Cisco PIX firewall Set up 3 security zones ***CS580*** John Trafecanty Jules R. Nya Baweu August 23, 2005

PIX with 3 interfaces - 3 security zones Purpose - This is the most used PIX config. in use in most enterprise networks today - It allows company servers sitting on the DMZ interface to be accessed from the public network while other computers sitting on the inside remain secured and inaccessible by intruders. Firewall policy rules - Inside users can initiate connections to the outside and DMZ. - Outside users can initiate connections only to the DMZ but not to the inside. - DMZ servers can only initiate connections to the outside but not to the inside.

Pix with 3 interfaces - 3 security zones Outside Inside DMZ

Our environment of work

Our setup

Our setup - Simplified

Config. on Switch S2 - Vlan

Config. on Router R5

Config. on Router R6

Detailed config. command On the Cisco PIX Firewall nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security50 interface ethernet0 100basetx interface ethernet1 100basetx interface ethernet2 100basetx ip address outside ip address inside ip address dmz fixup protocol ftp 21 fixup protocol http 80 fixup protocol smtp 25 fixup protocol h fixup protocol rsh 514 fixup protocol sqlnet 1521 arp timeout names name webserver pager lines 24 logging console 7 nat (inside) nat (dmz) global (outside) global (outside) global (dmz) static (dmz,outside) webserver

Detailed config. command On the Cisco PIX Firewall access-list acl_out permit tcp any host eq http Access-group acl_out in interface outside rip outside passive version 2 rip outside default version 2 rip inside passive version 1 rip dmz passive version 2 route outside mtu outside 1500 mtu inside 1500 mtu dmz 1500 telnet inside telnet timeout 5 terminal width 80

Config. on Pix firewall

Scenario of traffic from inside to the outside – Telnet to the router R4 “This traffic is allowed”

Scenario of traffic from inside to the outside – ping to the router R4 “This traffic is allowed”

Scenario of traffic from outside to the inside – Telnet to Router R6 “Dest. Unreachable, since R6 is using private ip”

Scenario of traffic from outside to the DMZ – ping to Router R5 “Only http traffic is allowed to the dmz from outside”

Scenario of traffic from outside to the DMZ – Status on the Pix firewall after ping to Router R5 “Only http traffic is allowed to the dmz from outside”

Scenario of traffic from outside to the DMZ – Telnet to Router R5 “Telnet is no allowed to the dmz from outside”

Scenario of traffic from outside to the DMZ – Status on the Pix firewall after telnet to Router R5 “Telnet is no allowed to the dmz from outside”

Conclusion This lab project has shown an example of how to configure a stateful packet filter - Cisco PIX Firewall. The set up of the Cisco PIX firewall through the 3 security zones scheme is used today in complex networks and can provide an effective security protection for enterprise networks.