Cisco Systems CL-28826-01 Zones and VRF-aware Firewalls

21-6

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter 21 Managing Zone-based Firewall Rules

Understanding the Zone-based Firewall Rules

interfaces in that security zone. Connections can be isolated in a VPN DMZ if connectivity must be

limited by a specific policy. Or, if VPN connectivity is implicitly trusted, VPN connections can be placed

in the same security zone as the trusted inside network.

To configure the router to use zone-based firewall rules with dynamic VPNs (those which dynamically

create Tunnel/Loopback/Virtual interfaces):

•Define a zone specifically for the VPN interfaces.

•Enter this zone in the VPN Zone field on the VPN tab of the Zone Based Firewall Page, page 21-49.

•Create zone-based firewall rules to allow the VPN traffic, as appropriate.

If non-VTI IPsec is employed, you must exercise caution when you configure a zone-based firewall

policy for VPN. The zone policy must specifically allow access to protected hosts by remote VPN hosts

or clients if they are in a different zone than the ingress interface for encrypted VPN traffic. This access

policy must be configured by including an access control list (ACL) enumerating the source IP addresses

of the VPN clients, and the destination IP addresses of all protected hosts the VPN clients are allowed

to reach. If the access policy is not properly configured, the policy could expose vulnerable hosts to

hostile traffic.

Refer to this white paper on cisco.com “Using VPN with Zone-Based Policy Firewall” for further

discussion of these topics.