Shaikh Mumsad Ahmed Security in Computing IT21066
Practical 6
Configuring a Zone-Based Policy Firewall (ZPF)
Topology
Shaikh Mumsad Ahmed Security in Computing IT21066
Shaikh Mumsad Ahmed Security in Computing IT21066
Router 1 Configuration
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R1
R1(config)#
R1(config)#interface GigabitEthernet0/1
R1(config-if)#no ip address
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface Serial0/0/0
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#ip address 10.1.1.1 255.255.255.252
R1(config-if)#ex
Configure Rip on Router 1
R1(config)#router rip
R1(config-router)#network 192.168.1.0
R1(config-router)#network 10.1.1.0
R1(config-router)#ex
R1(config)#
Shaikh Mumsad Ahmed Security in Computing IT21066
Router 2 configuration
Router>enable
Router#
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface Serial0/0/0
Router(config-if)#no ip address
Router(config-if)#ip address 10.1.1.2 255.0.0.0
Router(config-if)#ip address 10.1.1.2 255.0.0.0
Router(config-if)#ip address 10.1.1.2 255.255.255.252
Router(config-if)#ip address 10.1.1.2 255.255.255.252
Router(config-if)#no shutdown
Router(config-if)#end
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R2
R2(config)#interface Serial0/0/1
R2(config-if)#ip address 10.2.2.2 255.255.255.252
R2(config-if)#ip address 10.2.2.2 255.255.255.252
R2(config-if)#no shutdown
Configure Rip on Router 2
R2(config-if)#ex
R2(config)#router rip
R2(config-router)#network 10.1.1.0
R2(config-router)#network 10.2.2.0
R2(config-router)#ex
R2(config)#
Shaikh Mumsad Ahmed Security in Computing IT21066
Router 3 configuration
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R3
R3(config)#
R3(config)#
R3(config)#
R3(config)#interface GigabitEthernet0/1
R3(config-if)#no ip address
R3(config-if)#ip address 192.168.3.1 255.255.255.0
R3(config-if)#ip address 192.168.3.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#interface Serial0/0/0
R3(config-if)#
R3(config-if)#exit
R3(config)#interface Serial0/0/1
R3(config-if)#ip address 10.2.2.1 255.0.0.0
R3(config-if)#ip address 10.2.2.1 255.0.0.0
R3(config-if)#ip address 10.2.2.1 255.255.255.252
R3(config-if)#ip address 10.2.2.1 255.255.255.252
R3(config-if)#no shutdown
Rip configuration on Router 3
R3(config-if)#ex
R3(config)#router rip
Shaikh Mumsad Ahmed Security in Computing IT21066
R3(config-router)#network 192.168.3.0
R3(config-router)#network 10.2.2.0
R3(config-router)#ex
R3(config)#
Configure SSH On Router 2
R2(config)#ip domain-name securityincomputing.com
R2(config)#username admin secret pwd
R2(config)#line vty 0 4
R2(config-line)#login local
R2(config-line)#transport input ssh
R2(config-line)#crypto key zeroize rsa
% No Signature RSA Keys found in configuration.
R2(config)#crypto key generate rsa
The name for the keys will be: R2.securityincomputing.com
Choose the size of the key modulus in the range of 360 to 4096 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
R2(config)#ip ssh authentication-retries 2
*Mar 1 0:20:53.121: %SSH-5-ENABLED: SSH 1.99 has been enabled
R2(config)#ip ssh version 2
R2(config)#^Z
R2#
Shaikh Mumsad Ahmed Security in Computing IT21066
Verify Basic Network Connectivity
Step 1: Check connectivity from PCA to PCC
Shaikh Mumsad Ahmed Security in Computing IT21066
Step 2: Access R2 using SSH.
PCC>ssh –l admin 10.2.2.2
Password:pwd
R2>exit
Step 3: From PC-C, open a web browser to the PC-A server.
Desktop -> Web Browser
Shaikh Mumsad Ahmed Security in Computing IT21066
URL: http://192.168.1.3
(Successful)
Create the Firewall Zones on R3
Enable the Security Technology package on R3
R2>
R2>en
R2#show version
Technology Package License Information for Module:'c1900'
----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
-----------------------------------------------------------------
ipbase ipbasek9 Permanent ipbasek9
security None None None
data None None None
Configuration register is 0x2102
R2#
R3>en
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#license boot module c1900 technology-package securityk9
ACCEPT? [yes/no]: yes
% use 'write' command to make license boot config take effect on next boot
R3(config)#: %IOS_LICENSE_IMAGE_APPLICATION-6-LICENSE_LEVEL: Module
name = C1900 Next reboot level = securityk9 and License = securityk9
Shaikh Mumsad Ahmed Security in Computing IT21066
R3(config)#ex
R3#
%SYS-5-CONFIG_I: Configured from console by console
R3#reload
System configuration has been modified. Save? [yes/no]:yes
Building configuration...
[OK]
Proceed with reload? [confirm]
-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 CISCO1941/K9 FTX1524KW47-
Technology Package License Information for Module:'c1900'
----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
-----------------------------------------------------------------
ipbase ipbasek9 Permanent ipbasek9
security securityk9 Evaluation securityk9
data disable None None
Configuration register is 0x2102
Create a Firewall zones,class Map and ACL on Router 3
R3>
R3>enable
R3#
R3#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#
R3(config)#zone security IN-ZONE
R3(config-sec-zone)#exit
R3(config)#zone security OUT-ZONE
R3(config-sec-zone)#exit
R3(config)#access-list 101 permit ip 192.168.3.0 0.0.0.255 any
R3(config)#class-map type inspect match-all IN-NET-CLASS-MAP
R3(config-cmap)#match access-group 101
R3(config-cmap)#exit
R3(config)#policy-map type inspect IN-2-OUT-PMAP
R3(config-pmap)#class type inspect IN-NET-CLASS-MAP
R3(config-pmap-c)#inspect
Shaikh Mumsad Ahmed Security in Computing IT21066
%No specific protocol configured in class IN-NET-CLASS-MAP for inspection. All
protocols will be inspected
R3(config-pmap-c)#exit
R3(config-pmap)#exit
R3(config)#zone-pair security IN-2-OUT-ZPAIR source IN-ZONE destination OUT-ZONE
R3(config-sec-zone-pair)#service-policy type inspect IN-2-OUT-PMAP
R3(config-sec-zone-pair)#exit
R3(config)#interface GigabitEthernet0/0
R3(config)#interface GigabitEthernet0/0
R3(config-if)#zone-member security IN-ZONE
R3(config-if)#ex
R3(config)#interface serial0/0/0
R3(config-if)#zone-member security OUT-ZONE
R3(config-if)#exit
R3(config)#
R3(config)#
R3(config)#exit
R3#
%SYS-5-CONFIG_I: Configured from console by console
R3#copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]
Test FireWall Functionality From IN-ZONE to OUT-ZONE
Shaikh Mumsad Ahmed Security in Computing IT21066
Shaikh Mumsad Ahmed Security in Computing IT21066
