Brocade Communications Systems 5600 vRouter User manual

Supporting Brocade 5600 vRouter 4.2R1
CONFIGURATION GUIDE
Brocade 5600 vRouter
Firewall Configuration Guide
53-1004253-01
16 May 2016

© 2016, Brocade Communications Systems, Inc. All Rights Reserved.
Brocade, Brocade Assurance, the B-wing symbol, ClearLink, DCX, Fabric OS, HyperEdge, ICX, MLX, MyBrocade, OpenScript, VCS, VDX, Vplane, and
Vyatta are registered trademarks, and Fabric Vision is a trademark of Brocade Communications Systems, Inc., in the United States and/or in other
countries. Other brands, products, or service names mentioned may be trademarks of others.
Notice: This document is for informational purposes only and does not set forth any warranty, expressed or implied, concerning any equipment,
equipment feature, or service offered or to be offered by Brocade. Brocade reserves the right to make changes to this document at any time, without
notice, and assumes no responsibility for its use. This informational document describes features that may not be currently available. Contact a Brocade
sales office for information on feature and product availability. Export of technical data contained in this document may require an export license from the
United States government.
The authors and Brocade Communications Systems, Inc. assume no liability or responsibility to any person or entity with respect to the accuracy of this
document or any loss, cost, liability, or damages arising from the information contained herein or the computer programs that accompany it.
The product described by this document may contain open source software covered by the GNU General Public License or other open source license
agreements. To find out which open source software is included in Brocade products, view the licensing terms applicable to the open source software, and
obtain a copy of the programming source code, please visit http://www.brocade.com/support/oscd.
Brocade 5600 vRouter Firewall Configuration Guide
2 53-1004253-01

Contents
Preface...........................................................................................................................................................................................................................................................................................7
Document conventions..............................................................................................................................................................................................................................................7
Text formatting conventions..........................................................................................................................................................................................................................7
Command syntax conventions....................................................................................................................................................................................................................7
Notes, cautions, and warnings.....................................................................................................................................................................................................................8
Brocade resources.......................................................................................................................................................................................................................................................8
Contacting Brocade Technical Support........................................................................................................................................................................................................... 8
Brocade customers...........................................................................................................................................................................................................................................8
Brocade OEM customers..............................................................................................................................................................................................................................9
Document feedback....................................................................................................................................................................................................................................................9
About This Guide.....................................................................................................................................................................................................................................................................11
Firewall Overview.................................................................................................................................................................................................................................................................. 13
Brocade firewall functionality................................................................................................................................................................................................................................13
Firewall and fragmented packets............................................................................................................................................................................................................. 13
Defining firewall instances......................................................................................................................................................................................................................................14
Firewall rules.........................................................................................................................................................................................................................................................14
Implicit Action......................................................................................................................................................................................................................................................14
Exclusion rules.................................................................................................................................................................................................................................................... 14
Stateful firewall and connection tracking........................................................................................................................................................................................................14
TCP strict tracking.......................................................................................................................................................................................................................................................15
Applying firewall instances to interfaces.........................................................................................................................................................................................................16
Interaction between firewall, NAT, and routing............................................................................................................................................................................................16
Traffic flow through firewall, NAT, and routing.................................................................................................................................................................................. 16
Zone-based firewall....................................................................................................................................................................................................................................................17
Control plane policing............................................................................................................................................................................................................................................... 19
Configuration Examples.................................................................................................................................................................................................................................................... 21
Packet-filtering..............................................................................................................................................................................................................................................................21
Filtering on source IP address................................................................................................................................................................................................................. 22
Filtering on source and destination IP addresses.........................................................................................................................................................................22
Filtering on source IP address and destination protocol.......................................................................................................................................................... 23
Defining a network-to-network filter.....................................................................................................................................................................................................24
Filtering on source MAC address.......................................................................................................................................................................................................... 25
Excluding an address.................................................................................................................................................................................................................................... 26
Matching TCP flags........................................................................................................................................................................................................................................27
Matching ICMP type names..................................................................................................................................................................................................................... 28
Matching groups..............................................................................................................................................................................................................................................28
Stateful behavior........................................................................................................................................................................................................................................................ 29
Configuring stateful behavior per rule set..........................................................................................................................................................................................29
Configuring global state policies............................................................................................................................................................................................................ 30
Zone-based firewall................................................................................................................................................................................................................................................... 31
Filtering traffic between zones...................................................................................................................................................................................................................31
Filtering traffic between the transit zones..........................................................................................................................................................................................33
Using firewall with VRRP interfaces................................................................................................................................................................................................................34
Applying a rule set to a VRRP interface............................................................................................................................................................................................. 35
Using VRRP with a zone-based firewall.............................................................................................................................................................................................36
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 3

