• MQC-like syntax wrapper for CBAC
– Makes configuration more modular than CBAC
– Uses same CBAC inspection engine behind the
scenes.
• Allows for more granular control than CBAC
– Interfaces grouped together based on zone assignment
• E.g. zone “outside”, “inside”, “dmz”, etc.
– Firewall policy applies based on association of zones
• Called zone pairing
• E.g. “inside-to-outside” pairing, “outside-to-dmz” pairing, etc.
– Decoupling of interface and zone allows for better
maintenance
• Easy to add new “inside” or “outside” interfaces
• New interfaces automatically inherit policy applied to zone pairing.
ZBF Zone Types
• Two types of zones
– User defined zones
• E.g. “outside”, “inside”, etc.
– Self zone
• Traffic locally originated from and destined to router.
ZBF Traffic Filtering
• Intra zone traffic allowed
– E.g. “inside” to “inside”
• Inter zone traffic denied
– E.g. “outside” to “inside”
– Policy must manually define inspected/allowed
traffic flows.
• Self traffic allowed by default
– Allows for control plane sessions
• E.g. OSPF adjacency
– Can be manually filtered with policy applied to
zone pairing
• E.g. “outside-to-self” pairing.
ZBF Classification
• Like MQC, ZBPF uses class-map to match traffic flows
– class-map type inspect
– match-all vs. match-any
• Two different types of inspection classes
– Layer 3/4 class-maps
• Matches ACLs or protocols
• E.g. TCP port 23 from host 1.2.3.4
– Layer 7 class-maps
• Deep Packet Inspection (DPI)
• Application specific inspections
• E.g. HTTP POST message, SMTP recipient count, etc.
ZBF Policies
• Like MQC, ZBPF uses policy-map to apply actions
– policy-map type inspect
• Two different types of inspection policies
– Layer 3/4 policy-maps
• Calls Layer 3/4 class-map
– Layer 7 policy-maps
• Calls Layer 7 class-map
• Like MQC policy-map ends in class-default
– class-default drops all traffic by default.
ZBF Layer 3/4 Policy Map Actions
• Inspect
– CBAC stateful inspection, similar to ASA MPF inspection
– Automatically allows return flows based on state table
• Pass
– One-way manual exception
– Traffic passed inside to outside does not automatically
pass outside to inside
• Drop
• Discard packets.
• Log
– Generate syslog message
• Police
– Rate limit traffic to specified value
• Service-Policy
– Call Layer 7 policy-map for Deep Packet
Inspection.
ZBF Layer 7 Policy Map Actions.
• Applies application specific action
– Different protocols support different actions
• Actions are…
– Allow
• Allow the session through
– Reset
• Send TCP RST to terminate session
– Log
• Generate syslog message
