Trabajo

1. Hosts en la zona INSIDE pueden acceder a cualquier host en la zona OUTSIDE utilizando HTTP y Ping
2. Hosts en la zona OUTSIDE pueden acceder a los servidores de la zona DMZ sólo por FTP y TFTP3. Los Hosts en la zona OUTSIDE pueden enviar ICMP (UNREACHABLE) a la zona INSIDE (10.20.2.0/24)
4. EL resto del tráfico se prohibe
Pasos
1. Sacar ACL
2. Definir Zonas
3. Definir ACL
4. UtilizarC3PL (Class-map/Policy-map/Zone-Pair)
###################################################################
1. Definir las zonas

zone security INSIDE
description Red Interna
exit
zone securityOUTSIDE
description Red Externa
exit
zone security DMZ
description Servidores FTP-TFTP
exit

2. Hacer ACLs

ip access-list extended in-out
permit tcp 10.20.2.0 0.0.0.255 10.10.2.0 0.0.0.255eq www
permit icmp 10.20.2.0 0.0.0.255 10.10.2.0 0.0.0.255 echo
permit eigrp any any
exit
ip access-list extended out-dmz
permit tcp 10.10.2.0 0.0.0.255 10.30.2.0 0.0.0.255 eq ftp
permit tcp10.10.2.0 0.0.0.255 10.30.2.0 0.0.0.255 eq ftp-data
permit udp 10.10.2.0 0.0.0.255 10.30.2.0 0.0.0.255 eq tftp
permit eigrp any any
exit
ip access-list extended out-in
permit icmp 10.10.2.0 0.0.0.25510.20.2.0 0.0.0.255 unreachable
permit eigrp any any
exit

3. Definir Class-Map

class-map type inspect in-out-class
match access-group name in-out
exit
class-map type inspect out-dmz-classmatch access-group name out-dmz
exit
class-map type inspect out-in-class
match access-group name out-in
exit

4. Definir Policy maps

policy-map type inspect in-out-policy
class type inspectin-out-class
inspect
exit
policy-map type inspect out-dmz-policy
class type inspect out-dmz-class
inspect
exit
policy-map type inspect out-in-policy
class type inspect out-in-class
inspectexit

5. Definir los pares de zonas

zone-pair security in-out-zone source INSIDE destination OUTSIDE
service-policy type inspect in-out-policy
exit
zone-pair security out-dmz-zone source...