Enabling control plane policing..........................................................................................................................................................................................................................36
Viewing firewall information.................................................................................................................................................................................................................................38
Showing firewall instance information.................................................................................................................................................................................................38
Showing firewall configuration on interfaces................................................................................................................................................................................... 39
Showing firewall configuration................................................................................................................................................................................................................. 39
Global Firewall Commands............................................................................................................................................................................................................................................. 41
clear firewall...................................................................................................................................................................................................................................................................42
security firewall............................................................................................................................................................................................................................................................43
show security firewall <interface>......................................................................................................................................................................................................................44
Firewall Commands........................................................................................................................................................................................................................................................... 45
security firewall all-ping <state>......................................................................................................................................................................................................................... 46
security firewall broadcast-ping <state>.........................................................................................................................................................................................................47
security firewall config-trap <state>................................................................................................................................................................................................................. 49
security firewall global-state-policy <protocol>........................................................................................................................................................................................50
security firewall name <name>........................................................................................................................................................................................................................... 52
security firewall name <name> default-action <action>........................................................................................................................................................................53
security firewall name <name> default-log <action>.............................................................................................................................................................................. 54
security firewall name <name> description <description>...................................................................................................................................................................55
security firewall name <name> rule <rule-number>................................................................................................................................................................................56
security firewall name <name> rule <rule-number> action <action>..............................................................................................................................................57
security firewall name <name> rule <rule-number> description <description>....................................................................................................................... 58
security firewall name <name> rule <rule-number> destination <destination>........................................................................................................................59
security firewall name <name> rule <rule-number> disable................................................................................................................................................................ 61
security firewall name <name> rule <rule-number> dscp <value>..................................................................................................................................................62
security firewall name <name> rule <rule-number> ethertype <type>..........................................................................................................................................63
security firewall name <name> rule <rule-number> fragment..........................................................................................................................................................64
security firewall name <name> rule <rule-number> icmp................................................................................................................................................................... 65
security firewall name <name> rule <rule-number> icmpv6..............................................................................................................................................................67
security firewall name <name> rule <rule-number> ipv6-route type <number>.................................................................................................................... 69
security firewall name <name> rule <rule-number> log........................................................................................................................................................................70
security firewall name <name> rule <rule-number> mark <action>..................................................................................................................................................71
security firewall name <name> rule <rule-number> pcp <number>...............................................................................................................................................73
security firewall name <name> rule <rule-number> police <limiting-method>........................................................................................................................74
security firewall name <name> rule <rule-number> protocol.............................................................................................................................................................76
security firewall name <name> rule <rule-number> source <source>........................................................................................................................................... 77
security firewall name <name> rule <rule-number> state <state>....................................................................................................................................................79
security firewall name <name> rule <rule-number> tcp flags <flags>.......................................................................................................................................... 80
security firewall session-log <protocol>..........................................................................................................................................................................................................81
security firewall tcp-strict.......................................................................................................................................................................................................................................83
interfaces dataplane <interface> firewall local <ruleset> ......................................................................................................................................................................84
interfaces loopback <interface> firewall local <ruleset>........................................................................................................................................................................ 85
Related commands.................................................................................................................................................................................................................................................. 86
Zone-Based Firewall Commands..............................................................................................................................................................................................................................87
clear zone-policy........................................................................................................................................................................................................................................................88
show zone-policy...................................................................................................................................................................................................................................................... 89
security zone-policy zone <zone>....................................................................................................................................................................................................................90
security zone-policy zone <zone> default-action <action>.................................................................................................................................................................. 91
security zone-policy zone <zone> description <description>............................................................................................................................................................92
security zone-policy zone <from-zone> to <to-zone>..........................................................................................................................................................................93
Brocade 5600 vRouter Firewall Configuration Guide
4 53-1004253-01

