email submission and the head office VPN, and a drop-and-log default. When a PC later tried to reach an unusual port on the internet, the router logs showed the drops, which led the team to an unwanted remote-control tool that was then removed. The same router also kept its SSH access restricted by adding a self-zone policy for management.