1. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-1 Lesson 13 Switching and Routing

2. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-2 Objectives Upon completion of this lesson, you will be able to perform the following tasks: Describe the VLAN functionality of the PIX Firewall. Explain the routing functionality of the PIX Firewall. Configure the PIX Firewall to work with RIP. Configure the PIX Firewall to work with OSPF. Configure the PIX Firewall to forward multicast traffic.

3. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-3 Virtual LANs

4. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-4 Virtual LANs Two physical LAN connections –Inside –Outside Three virtual LAN connections –DMZ servers Outside Inside Public server Partner server Proxy server VLAN DMZ Internet VLAN trunk port

5. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-5 Create Logical and Physical Interfaces pix1(config)# interface ethernet3 100full pix1(config)# interface ethernet3 vlan10 physical pix1(config)# interface ethernet3 vlan20 logical pix1(config)# interface ethernet3 vlan30 logical 192.168.0.0 10.0.0.0 Internet Public server Partner server Proxy server vlan30 vlan20 Trunk port vlan10 vlan30 vlan20

6. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-6 Assign VLAN Names and Security Levels pix1(config)# nameif vlan10 dmz1 security10 pix1(config)# nameif vlan20 dmz2 security20 pix1(config)# nameif vlan30 dmz3 security30 192.168.0.0 10.0.0.0 Public server Partner server Proxy server vlan30 vlan20 Trunk port vlan10 dmz1 vlan30 dmz3 vlan20 dmz2 Internet

7. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-7 Assign VLAN IP Addresses pix1(config)# ip address dmz1 172.26.26.10 pix1(config)# ip address dmz2 172.26.26.20 pix1(config)# ip address dmz3 172.26.26.30 192.168.0.0 10.0.0.0 Public server Partner server Proxy Server vlan30 vlan20 Trunk port vlan10 dmz1 172.26.26.10 dmz3 172.26.26.30 dmz2 172.26.26.20 Internet

8. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-8 Maximum Interfaces Supported Restricted licenseUnrestricted license Total interfaces Physical interfaces Logical interfaces Total interfaces Physical interfaces Logical interfaces PIX 501NA 22 Not supported PIX 506ENA 22 Not supported PIX 515E5531068 PIX 52586612810 PIX 5351088241022 Maximum number of logical interfaces = total interfaces minus physical interfaces in use. Example: PIX515R—5 (total) minus 2 (physical) = 3 (logical)

9. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-9 Static and Dynamic Routing

10. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-10 Static Routes route if_name ip_address netmask gateway_ip [metric] pixfirewall(config)# Defines a static or default route for an interface pix1(config)# route outside 0.0.0.0 0.0.0.0 192.168.0.1 1 pix1(config)# route inside 10.0.1.0 255.255.255.0 10.0.0.102 1 192.168.0.1 10.0.1.11 10.0.1.4 Default route 10.0.0.102 Static route Internet

11. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-11 Dynamic RIP Routes pix1(config)# rip outside passive version 2 authentication md5 MYKEY 2 pix1(config)# rip inside default The PIX Firewall accepts encrypted RIP version 2 multicast updates. For example, it could learn the route to network 172.26.26.0 from router A. The PIX Firewall broadcasts IP address 10.0.0.1 as the default route for devices on the inside interface. 192.168.0.0 10.0.1.11 10.0.1.4 RIP v 2 10.0.0.0 10.0.0.1 Default route.1.102.1.2 172.26.26.30 Router A

12. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-12 rip if_name default | passive [version [1 | 2]] [authentication [text | md5 key key_id]] pixfirewall(config)# Dynamic RIP Routes (Cont.) pix1(config)# rip outside passive version 2 authentication md5 MYKEY 2 pix1(config)# rip inside passive pix1(config)# rip dmz passive version 2 RIP v2 RIP v1 RIP v2 192.168.0.0 10.0.1.0 10.0.0.0 172.26.26.30 Enables IP routing table updates from received RIP broadcasts

13. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-13 OSPF

14. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-14 OSPF Private 10.0.1.0 1.1.2.0 10.0.0.0 0 OSPF PIX Firewall Software Release 6.3 adds support for OSPF dynamic routing protocol Some of the OSPF supported features are as follows: Support for intra-area, interarea and external (type 1 and 2) routes Support for virtual links Authentication for OSPF packets Configuring PIX as a DR, ABR, and limited ASBR functionality ABR type 3 LSA filtering Route redistribution Internet

15. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-15 OSPF Configuration OSPF configuration Enable OSPF Define interfaces on which OSPF runs Define OSPF areas Private 10.0.1.0 1.1.2.0 10.0.0.0 0 OSPF Router OSPF 1 Internet

16. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-16 Enable OSPF Routing pix1(config)# router ospf 1 pix1(config-router)# network 1.1.1.0 255.255.255.0 area 0 pix1(config-router)# network 1.1.2.0 255.255.255.0 area 1.1.2.0 pix1(config-router)# network 10.0.0.0 255.255.255.0 area 10.0.0.0 router ospf pid pixfirewall(config)# Enables OSPF routing through the PIX Firewall Private 1.1.1.0 10.0.1.0 Router OSPF 1 1.1.2.0 10.0.0.0 0 Internet

17. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-17 Define OSPF Networks pix1(config)# router ospf 1 pix1(config-router)# network 1.1.1.0 255.255.255.0 area 0 pix1(config-router)# network 1.1.2.0 255.255.255.0 area 1.1.2.0 pix1(config-router)# network 10.0.0.0 255.255.255.0 area 10.0.0.0 network prefix ip_address netmask area area_id pixfirewall(config)# Adds and removes interfaces to and from the OSPF routing process Private 1.1.1.0 10.0.1.0 Router OSPF 1 1.1.2.0 10.0.0.0 0 Internet

18. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-18 Private Link State Advertisements 1.1.1.0 10.0.1.0 Router OSPF 1 1.1.2.0 Advertise Routes 10.0.0.0 OSPF advertises routes to networks May need to prevent networks from being advertised when using private addressing pix1(config-router)# area 0 filter-list prefix ten in pix1(config)# prefix-list ten deny 10.0.0.0/16 pix1(config)# prefix-list ten permit 1.1.2.0/24 area area_id filter-list prefix {prefix_list_name in | out} pixfirewall(config)# prefix-list list_name [seq seq_number]{permit|deny prefix/len} Internet

19. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-19 Private LSA Filter Example 1.1.1.0 10.0.1.0 Router OSPF 1 1.1.2.0 pix1(config)# router ospf 1 pix1(config-router)# network 1.1.1.0 255.255.255.0 area 0 pix1(config-router)# network 1.1.2.0 255.255.255.0 area 1.1.2.0 pix1(config-router)# network 10.0.0.0 255.255.255.0 area 10.0.0.0 pix1(config-router)# area 0 filter-list prefix ten in pix1(config)# prefix-list ten deny 10.0.0.0/16 pix1(config)# prefix-list ten permit 1.1.2.0/24 X Advertise Routes 10.0.0.0 0 Internet

20. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-20 OSPF—One-Process Network Example pix1(config)# nameif ethernet0 outside security0 pix1(config)# nameif ethernet1 inside security100 pix1(config)# nameif ethernet2 dmz security50 pix1(config)# ip address outside 1.1.1.1 255.255.255.0 pix1(config)# ip address inside 10.0.0.1 255.255.255.0 pix1(config)# ip address dmz 1.1.2.1 255.255.255.0 1.1.1.0 10.0.1.0 1.1.2.0 10.0.0.0 Inside.1 Internet

21. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-21 OSPF—Static and Dynamic Translations pix1(config)# static (inside,outside) 1.1.1.2 10.0.1.2 255.255.255.255 pix1(config)# static (dmz,outside)1.1.3.2 1.1.3.2 255.255.255.255 pix1(config)# nat (inside) 1 0 0 pix1(config)# global (outside) 1 1.1.1.4-1.1.1.254 1.1.1.2 1.1.3.2 1.1.1.0 10.0.1.0 1.1.2.0 10.0.0.0 Private Internet 1.1.3.2.2

22. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-22 OSPF—Configure Areas and LSA Filter pix1(config)# router ospf 1 pix1(config-router)# network 1.1.1.0 255.255.255.0 area 0 pix1(config-router)# network 1.1.2.0 255.255.255.0 area 1.1.2.0 pix1(config-router)# network 10.0.0.0 255.255.255.0 area 10.0.0.0 pix1(config-router)# area 0 filter-list prefix ten in pix1(config)# prefix-list ten deny 10.0.0.0/16 pix1(config)# prefix-list ten permit 1.1.2.0/24 Private 1.1.1.0 10.0.1.0 Router OSPF 1 1.1.2.0 X Advertise Routes 10.0.0.0 0 Internet

23. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-23 OSPF—Two Processes 1.1.1.0 10.0.1.0 Router OSPF 1 192.168.1.0 10.0.0.0 Router OSPF 2 0 PIX Firewall OSPF two-process criteria: NAT is used. OSPF is operating on public and private areas. LSA type 3 filtering is required. Run two OSPF processes: One process is for public areas. One process is for the private areas. Internet

24. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-24 Defining OSPF—Two Processes 1.1.1.0 10.0.1.0 Router OSPF 1 192.168.1.0 10.0.0.0 pix1(config)# router ospf 1 //public AS pix1(config-router)# network 1.1.1.0 255.255.255.0 area 0 pix1(config)# router ospf 2 //private AS pix1(config-router)# network 10.0.0.0 255.255.255.0 area 10.0.0.0 pix1(config-router)# network 192.168.1.0 255.255.255.0 area 192.168.1.0 Router OSPF 2 0 Internet

25. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-25 Defining Redistribution pix1(config)# router ospf 1 //public AS pix1(config)# router ospf 2 //private AS pix1(config-router)# redistribute ospf 1 //import public routes Redistribute routes Do not redistribute routes X 1.1.1.0 10.0.1.0 Router OSPF 1 192.168.1.0 10.0.0.0 Private Router OSPF 2 X redistribute ospf pid pixfirewall(config)# Configures redistribution of routes between OSPF processes according to the parameters specified 0 Internet

26. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-26 Redistribution Example pix1(config)# router ospf 1 //public AS pix1(config-router)# network 1.1.1.0 255.255.255.0 area 0 pix1(config)# router ospf 2 //private AS pix1(config-router)# redistribute ospf 1 //import public routes pix1(config-router)# network 10.0.0.0 255.255.255.0 area 10.0.0.0 pix1(config-router)# network 192.168.1.0 255.255.255.0 area 192.168.1.0 Redistribute routes Do not redistribute routes X 1.1.1.0 10.0.1.0 Router OSPF 1 192.168.1.0 10.0.0.0 Router OSPF 2 X 0 Internet

27. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-27 OSPF—Two-Process Configuration Example pix1(config)# nameif ethernet0 outside security0 pix1(config)# nameif ethernet1 inside security100 pix1(config)# nameif ethernet2 dmz security50 pix1(config)# ip address outside 1.1.1.1 255.255.255.0 pix1(config)# ip address inside 10.0.0.1 255.255.255.0 pix1(config)# ip address dmz 192.168.1.1 255.255.255.0.1 1.1.1.0 10.0.1.0 192.168.1.0 10.0.0.0 Internet

28. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-28 OSPF—Static and Dynamic Translations pix1(config)# static (inside,outside) 1.1.1.2 10.0.1.2 255.255.255.255 pix1(config)# static (dmz,outside)1.1.1.3 192.168.2.2 255.255.255.255 pix1(config)# nat (inside) 1 0 0 pix1(config)# global (outside) 1 1.1.1.4-1.1.1.254 1.1.1.3 1.1.1.2 1.1.1.0 10.0.1.0 192.168.1.0 10.0.0.0 Internet.2

29. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-29 OSPF—Configure Areas and Redistribution pix1(config)# router ospf 1 //public AS pix1(config-router)# network 1.1.1.0 255.255.255.0 area 0 pix1(config)# router ospf 2 //private AS pix1(config-router)# redistribute ospf 1 //import public routes pix1(config-router)# network 10.0.0.0 255.255.255.0 area 10.0.0.0 pix1(config-router)# network 192.168.1.0 255.255.255.0 area 192.168.1.0 Redistribute routes X 1.1.1.0 10.0.1.0 Router OSPF 1 192.168.1.0 10.0.0.0 Router OSPF 2 X Do not redistribute routes 0 Internet

30. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-30 Multicast

31. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-31 IP Multicasting An IP datagram is transmitted to a set of hosts identified by a single IP destination address. Clients that wish to receive multicasts must join a multicast host group. Multicast router discovers group hosts by sending IGMP query messages. Host group members respond with IGMP reports. PIX Firewall supports Stub Multicast Routing—IGMP proxying. Multicast server Inside Outside Multicast router Multicast client IGMP query IGMP report

32. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-32 multicast interface interface_name pixfirewall (config)# Outside Multicast Server— Configuring Outside Interface Enables multicast support on the specified interface and places the interface in multicast promiscuous mode pix1(config)# multicast interface outside pix1(config-multicast)# igmp access-group 110 pix1(config)# access-list 110 permit udp any host 224.0.1.50 pixfirewall(config-multicast)# igmp access-group acl-id Applies ACL to multicast interface Multicast server Outside Multicast router Multicast client Multicast group 224.0.1.50

33. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-33 Outside Multicast Server— Configuring Inside Interface pix1(config)# multicast interface inside pix1(config-multicast)# igmp forward interface outside pix1(config-multicast)# igmp join-group 224.0.1.50 pixfirewall(config-multicast)# igmp forward interface interface_name Enables forwarding of IGMP reports to the multicast router on outside interface Multicast server Inside Multicast router Multicast client IGMP reports pixfirewall(config-multicast)# igmp join-group group Enables PIX Firewall to join a multicast group

34. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-34 Outside Multicast Server—Inside Receiving Hosts Example pix1(config)# multicast interface dmz pix1(config-multicast)# igmp access-group 120 pix1(config)# access-list 120 permit udp any host 224.0.1.50 pix1(config)# multicast interface inside pix1(config-multicast)# igmp forward interface dmz 1.Host 10.0.0.11 sends an IGMP report: Source 10.0.0.11 Destination 224.0.1.50 IGMP group 224.0.1.50 2.The PIX Firewall accepts the packet, and IGMP places the inside interface on the output list for the group. 3.The PIX Firewall forwards the IGMP packet to the multicast router: Source 172.16.0.1 Destination 224.0.1.50 IGMP group 224.0.1.50 4.The router places the input interface on the output list for the group. 5.Packets from the multicast server arrive at the router, which forwards them to the necessary interfaces. 6.The PIX Firewall accepts the packets and forwards them to the interfaces for the group. Multicast server Multicast router Multicast client 10.0.0.11 Multicast group 224.0.1.50 IGMP reports 172.16.0.1

35. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-35 Inside Server—Configuring Static Multicast Route pix1(config)# multicast interface outside pix1(config)# multicast interface inside pix1(config)# mroute 10.0.0.11 255.255.255.255 inside 230.1.1.2 255.255.255.255 outside Multicast group 230.1.1.2 Inside Multicast server 10.0.0.11 Multicast client mroute src smask in-if-name dst dmask out-if-name pixfirewall(config)# Creates a static multicast route from transmission source to next-hop router interface

36. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-36 Configuring Other IGMP Options pixfirewall(config-multicast)# igmp version 2 pixfirewall(config-multicast)# igmp query-interval 120 pixfirewall(config-multicast)# igmp query-max- response-time 50 pixfirewall(config-multicast)# igmp version 1 | 2 Sets the version of IGMP to be used igmp query-max-response-time seconds pixfirewall(config-multicast)# Sets the maximum query response time (for IGMP version 2 only) igmp query-interval seconds pixfirewall(config-multicast)# Configures the frequency at which IGMP query messages are sent by the interface

37. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-37 pixfirewall(config)# Viewing SMR Configuration show multicast [interface interface_name] Displays all or per-interface multicast settings pixfirewall(config)# show igmp [group | interface interface_name][detail] Displays multicast-related information about one or more groups show mroute [dst [src]] Displays multicast routes pixfirewall(config)#

38. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-38 pixfirewall(config)# Debugging SMR Configuration debug igmp Enables debugging for IGMP events debug mfwd pixfirewall(config)# Enable debugging for multicast forwarding events

39. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-39 Summary

40. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-40 Summary You can add static routes to the PIX Firewall to enable access to networks connected outside a router on any interface. The PIX Firewall can be configured to listen for RIP version 1 or RIP version 2 routing broadcasts. The PIX Firewall cannot pass RIP updates between interfaces. When RIP version 2 is configured in passive mode, the PIX Firewall accepts RIP version 2 multicast updates with the IP destination of 224.0.0.9. The PIX Firewall transmits default route updates using an IP destination of 224.0.0.9 if configured for the RIP version 2 default mode. The PIX Firewall supports one or two OSPF routing domains.

41. © 2004, Cisco Systems, Inc. All rights reserved. CSPFA 3.2—13-41 Summary (Cont.) The PIX Firewall supports OSPF intra-area and interarea routing. The PIX Firewall supports ABR LSA type 3 filtering. The PIX Firewall supports Stub Multicast Routing, which enables it to pass multicast traffic. The PIX Firewall can be configured to forward multicasts from a transmission source on a higher security level interface to receivers on a lower security level interface. The PIX Firewall can also be configured to allow hosts on a higher security level interface to receive multicasts from a host on a lower security level interface.