© 2006 Cisco Systems, Inc. All rights reserved. Implementing Secure Converged Wide Area Networks (ISCW) Module 6: Cisco IOS Threat Defense Features

© 2006 Cisco Systems, Inc. All rights reserved.

Implementing Secure Converged Wide Area Networks (ISCW)

Module 6: Cisco IOS Threat Defense Features


Module 6: Cisco IOS Threat Defense Features

Lesson 6.3: Basic and Advanced Firewall Wizards


Objectives Describe the Security Device Manager (SDM) and how

it is used in firewall configuration.

Describe using the Basic and Advanced Firewall wizard in SDM to configure a firewall.

Explain how to review and modify the configuration generated by the SDM.

Explain how to enable logging in order to view firewall activity within SDM.


Basic and Advanced Firewall Wizards SDM offers configuration wizards to simplify Cisco IOS

Firewall configuration.

Two configuration wizards exist:Basic Firewall Configuration wizard:

Supports two interface types (inside and outside)

Applies predefined rules

Advanced Firewall Configuration wizard:

Supports more interfaces (Inside, Outside, and DMZ)

Applies predefined or custom rules


Configuring a Basic Firewall

1

2

3

4


Basic Firewall Interface Configuration


Basic Firewall Configuration Summary and Deployment


Reviewing the Basic Firewall for the Originating Traffic


Reviewing the Basic Firewall for the Returning Traffic


Resulting Basic Firewall Inspection Rule Configuration

Router#show running-config | include ip inspect nameip inspect name SDM_LOW cuseemeip inspect name SDM_LOW dnsip inspect name SDM_LOW ftpip inspect name SDM_LOW h323ip inspect name SDM_LOW httpsip inspect name SDM_LOW icmpip inspect name SDM_LOW imapip inspect name SDM_LOW pop3ip inspect name SDM_LOW netshowip inspect name SDM_LOW rcmdip inspect name SDM_LOW realaudioip inspect name SDM_LOW rtspip inspect name SDM_LOW esmtpip inspect name SDM_LOW sqlnetip inspect name SDM_LOW streamworksip inspect name SDM_LOW tftpip inspect name SDM_LOW tcpip inspect name SDM_LOW udpip inspect name SDM_LOW vdolive


Resulting Basic Firewall ACL Configuration

Router#show running-config | include access-listaccess-list 100 remark autogenerated by SDM firewall configurationaccess-list 100 remark SDM_ACL Category=1access-list 100 deny ip 200.0.0.0 0.0.0.3 anyaccess-list 100 deny ip host 255.255.255.255 anyaccess-list 100 deny ip 127.0.0.0 0.255.255.255 anyaccess-list 100 permit ip any anyaccess-list 101 remark autogenerated by SDM firewall configurationaccess-list 101 remark SDM_ACL Category=1access-list 101 deny ip 10.1.1.0 0.0.0.255 anyaccess-list 101 permit icmp any host 200.0.0.1 echo-replyaccess-list 101 permit icmp any host 200.0.0.1 time-exceededaccess-list 101 permit icmp any host 200.0.0.1 unreachableaccess-list 101 deny ip 10.0.0.0 0.255.255.255 anyaccess-list 101 deny ip 172.16.0.0 0.15.255.255 anyaccess-list 101 deny ip 192.168.0.0 0.0.255.255 anyaccess-list 101 deny ip 127.0.0.0 0.255.255.255 anyaccess-list 101 deny ip host 255.255.255.255 anyaccess-list 101 deny ip host 0.0.0.0 anyaccess-list 101 deny ip any any log


Resulting Basic Firewall Interface Configuration

Router#show running-config | begin interfaceinterface FastEthernet0/0 description $FW_INSIDE$ ip address 10.1.1.1 255.255.255.0 ip access-group 100 in!interface Serial0/0/0 description $FW_OUTSIDE$ ip address 200.0.0.1 255.255.255.252 ip access-group 101 in ip verify unicast reverse-path ip inspect SDM_LOW out!<...rest of output removed...>


Configuring Interfaces on an Advanced Firewall

2

3

4

1


Advanced Firewall Interface Configuration


Advanced Firewall DMZ Service Configuration


Advanced Firewall DMZ Service Configuration: TCP


Advanced Firewall DMZ Service Configuration: UDP


Advanced Firewall DMZ Service Configuration: Configured Services


Advanced Firewall Security Policy


Advanced Firewall Protocols and Applications


Advanced Firewall Protocols and Applications (Cont.)


