Back to Dashboard
Module 40
Firewall Technologies
← Previous Module
Next Module →
# 📘 CCNA 200-301 - Video 40: Firewall Technologies ## Deep Study Notes --- ## 📌 Learning Objectives By the end of this video, you should understand: - What firewalls are and why they're used - Types of firewalls (Packet Filtering, Stateful, Application, Next-Generation) - Firewall architectures (Router-based, Appliance, Virtual) - Zone-Based Policy Firewall (ZBF) - Access Control Lists (ACLs) as basic firewalls - Firewall design and placement - Firewall verification and troubleshooting --- ## 🧠 Core Concepts ### 1. What is a Firewall? **Definition:** A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules, establishing a barrier between trusted internal networks and untrusted external networks. **Analogy:** Think of a firewall like a security checkpoint at an airport. Everyone and everything trying to enter must pass through screening. Some people are allowed in, some are denied based on rules (ticket, ID, etc.). The checkpoint also inspects bags (packet inspection) for prohibited items. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ FIREWALL CONCEPT │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ WITHOUT FIREWALL: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Internal Network Internet │ │ │ │ ┌─────────────────┐ ┌─────────────────┐ │ │ │ │ │ │ │ │ │ │ │ │ │ Trusted │◄────────►│ Untrusted │ │ │ │ │ │ Network │ │ Network │ │ │ │ │ │ │ │ │ │ │ │ │ └─────────────────┘ └─────────────────┘ │ │ │ │ │ │ │ │ No protection - all traffic allowed in both directions │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ WITH FIREWALL: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Internal Network Firewall Internet │ │ │ │ ┌─────────────────┐ ┌─────────┐ ┌─────────────────┐ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ Trusted │───────│ Firewall│────────│ Untrusted │ │ │ │ │ │ Network │ │ │ │ Network │ │ │ │ │ │ │ └─────────┘ │ │ │ │ │ │ └─────────────────┘ └─────────────────┘ │ │ │ │ │ │ │ │ Firewall controls traffic: │ │ │ │ • Blocks unauthorized inbound traffic │ │ │ │ • Allows authorized outbound traffic │ │ │ │ • Inspects packets │ │ │ │ • Logs activity │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 2. Firewall Types ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ FIREWALL TYPES │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ TYPE 1: PACKET FILTERING FIREWALL (Stateless) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Examines each packet independently │ │ │ │ • Based on: Source IP, Destination IP, Port, Protocol │ │ │ │ • No state awareness │ │ │ │ • Example: ACLs on routers │ │ │ │ • Pros: Fast, low overhead │ │ │ │ • Cons: Cannot detect application-layer attacks │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ TYPE 2: STATEFUL FIREWALL │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Tracks connection state (state table) │ │ │ │ • Knows if packet is part of established connection │ │ │ │ • Allows return traffic automatically │ │ │ │ • Example: Cisco ASA, Zone-Based Policy Firewall │ │ │ │ • Pros: More secure, easier to configure │ │ │ │ • Cons: More resource intensive │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ TYPE 3: APPLICATION LAYER FIREWALL (Proxy) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Inspects traffic at application layer (HTTP, FTP, etc.) │ │ │ │ • Can block specific application commands │ │ │ │ • Example: Web Application Firewall (WAF) │ │ │ │ • Pros: Deep inspection, application awareness │ │ │ │ • Cons: Slower, higher overhead │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ TYPE 4: NEXT-GENERATION FIREWALL (NGFW) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Combines stateful inspection with application awareness │ │ │ │ • Intrusion Prevention System (IPS) │ │ │ │ • Threat intelligence │ │ │ │ • User identity awareness │ │ │ │ • Example: Cisco Firepower, Palo Alto Networks │ │ │ │ • Pros: Comprehensive security │ │ │ │ • Cons: Expensive, complex │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 3. Firewall Architectures ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ FIREWALL ARCHITECTURES │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ARCHITECTURE 1: Router-Based Firewall (ACL) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Internal ──── Router (with