Application Firewall

The Application Firewall blocks traffic based on applications or application-family. This application-aware firewall feature provides the following benefits:

• Application visibility and granular control

• Classification of 1400+ layer 7 applications

• Blocks traffic by application or application-family

You can create lists of individual applications or application families. A sequence that contains a specified application or application family list can be inspected. This inspect action is a Layer 4 action. Matching applications are blocked/denied.

The router provides Application Layer Gateway (ALG) FTP support with Network Address Translation – Direct Internet Access (NAT-DIA), Service NAT, and Enterprise Firewall. Service NAT support is added for FTP ALG on the client and not on the FTP Server.

Note	The Application Firewall is valid only for Cisco IOS XE SD-WAN devices.

In vManage NMS, you configure firewall policies from the Configuration > Security screen, using a policy configuration wizard. In the CLI, you configure these firewalls on the XE SD-WAN Router.

Configuration Components

For firewall policies, you configure zones and a policy to apply to those zones.

Each zone consists of one of more VPNs in the overlay network. You define a source zone, which identifies the VPNs from which data traffic originates, and a destination zone, which identifies the VPNs to which the traffic is being sent.

The firewall policy consists of a series of numbered (ordered) sequences of match–action pairs that are evaluated in order, from lowest sequence number to highest sequence number. When a data packet matches the match conditions, the associated action or actions are taken and policy evaluation on that packet stops. Keep this process in mind as you design your policies to ensure that the desired actions are taken on the items subject to policy.

If a packet matches no parameters in any of the policy sequences, you define a default action to be taken on the packet.

The following figure illustrates the configuration components for firewall policies:

To create an application firewall policy, you include the following components in the configuration for a XE SD-WAN Router:

General vManage Configuration Procedure

To configure firewall policies, use the vManage policy configuration wizard. The wizard is a UI policy builder that lets you configure policy components:

• Create Lists—Create lists that group together related items and that you call in the match condition of a firewall policy.

• Firewall Policy—Define the match and action conditions of the firewall policy.

• Apply Configuration—Define zone pairs.

You must configure all these components to create a firewall policy. If you are modifying an existing firewall, you can skip a component by clicking the Next button at the bottom of the screen. To return to a component, click the Back button at the bottom of the screen.

To create an application firewall policy, you include the following components in the configuration for a XE SD-WAN Router:

Create Lists

You create lists that group together related items and that you call in the match condition of a firewall policy.

To create lists:

1. In vManage NMS, select the Configure > Security screen.

2. In the Title bar, click the Custom Options drop-down.

3. Select Lists. The Define Lists screen displays.

4. Select the list type to create. The following table describes the lists you can create for firewall policies.

You can edit, copy, or delete an existing list, click the Edit, Copy, or Trash Bin icon in the Action column.

This article provides procedures for configuring firewall policies on XE SD-WAN Routers. You provision firewall policies to direct traffic between two zones, which are referred to as a source zone and a destination zone. Each zone consists of one or more VPNs in the overlay network.

In vManage NMS, you configure firewall policies from the Configuration > Security screen, using a policy configuration wizard. In the CLI, you configure these firewalls on the XE SD-WAN Router.

Start the Policy Configuration Wizard

To start the policy configuration wizard:

1. In vManage NMS, select the Configure > Security screen.

2. Click Add Security Policy.

The Add Security Policy configuration wizard opens, and various use-case scenarios display.

Select a Use-Case Scenario

In Add Security Policy, select a policy based on use-case scenarios, or build your own custom policy.

1. Select a security policy use-case scenario. The following table describes the use-case scenarios.

   • Compliance – Applies application firewall and intrusion prevention.

   • Guest Access – Applies application firewall and URL filtering.

   • Direct Cloud Access – Applies application firewall, URL filtering, and DNS Umbrella security.

   • Direct Internet Access – Applies application firewall, intrusion prevention, URL filtering, and DNS Umbrella security.

   • Custom – Build your own security policy by combining various security policy blocks.

2. Click Proceed to add a firewall policy in the wizard.

Configure Firewall Policy

1. Click the Add Firewall Policy drop-down.

2. To create a new firewall policy

   1. Select Create New.

   2. Enter a name and description for the policy.

   3. Go to Step 4.

3. To import an existing zone-based firewall policy:

   1. Select Copy from Existing. The Copy from Existing Firewall Policy dialog box appears.

   2. From the Policy drop-down, select the policy to copy.

   3. In the Policy Name field, accept the default name (policy_name_copy) or enter a new name.

   4. In the Policy Description field, enter a description.

   5. Click Copy.

   6. To modify the policy, click the More Actions icon to at the far right of the policy and select Edit. Go to Step 4.

   Otherwise, click Next to move to the next security block in the configuration wizard.

