Configuring Cisco ZFW - Cisco Zone Based Firewall

The concept of Cisco Zone Based Firewall (ZFW) is very simple yet can quickly turn into a giant two headed dog if you don't understand how to design it. ZFW basically classifies interfaces into security zones and Intra-zone interfaces can pass traffic freely between each other however traffic between Inter-zone interfaces is restricted by default. A quick example can shed more light on this concept.

Consider the simple topology below and let's get started.
  

Configuring CBAC - Context Based Access Control

When it comes to security, I think you should always implement an actual firewall such as an ASA. However if you are a small business and you needed to get a stateful firewall up and running then Cisco Context Based Access Control is the way to go. It's lightweight, easy to configure and it gets the job done.

Consider this topology below and let's see how easily we can get it configured.

Configuring NAT - NAT with route-maps

Fourth post in this NAT series is the 'NAT with route-maps'. In my opinion, using route-map to manipulate NAT is a fairly advanced topic. Therefore make sure to do plenty of labs and read up on docs to understand the concepts. With that being said, let's get started.

Topology we will be using.

Configuring NAT - Dynamic NAT with PAT

Third post in this NAT series is "Dynamic NAT with Port Address Translation". Port Address Translation (PAT) works by translating not just the IP address but the ports associated with the connection. It was mainly created to allow many-to-one NAT, so a single public IP can be shared between 1000s of hosts.

Topology we will be using is similar to the ones from my previous posts on this series. 

Cisco to Cisco IPsec-manual Decrypt packets - Part 2

Now let's get into decrypting ICMP packets between R1 and R2.

First let's capture some packets between R1 and R2.

• Right click on the line between R1 and R2
• Choose R1 f1/0 
• Click "OK"

Cisco to Cisco IPsec-manual Decrypt packets - Part 1

We will split this blogtorial into 2 parts. Part 1 will concentrate on how to setup up the IPsec-manual tunnel and Part 2 will concentrate on how to decrypt the traffic between the two VPN end points. Reason we are setting up a ipsec-manual instead of a ipsec-isakmp VPN is because we cannot get the IPsec session keys to decrypt the packet if isakmp is used.

Consider this simple 2 router topology and let's get started. 

Configuring ACLs - ACL Resequence

In this blogtorial we will see how ACLs are sequenced and how we can resequence if we need to. ACL's initially start with sequence number of 10 and increments each entry by 10 unless specified.

Let's take a look.