ACLs) ──── Internet │ │ │ │ │ │ │ │ • Basic packet filtering │ │ │ │ • Stateless │ │ │ │ • Low cost (no additional hardware) │ │ │ │ • Limited security │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ARCHITECTURE 2: Dedicated Firewall Appliance │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Internal ──── Switch ──── Firewall ──── Router ──── Internet │ │ │ │ │ │ │ │ • Stateful inspection │ │ │ │ • High performance │ │ │ │ • Dedicated hardware │ │ │ │ • Example: Cisco ASA, Firepower │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ARCHITECTURE 3: Virtual Firewall │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Virtual Machine ──── vSwitch ──── Virtual Firewall ──── Physical │ │ │ │ │ │ │ │ • Runs in virtual environment │ │ │ │ • Scales with virtual infrastructure │ │ │ │ • Example: Cisco ASAv, virtual Firepower │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ARCHITECTURE 4: Cloud Firewall (FWaaS) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Internal ──── Internet ──── Cloud Firewall ──── Cloud Resources │ │ │ │ │ │ │ │ • Firewall as a Service │ │ │ │ • No hardware to manage │ │ │ │ • Example: AWS Security Groups, Azure Firewall │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 4. Zone-Based Policy Firewall (ZBF) **Definition:** Zone-Based Policy Firewall is Cisco IOS feature that groups interfaces into zones and applies policies between zones, providing stateful firewall functionality on routers. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ ZONE-BASED POLICY FIREWALL │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ZONE CONCEPT: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ ┌─────────────────┐ ┌─────────────────┐ │ │ │ │ │ INSIDE ZONE │ │ OUTSIDE ZONE │ │ │ │ │ │ (Trusted) │ │ (Untrusted) │ │ │ │ │ │ │ │ │ │ │ │ │ │ Gi0/1 │ │ Gi0/0 │ │ │ │ │ │ 192.168.1.1 │ │ 203.0.113.1 │ │ │ │ │ └────────┬────────┘ └────────┬────────┘ │ │ │ │ │ │ │ │ │ │ │ ┌─────────────────┐ │ │ │ │ │ └─────────│ Router │──────────┘ │ │ │ │ │ │ │ │ │ │ │ ZBF Policy: │ │ │ │ │ │ INSIDE → OUTSIDE │ │ │ │ │ │ OUTSIDE → INSIDE │ │ │ │ │ └─────────────────┘ │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ZBF ADVANTAGES: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Stateful inspection │ │ │ │ • Zone-based policies (simpler than interface ACLs) │ │ │ │ • Supports inspection of multiple protocols (HTTP, FTP, SMTP) │ │ │ │ • Application inspection │ │ │ │ • QoS integration │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **ZBF Configuration:** ```cisco ! Step 1: Define zones Router(config)# zone security INSIDE Router(config)# zone security OUTSIDE Router(config)# zone security DMZ ! Step 2: Define class maps (traffic classification) Router(config)# class-map type inspect match-any HTTP-TRAFFIC Router(config-cmap)# match protocol http Router(config-cmap)# match protocol https Router(config-cmap)# exit Router(config)# class-map type inspect match-any ICMP-TRAFFIC Router(config-cmap)# match protocol icmp Router(config-cmap)# exit ! Step 3: Define policy maps (actions) Router(config)# policy-map type inspect INSIDE-TO-OUTSIDE Router(config-pmap)# class type inspect HTTP-TRAFFIC Router(config-pmap-c)# inspect Router(config-pmap-c)# exit Router(config-pmap)# class type inspect ICMP-TRAFFIC Router(config-pmap-c)# inspect Router(config-pmap-c)# exit Router(config-pmap)# class class-default Router(config-pmap-c)# drop Router(config-pmap-c)# exit ! Step 4: Define zone pairs and apply policy Router(config)# zone-pair security ZP-INSIDE-OUTSIDE source INSIDE destination OUTSIDE Router(config-sec-zone-pair)# service-policy type inspect INSIDE-TO-OUTSIDE ! Step 5: Assign interfaces to zones Router(config)# interface GigabitEthernet0/1 Router(config-if)# zone-member security INSIDE Router(config-if)# exit Router(config)# interface GigabitEthernet0/0 Router(config-if)# zone-member security OUTSIDE Router(config-if)# exit ``` --- ### 5. ACLs as Basic Firewalls **Standard ACL Firewall:** ```cisco ! Block specific host from accessing network access-list 10 deny host 192.168.1.100 access-list 10 permit any interface GigabitEthernet0/0 ip access-group 10 in ``` **Extended ACL Firewall:** ```cisco ! Allow internal users to access web servers (only HTTP/HTTPS) access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80 access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 