Advanced Firewall Protocols and Applications (Cont.)


Advanced Firewall Inspection Parameters


Advanced Firewall Security Policy Selection


Advanced Firewall Configuration Summary and Deployment


Resulting Advanced Firewall Inspection Rule Configuration

Router#show running-config | include ip inspect nameip inspect name appfw_100 tcp audit-trail onip inspect name appfw_100 udpip inspect name appfw_100 ftpip inspect name dmzinspect tcpip inspect name dmzinspect udp


Resulting Advanced Firewall ACL Configuration

Router#show running-config | include access-listaccess-list 100 remark autogenerated by SDM firewall configurationaccess-list 100 remark SDM_ACL Category=1access-list 100 deny ip 200.0.0.0 0.0.0.3 anyaccess-list 100 deny ip 192.168.0.0 0.0.0.255 anyaccess-list 100 deny ip host 255.255.255.255 anyaccess-list 100 deny ip 127.0.0.0 0.255.255.255 anyaccess-list 100 permit ip any anyaccess-list 101 remark autogenerated by SDM firewall configurationaccess-list 101 remark SDM_ACL Category=1access-list 101 deny ip any any logaccess-list 102 remark autogenerated by SDM firewall configurationaccess-list 102 remark SDM_ACL Category=1access-list 102 deny ip 192.168.0.0 0.0.0.255 anyaccess-list 102 deny ip 10.1.1.0 0.0.0.255 anyaccess-list 102 permit icmp any host 200.0.0.1echo-replyaccess-list 102 permit icmp any host 200.0.0.1 time-exceededaccess-list 102 permit icmp any host 200.0.0.1 unreachableaccess-list 102 permit tcp any host 192.168.0.2 eq wwwaccess-list 102 permit udp any host 192.168.0.3 eq isakmpaccess-list 102 deny ip 10.0.0.0 0.255.255.255 anyaccess-list 102 deny ip 172.16.0.0 0.15.255.255 anyaccess-list 102 deny ip 192.168.0.0 0.0.255.255 anyaccess-list 102 deny ip 127.0.0.0 0.255.255.255 anyaccess-list 102 deny ip host 255.255.255.255 anyaccess-list 102 deny ip host 0.0.0.0 anyaccess-list 102 deny ip any any log


Resulting Advanced Firewall Interface Configuration

Router#show running-config | begin interfaceinterface FastEthernet0/0 description $FW_INSIDE$ ip address 10.1.1.1 255.255.255.0 ip access-group 100 in ip inspect appfw_100 in! interface FastEthernet0/1 description $FW_DMZ$ ip address 192.168.0.1 255.255.255.0 ip access-group 101 in ip inspect dmzinspect out!interface Serial0/0/0 description $FW_OUTSIDE$ ip address 200.0.0.1 255.255.255.252 ip access-group 102 in ip verify unicast reverse-path!<...rest of the output removed...>


Preparing for Firewall Activity Viewing

1

2

3

5

6

4


Viewing Firewall Log

1

2


Summary Cisco Security Device Manager (SDM), a configuration

and management tool for Cisco IOS routers that use a GUI, offers a simple method to set up the Cisco IOS Firewall.

The Basic Firewall Configuration wizard applies default access rules to both inside and outside interfaces, applies default inspection rules to the outside interface, and enables IP unicast reverse path forwarding (uRPF) on the outside interface.

The Advanced Firewall Configuration wizard applies default or custom access rules, as well as default or custom inspection rules, to inside, outside, and DMZ interfaces. The Advanced Firewall Configuration wizard also enables IP unicast reverse-path forwarding on the outside interface.


Q and A


Resources Cisco Router and Security Device Manager Introduction

http://cisco.com/en/US/partner/products/sw/secursw/ps5318/index.html

Cisco Router and Security Device Manager Supporthttp://cisco.com/en/US/partner/products/sw/secursw/ps5318/tsd_products_support_series_home.html

Cisco Router and Security Device Manager User Guides

http://cisco.com/en/US/partner/products/sw/secursw/ps5318/products_user_guide_list.html


Documents

© 2006 Cisco Systems, Inc. All rights reserved. Implementing Secure Converged Wide Area Networks (ISCW) Module 6: Cisco IOS Threat Defense Features