4. In the left pane, click Sequence Rule to create a single sequence in the firewall policy. The Match tab is selected by default.

5. Click a match condition:

   • Source Data Prefix

   • Source Port

   • Destination Data Prefix

   • Destination Port

   • Protocol

   • Application/Application Family List

6. Enter the values for the match condition. 

   Note	If you selected an Application or Application Family List, you must select at least one other match condition.

7. Click the Actions tab.

8. Enter the action or actions to take if the traffic matches.

   Note	If a match condition contains an Application or Application Family List, the action must be Inspect. This inspect action is a Layer 4 action. The action for a specific application is block/deny.

9. Click Save Match and Actions to save match-action pair.

10. Repeat Steps 4 through 9 to add match–action pairs to the firewall policy.

11. To rearrange match–action pairs in the policy, drag them to the desired position.

12. To edit, copy, or delete a sequence rule, in the right pane, click the edit, copy, or delete icon to the right of the sequence rule.

13. If no packets match any of the policy sequence rules, the default action is to drop the packets. To change the default action:

    1. Click the Pencil icon.

    2. Change the default action to Inspect or Pass.

    3. Click Save Match and Actions.

Apply Policy to a Zone Pair

1. At the top of the page, click Apply Zone-Pairs.

2. In the Source Zone field, select the zone that is the source of the data packets.

3. In the Destination Zone field, select the zone that is the destination of the data packets.

   Note	You can select the same zone for both source and destination. However, if the packet's source and destination use the same physical interface (resulting in U-turn traffic), a firewall session is not created and traffic passes.

4. Click the plus (+) icon to add zone pairs.

5. Click Save.

6. At the bottom of the page, click Save Firewall Policy to save the policy.

7. To edit or delete a firewall policy, in the right pane, click the More Actions icon to the far right of the policy and select the desired option.

8. Click Next to configure the next security block in the wizard.

   • Intrusion Prevention

   • URL Filtering

   • DNS Security

Policy Summary

1. Enter a name for the security policy. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (–), and underscores (_). It cannot contain spaces or any other characters.

2. Enter a description for the security policy. This field is mandatory.

3. (Optional) For Cisco IOS XE SD-WAN Release 16.12.x and onwards, to configure high-speed logging (HSL), enter the following details of the Netflow server that will listen for the Netflow event logs:

   Note	For more information on HSL, see Firewall High-Speed Logging Overview.

   1. In the VPN field, enter the VPN that the server is in.

   2. In the Server IP field, enter the IP address of the server.

   3. In the Port field, enter the port on which the server is listening.

4. If you configured an application firewall policy, uncheck the “Bypass firewall policy and allow all Internet traffic to/from VPN 0” check box in the Additional Security Policy Settings area.

5. (Optional) To configure an audit trail, enable the Audit Trail option. This option is only applicable for rules with an Inspect action.

6. Click Save Policy to save the security policy.

Note

For IPSEC overlay tunnels in Cisco SD-WAN, if a self zone is selected as a zone pair, firewall sessions are created for SD-WAN overlay BFD packets if inspect action is configured for UDP. However, for GRE overlay tunnels, if you chose a self zone as a zone pair with the inspect action of protocol 47, firewall sessions are created only for TCP, UDP, ICMP packets; but not BFD packets.

Warning

Control connections may be impacted when you configure drop action from self-zone to VPN0 and vice versa. This applies for DTLS/TLS, BFD packets, and IPsec overlay tunnel.

To apply policy to a zone pair:

1. Create security policy using Cisco vManage. See

   https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/ios-xe-17/security-book-xe/m-firewall-17.html#c-use-the-policy-configuration-wizard-17

2. At the top of the page, click Apply Zone-Pairs.

3. In the Source Zone field, choose the zone that is the source of the data packets.

4. In the Destination Zone field, choose the zone that is the destination of the data packets.

   Note	You can choose self zone for either a source zone or a destination zone, not both.

5. Click the plus (+) icon to create a zone pair.

6. Click Save.

7. At the bottom of the page, click Save Firewall Policy to save the policy.

8. To edit or delete a firewall policy, click the More Actions icon in the right pane to the far right of the policy, and select the desired option.

9. Click Next to configure the next security block in the wizard.

   • Intrusion Prevention

   • URL Filtering

   • DNS Security

To apply a security policy to an Cisco IOS XE SD-WAN device:

1. In Cisco vManage, select the Configuration > Templates screen.

2. If you are creating a new device template:

   1. In the Device tab, click Create Template.

   2. From the Create Template drop-down, select From Feature Template.

   3. From the Device Model drop-down, select one of the Cisco IOS XE SD-WAN devices.

   4. In the Template Name field, enter a name for the device template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (–), and underscores (_). It cannot contain spaces or any other characters.

