swagner-de
commented
3 years ago This seems to be displayed only but not inspection is taking place. After clarification with the BU, this response was provided:
By other hand, for answering your qestion about why the ‘show policy-map type inspect zone-pair [z[ne-oair-name]’was displaying hitcounts in the inspect section, they confirmed to me these are just statitics/counters and this does not mean this is indeed doing L7 inspection.
ASR1002-HX# show policy-map type inspect zone-pair ZP-OUT2IN
Zone-pair: ZP-OUT2IN
Service-policy inspect : PM-OUT2IN
Class-map: CM-OUT2IN (match-any)
Match: protocol http
Match: protocol telnet
Match: protocol dns
Match: protocol icmp
Inspect
Packet inspection statistics [process switch:fast switch]
tcp packets: [0:448]
icmp packets: [0:1157948]
http packets: [0:658]
dns packets: [0:17370]
Session creations since subsystem startup or last reset 6489
Current session counts (estab/half-open/terminating) [3:0:0]
Maxever session counts (estab/half-open/terminating) [4:12:0]
Last session created 00:00:21
Last statistic reset never
Last session creation rate 6
Last half-open session total 03.- The only way for confirming if the ZBF is doing L7 inspection for specific protocols is by executing the following command ‘show plat hardware qfp active feature alg statistics’, here an example from my lab tests for the DNS traffic when the ‘no application-inspect all’ was and was not in place:
TAC
TAC Case 691170876 is open for this.
Problem Description
When using the ASR1Ks Zone Based Firewall feature, we specifically want to deliver only L4 inspection and stateful firewalling but no L7 inspection.
Consider a VRF that has one outside (BD-VIF7005) and inside interfaces (all remaining). Firewalling should be done between outside and inside, but also vice versa. VRF Configuration:
ZBF Config:
As you can see I try to keep the class-maps as short as possible, explicitly not coupling them with
match-allandmatch tcpstatements, as we plan to replicate this piece of configuration 100s of times with different ACLs and addingmatch tcp,match udp,match icmpwould basically drastically reduce the scale we can deploy this configuration. In terms of scale, I refer to the 1000 match statements global limit mentioned here:https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/xe-17/sec-data-zbf-xe-17-book/m_sec-zone-pol-fw-xe.html
So now in order to have ZBF only do L4 firewalling, I bind a parameter map on the
inspectin thepolicy-map. See my parameter maps here:From the docs I read that I can disable L7 inspection as I did it.
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/xe-17/sec-data-zbf-xe-17-book/m_zbf_enable_alg_aic.html
However when I do
I can see that the ZBF does inspect them on L7 which is different than what I see if I explicitly tell the feature to i.e. treat the http traffic as pure tcp in the class-maps match statement.