443 access-list 100 deny ip any any interface GigabitEthernet0/0 ip access-group 100 in ``` **ACL Limitations:** - Stateless (each packet evaluated independently) - No application awareness - Difficult to manage complex rules - No state table for return traffic --- ### 6. Cisco Firewall Products | Product | Type | Use Case | |---------|------|----------| | **Cisco ASA** | Stateful Firewall | Small to medium business, branch offices | | **Cisco Firepower** | NGFW (Next-Gen) | Enterprise, advanced threat protection | | **Cisco IOS ZBF** | Software Firewall | Integrated on routers, branch offices | | **Cisco Meraki MX** | Cloud-Managed Firewall | Distributed sites, SD-WAN | | **Cisco ASAv** | Virtual Firewall | Virtualized environments | ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ CISCO FIREWALL PRODUCT LINE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ ENTERPRISE (Firepower) │ │ │ │ • NGFW capabilities │ │ │ │ • IPS, AMP, URL filtering │ │ │ │ • High throughput │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ MID-RANGE (ASA) │ │ │ │ • Stateful inspection │ │ │ │ • VPN concentrator │ │ │ │ • Reliable, proven │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ SMALL BUSINESS (Meraki, IOS ZBF) │ │ │ │ • Cloud-managed │ │ │ │ • Integrated with router │ │ │ │ • Cost-effective │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 7. Firewall Deployment Models ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ FIREWALL DEPLOYMENT MODELS │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ MODEL 1: Two-Legged (Simple) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Internal Network ──── Firewall ──── Internet │ │ │ │ │ │ │ │ • Basic protection │ │ │ │ • No DMZ │ │ │ │ • Best for small networks │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ MODEL 2: Three-Legged (With DMZ) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Internal Network ────┐ │ │ │ │ │ │ │ │ │ ┌──▼──┐ │ │ │ │ │Firewall│ │ │ │ │ └──┬──┘ │ │ │ │ │ │ │ │ │ DMZ (Public Servers)─┘ │ │ │ │ │ │ │ │ • Separate network for public servers │ │ │ │ • Better security │ │ │ │ • Standard for business networks │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ MODEL 3: Screened Subnet (Multiple DMZs) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Internal Network ──── Firewall 1 ──── DMZ (Web) ──── Firewall 2 │ │ │ │ │ │ │ │ │ DMZ (Database) │ │ │ │ │ │ │ │ • Multiple layers of security │ │ │ │ • Defense in depth │ │ │ │ • Used in high-security environments │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 8. Firewall Rules and Policies **Common Firewall Rules:** | Rule | Source | Destination | Service | Action | Reason | |------|--------|-------------|---------|--------|--------| | 1 | Internal | Internet | HTTP, HTTPS | Allow | Web browsing | | 2 | Internal | Internet | DNS | Allow | Name resolution | | 3 | Internal | Internal | Any | Allow | Internal communication | | 4 | Internet | Internal | Any | Deny | No inbound from internet | | 5 | Internet | DMZ | HTTP, HTTPS | Allow | Public web access | | 6 | DMZ | Database | SQL | Allow | Web to database | **Rule Best Practices:** - Most specific rules first - Deny all at the end (implicit deny) - Group similar rules - Use object groups for organization --- ### 9. Firewall Verification Commands | Command | Purpose | |---------|---------| | `show access-lists` | Display ACL rules (router-based firewall) | | `show policy-map type inspect` | Display ZBF policy | | `show zone security` | Display configured zones | | `show zone-pair security` | Display zone pair policies | | `show firewall` | Display firewall status (ASA) | | `show running-config | section firewall` | Display firewall configuration | **ZBF Verification:** ```cisco Router# show zone security zone INSIDE Description: Trusted internal network Member interfaces: GigabitEthernet0/1 zone OUTSIDE Description: Untrusted external network Member interfaces: GigabitEthernet0/0 Router# show zone-pair security zone-pair ZP-INSIDE-OUTSIDE source: INSIDE destination: OUTSIDE service-policy type inspect INSIDE-TO-OUTSIDE Router# show policy-map type inspect INSIDE-TO-OUTSIDE policy-map type inspect INSIDE-TO-OUTSIDE class HTTP-TRAFFIC inspect class ICMP-TRAFFIC inspect class class-default drop ``` --- ### 10. Firewall Troubleshooting | Problem | Symptom | Solution | |---------|---------|----------| | **Traffic Blocked** | Users cannot access internet | Check firewall rules, verify zone assignments | | **Application Not Working** | Specific app fails | Check if protocol inspection is required | | **High CPU** | Slow performance | Review rule count, enable logging selectively | | **VPN Issues** | VPN users cannot connect | Verify firewall allows VPN protocols (ESP, UDP 500, 4500) | | **DMZ Issues** | Public server inaccessible | Check NAT and firewall rules for inbound traffic | **Troubleshooting Commands:** ```cisco ! Check firewall hits Router# show access-lists Router# show policy-map type inspect ! Test connectivity Router# ping 8.8.8.8 source 192.168.1.1 ! Debug firewall events (use carefully) Router# debug ip inspect Router# debug policy-map type inspect ! Check NAT for firewall Router# show ip nat translations ``` --- ### 11. Firewall Best Practices ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ FIREWALL BEST PRACTICES │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ 1. DEFAULT DENY │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Start with deny all, then allow specific traffic │ │ │ │ • Implicit deny at end of all rule sets │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 2. LEAST PRIVILEGE │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Allow only necessary traffic │ │ │ │ • Use specific source/destination/ports │ │ │ │ • Avoid "any" when possible │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 3. DEFENSE IN DEPTH │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Multiple layers of security │ │ │ │ • Firewall + IPS + endpoint protection │ │ │ │ • DMZ for public-facing servers │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 4. LOGGING AND MONITORING │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Enable logging for denied traffic │ │ │ │ • Monitor failed attempts │ │ │ │ • Review logs regularly │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 5. REGULAR REVIEW │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Review firewall rules quarterly │ │ │ │ • Remove unused rules │ │ │ │ • Document rule purpose │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 6. CHANGE MANAGEMENT │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Document all firewall changes │ │ │ │ • Test rules before production │ │ │ │ • Have rollback plan │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ## 🔧 Complete Configuration Examples ### Lab 1: Router ACL Firewall **Topology:** ``` Internal Network (192.168.1.0/24) ──── Router ──── Internet ``` **Router Configuration:** ```cisco hostname Router ! ! Allow internal users to access internet access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80 access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 443 access-list 100 permit udp 192.168.1.0 0.0.0.255 any eq 53 access-list 100 permit icmp 192.168.1.0 0.0.0.255 any ! ! Deny all other traffic access-list 100 deny ip any any ! ! Apply to inside interface interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip access-group 100 in ! ! Default route to internet ip route 0.0.0.0 0.0.0.0 203.0.113.1 ! end ``` --- ### Lab 2: Zone-Based Policy Firewall **Topology:** ``` Inside (192.168.1.0/24) ──── Router ──── Outside (Internet) │ │ DMZ (10.1.1.0/24) ``` **Router Configuration:** ```cisco hostname Router ! ! Create zones zone security INSIDE zone security OUTSIDE zone security DMZ ! ! Class maps for traffic classification class-map type inspect match-any WEB-TRAFFIC match protocol http match protocol https ! class-map type inspect match-any DNS-TRAFFIC match protocol dns ! class-map type inspect match-any ICMP-TRAFFIC match protocol icmp ! ! Policy for INSIDE to OUTSIDE policy-map type inspect INSIDE-TO-OUTSIDE class type inspect WEB-TRAFFIC inspect class type inspect DNS-TRAFFIC inspect class type inspect ICMP-TRAFFIC inspect class class-default drop ! ! Policy for OUTSIDE to DMZ (web servers) policy-map type inspect OUTSIDE-TO-DMZ class type inspect WEB-TRAFFIC inspect class class-default drop ! ! Zone pairs zone-pair security ZP-INSIDE-OUTSIDE source INSIDE destination OUTSIDE service-policy type inspect INSIDE-TO-OUTSIDE ! zone-pair security ZP-OUTSIDE-DMZ source OUTSIDE destination DMZ service-policy type inspect OUTSIDE-TO-DMZ ! ! Assign interfaces to zones