   5. In the Description field, enter a description for the device template. This field is mandatory, and it can contain any characters and spaces.

   6. Continue with Step 4.

3. If you are editing an existing device template:

   1. In the Device tab, click the More Actions icon to the right of the desired template, and click the pencil icon.

   2. Click the Additional Templates tab. The screen scrolls to the Additional Templates section.

   3. From the Policy drop-down, select the name of a policy that you have configured.

4. Click the Additional Templates tab located directly beneath the Description field. The screen scrolls to the Additional Templates section.

5. From the Security Policy drop-down, select the name of the security policy you configured in the above procedure.

6. Click Create (for a new template) or Update (for an existing template).

This topic provides an example of configuring a simple zone-based firewall using the CLI or vManage.

Setting Up an Inspection Firewall Policy

In this zone-based firewall configuration example, we have a scenario where a router is connected to an employee network and the internet.

We want to set up a firewall between the employee network and the internet to do the following:

• Enable stateful packet inspection for traffic between the employee network and the internet

• Log all packets dropped by the firewall

• Set Denial-of-Service thresholds

• Enable the following firewall rule:

  Protocol	Source Address	Source Port	Destination Address	Destination Port	Action
  TCP and UDP	10.0.0.1 172.16.0.1 192.168.0.1 255.255.0.0	200	209.165.200.225 209.165.202.129	300	drop

The configuration consists of three sections:

• Define the zones.

• Define a firewall policy.

• Define the zone pair.

• Apply the zone-based firewall policy to the zone pair.

CLI Configuration

1. Enable privileged EXEC mode. If prompted, enter your password.

   Device> enable

2. Enter global configuration mode:

   configure transaction

3. Create the inspect parameter map:

   Device(config)# parameter-map type inspect-global
    multi-tenancy
    vpn zone security
    alert on
    log dropped-packets
    max-incomplete tcp 2000
   

4. Create the employee zone:

   Device(config)# zone security employee
    vpn 1
   

5. Create the internet zone:

   Device(config)# zone security internet
    vpn 0

6. Configure the object group for the source addresses:

   Device(config)# object-group network employee_1
    host 10.0.0.1
    host 172.16.0.1
    192.168.0.1 255.255.0.0
   

7. Configure the object group for the destination addresses:

   Device(config)# object-group network internet_1
    host 209.165.200.225
    host 209.165.202.129
   

8. Configure the object group for the ports:

   Device(config)# object-group network svc
    tcp source eq 200 eq 300
    udp source eq 200 eq 300

9. Create the IP access-list:

   Device(config)# ip access-list ext acl_1
    10 deny  object-group svc object-group employee_1  object-group internet_1

10. Create the class map:

    Device(config)# class-map type inspect match-all cmap_1
     match access-group name acl_1
    

11. Create the policy map that you want to add to the zone pair.

    Device(config)# policy-map type inspect fw_policy1
     class cmap_1
      drop

12. Create the zone pair and link the policy map to it:

    Device(config)# zone-pair security employee-inet source employee destination internet
     service-policy type drop fw_policy1
    

vManage Configuration

To configure this zone-based firewall policy in vManage NMS:

1. Select Configuration > Security.

2. Click Add Policy. The zone-based firewall configuration wizard opens.

Configure data prefix groups and zones in the Create Groups of Interest screen:

1. In the left pane, select Data Prefix.

2. In the right pane, click New Data Prefix List.

3. Enter a name for the list.

4. Enter the data prefix or prefixes to include in the list.

5. Click Add.

Configure zones in the Create Groups of Interest screen:

1. In the left pane, select Zones.

2. In the right pane, click New Zone List.

3. Enter a name for the list.

4. Enter the number of the zone or zones to include in the list. Separate numbers with a comma.

5. Click Add.

6. Click Next to move to Zone-Based Firewall in the zone-based firewall configuration wizard.

Configure zone-based firewall policies:

1. Click Add Configuration, and select Create New.

2. Enter a name and description for the policy.

3. In the left pane, click Add Sequence.

4. In the right pane, click Add Sequence Rule.

5. Select the desired match and action conditions.

6. Click Same Match and Actions.

7. In the left pane, click Default Action.

8. Select the desired default action.

9. Click Save Zone-Based Policy.

Click Next to move to the Apply Configuration in the zone-based firewall configuration wizard.

1. Enter a name and description for the zone-based firewall zone pair.

2. Click Add Zone Pair.

3. In the Source Zone drop-down, select the zone from which data traffic originates.

4. In the Destination Zone drop-down, select the zone to which data traffic is sent.

5. Click Add.

6. Click Save Policy. The Configuration > Security screen is then displayed, and the zone-based firewalls table includes the newly created policy.