interface GigabitEthernet0/0 zone-member security INSIDE ! interface GigabitEthernet0/1 zone-member security OUTSIDE ! interface GigabitEthernet0/2 zone-member security DMZ ! end ``` --- ### Lab 3: DMZ with Web Server Access **Topology:** ``` Inside (192.168.1.0/24) │ Firewall │ ┌────┴────┐ │ │ Internet DMZ (10.1.1.0/24) Web Server (10.1.1.10) ``` **Firewall Configuration:** ```cisco hostname Firewall ! ! Zones zone security INSIDE zone security OUTSIDE zone security DMZ ! ! Web traffic class class-map type inspect match-any WEB match protocol http match protocol https ! ! Inside to outside policy policy-map type inspect INSIDE-TO-OUTSIDE class WEB inspect class class-default drop ! ! Outside to DMZ policy (allow web to DMZ) policy-map type inspect OUTSIDE-TO-DMZ class WEB inspect class class-default drop ! ! Inside to DMZ policy (allow internal to DMZ) policy-map type inspect INSIDE-TO-DMZ class WEB inspect class class-default drop ! ! Zone pairs zone-pair security ZP-INSIDE-OUTSIDE source INSIDE destination OUTSIDE service-policy type inspect INSIDE-TO-OUTSIDE ! zone-pair security ZP-OUTSIDE-DMZ source OUTSIDE destination DMZ service-policy type inspect OUTSIDE-TO-DMZ ! zone-pair security ZP-INSIDE-DMZ source INSIDE destination DMZ service-policy type inspect INSIDE-TO-DMZ ! ! Interface assignments interface GigabitEthernet0/0 zone-member security INSIDE ip address 192.168.1.1 255.255.255.0 ! interface GigabitEthernet0/1 zone-member security OUTSIDE ip address 203.0.113.1 255.255.255.0 ! interface GigabitEthernet0/2 zone-member security DMZ ip address 10.1.1.1 255.255.255.0 ! ! NAT for internal users ip nat inside source list 10 interface GigabitEthernet0/1 overload access-list 10 permit 192.168.1.0 0.0.0.255 ! ! Static NAT for web server ip nat inside source static 10.1.1.10 203.0.113.10 ! end ``` --- ## ✅ Exam Tips (For CCNA 200-301) | Topic | What Cisco Tests | |-------|------------------| | **Firewall Types** | Packet filtering, stateful, application, NGFW | | **ZBF** | Zones, zone pairs, class maps, policy maps | | **ACL Firewall** | Basic stateless filtering | | **DMZ** | Demilitarized zone for public servers | | **Stateful Inspection** | Tracks connection state, allows return traffic | | **Defense in Depth** | Multiple layers of security | ### Common Exam Scenarios: **Scenario 1:** "A router needs to allow internal users to browse the internet but block all inbound traffic. Which firewall method should be used?" - **Answer:** ACLs or ZBF with stateful inspection **Scenario 2:** "What is the purpose of a DMZ?" - **Answer:** Provides a separate network for public-facing servers, isolating them from internal network **Scenario 3:** "Which firewall type tracks connection state and automatically allows return traffic?" - **Answer:** Stateful firewall ### Mnemonics: **Firewall Types:** **"P.S.A.N." - Packet, Stateful, Application, NGFW** - **P**acket Filtering: Stateless, packet-by-packet - **S**tateful: Tracks connections - **A**pplication: Deep inspection - **N**GFW: Next-Generation **ZBF Components:** **"Z.C.P.Z." - Zones, Class Maps, Policy Maps, Zone Pairs** - **Z**ones: Security boundaries - **C**lass Maps: Traffic classification - **P**olicy Maps: Actions on traffic - **Z**one Pairs: Connect zones with policies --- ## 📝 Summary (1-Minute Revision) ``` FIREWALL TECHNOLOGIES: FIREWALL TYPES: ├── Packet Filtering: Stateless (ACLs) ├── Stateful: Tracks connections (ASA, ZBF) ├── Application: Deep inspection (Proxy) └── NGFW: Integrated IPS, URL filtering (Firepower) ZONE-BASED POLICY FIREWALL (ZBF): ├── Zones: Security boundaries (INSIDE, OUTSIDE, DMZ) ├── Class Maps: Traffic classification (HTTP, ICMP) ├── Policy Maps: Actions (inspect, drop) ├── Zone Pairs: Connect zones with policies └── Interface Assignment: zone-member security FIREWALL DEPLOYMENT: ├── Two-Legged: Internal + Internet ├── Three-Legged: Internal + DMZ + Internet └── Screened Subnet: Multiple DMZs CISCO FIREWALL PRODUCTS: ├── ASA: Stateful firewall, VPN ├── Firepower: NGFW, IPS, AMP ├── IOS ZBF: Integrated on routers ├── Meraki MX: Cloud-managed └── ASAv: Virtual firewall VERIFICATION: ├── show access-lists ├── show policy-map type inspect ├── show zone security └── show zone-pair security BEST PRACTICES: ├── Default deny ├── Least privilege ├── Defense in depth ├── Regular review └── Change management ``` --- ## 🧪 Practice Questions **1. Which firewall type tracks connection state and automatically allows return traffic?** - A) Packet Filtering - B) Stateful Firewall - C) Proxy Firewall - D) ACL <details> <summary>Answer</summary> <b>B) Stateful Firewall</b> - Stateful firewalls maintain connection tables and allow return traffic automatically. </details> **2. What is the purpose of a DMZ?** - A) Isolate public-facing servers from internal network - B) Increase network speed - C) Provide backup connectivity - D) Store user credentials <details> <summary>Answer</summary> <b>A) Isolate public-facing servers from internal network</b> - DMZ provides a buffer zone between internal and external networks. </details> **3. Which Cisco product is a Next-Generation Firewall (NGFW)?** - A) Cisco ASA - B) Cisco Firepower - C) Cisco IOS - D) Cisco Meraki <details> <summary>Answer</summary> <b>B) Cisco Firepower</b> - Firepower is Cisco's NGFW platform with IPS and threat intelligence. </details> **4. Which command assigns an interface to a security zone in ZBF?** - A) `zone-member security` - B) `security-zone` - C) `interface zone` - D) `zone interface` <details> <summary>Answer</summary> <b>A) `zone-member security`</b> - This command assigns an interface to a security zone. </details> **5. What is the key difference between stateless and stateful firewalls?** - A) Stateful firewalls are faster - B) Stateful firewalls track connection state - C) Stateless firewalls encrypt traffic - D) Stateless firewalls are more secure <details> <summary>Answer</summary> <b>B) Stateful firewalls track connection state</b> - Stateful firewalls maintain connection tables for better security. </details> **6. What does "inspect" action do in ZBF policy?** - A) Blocks traffic - B) Allows stateful inspection of traffic - C) Logs traffic only - D) Redirects traffic <details> <summary>Answer</summary> <b>B) Allows stateful inspection of traffic</b> - Inspect action enables stateful firewall inspection. </details> **7. Which firewall deployment model includes a separate network for public servers?** - A) Two-Legged - B) Three-Legged (with DMZ) - C) Screened Subnet - D) Both B and C <details> <summary>Answer</summary> <b>D) Both B and C</b> - Three-Legged and Screened Subnet models include DMZ. </details> **8. What is the default behavior of a firewall if no rules match?** - A) Allow all - B) Deny all - C) Ask user - D) Log only <details> <summary>Answer</summary> <b>B) Deny all</b> - Firewalls have an implicit deny at the end of rule sets. </details> **9. Which component in ZBF defines the traffic to be inspected?** - A) Zone - B) Class Map - C) Policy Map - D) Zone Pair <details> <summary>Answer</summary> <b>B) Class Map</b> - Class maps define which traffic to match. </details> **10. What is defense in depth?** - A) Single security layer - B) Multiple layers of security - C) Deep packet inspection - D) Defense against depth attacks <details> <summary>Answer</summary> <b>B) Multiple layers of security</b> - Defense in depth uses multiple security controls. </details> **11. Which command displays ZBF policy information?** - A) `show policy-map type inspect` - B) `show firewall` - C) `show access-lists` - D) `show zone` <details> <summary>Answer</summary> <b>A) `show policy-map type inspect`</b> - Displays ZBF policy configuration. </details> **12. What is the purpose of a zone pair in ZBF?** - A) Define zones - B) Connect source and destination zones with a policy - C) Assign interfaces - D) Classify traffic <details> <summary>Answer</summary> <b>B) Connect source and destination zones with a policy</b> - Zone pairs define traffic direction and apply policies. </details> --- ## 📌 Next Steps After completing Video 40, you should be ready for: - **Video 41:** QoS (Quality of Service) Overview - **Video 42:** Queuing Mechanisms **Lab Practice:** 1. Configure ACL-based firewall on router 2. Configure ZBF with INSIDE, OUTSIDE zones 3. Test inbound and outbound traffic 4. Configure DMZ with web server 5. Verify firewall rules with show commands 6. Troubleshoot blocked traffic --- **Ready for Video 41?** Share the link or say "next" and I'll continue with QoS (Quality of Service) Overview. I'll continue with **Video 41: QoS (Quality of Service) Overview** based on the standard CCNA 200-301 curriculum. ---