security zone-policy zone <from-zone> to <to-zone> firewall <name>...................................................................................................................................... 94
security zone-policy zone <zone> interface <interface-name>........................................................................................................................................................95
ICMPv6 Types....................................................................................................................................................................................................................................................................... 97
Supported Interface Types............................................................................................................................................................................................................................................. 101
List of Acronyms................................................................................................................................................................................................................................................................103
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 5

Brocade 5600 vRouter Firewall Configuration Guide
6 53-1004253-01

Preface
∙Document conventions..................................................................................................................................................................................................... 7
∙Brocade resources...............................................................................................................................................................................................................8
∙Contacting Brocade Technical Support...................................................................................................................................................................8
∙Document feedback........................................................................................................................................................................................................... 9
Document conventions
The document conventions describe text formatting conventions, command syntax conventions, and important notice formats used in
Brocade technical documentation.
Text formatting conventions
Text formatting conventions such as boldface, italic, or Courier font may be used in the flow of the text to highlight specific words or
phrases.
Format Description
bold text Identifies command names
Identifies keywords and operands
Identifies the names of user-manipulated GUI elements
Identifies text to enter at the GUI
italic text Identifies emphasis
Identifies variables
Identifies document titles
Courier font Identifies CLI output
Identifies command syntax examples
Command syntax conventions
Bold and italic text identify command syntax components. Delimiters and operators define groupings of parameters and their logical
relationships.
Convention Description
bold text Identifies command names, keywords, and command options.
italic text Identifies a variable.
value In Fibre Channel products, a fixed value provided as input to a command option is printed in plain text, for
example, --show WWN.
[ ] Syntax components displayed within square brackets are optional.
Default responses to system prompts are enclosed in square brackets.
{ x | y | z } A choice of required parameters is enclosed in curly brackets separated by vertical bars. You must select
one of the options.
In Fibre Channel products, square brackets may be used instead for this purpose.
x | yA vertical bar separates mutually exclusive elements.
< > Nonprinting characters, for example, passwords, are enclosed in angle brackets.
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 7

Convention Description
... Repeat the previous element, for example, member [ member ...].
\ Indicates a “soft” line break in command examples. If a backslash separates two lines of a command
input, enter the entire command at the prompt without the backslash.
Notes, cautions, and warnings
Notes, cautions, and warning statements may be used in this document. They are listed in the order of increasing severity of potential
hazards.
NOTE
A Note provides a tip, guidance, or advice, emphasizes important information, or provides a reference to related information.
ATTENTION
An Attention statement indicates a stronger note, for example, to alert you when traffic might be interrupted or the device might
reboot.
CAUTION
A Caution statement alerts you to situations that can be potentially hazardous to you or cause damage to hardware, firmware,
software, or data.
DANGER
A Danger statement indicates conditions or situations that can be potentially lethal or extremely hazardous to you. Safety labels
are also attached directly to products to warn of these conditions or situations.
Brocade resources
Visit the Brocade website to locate related documentation for your product and additional Brocade resources.
You can download additional publications supporting your product at www.brocade.com. Select the Brocade Products tab to locate your
product, then click the Brocade product name or image to open the individual product page. The user manuals are available in the
resources module at the bottom of the page under the Documentation category.
To get up-to-the-minute information on Brocade products and resources, go to MyBrocade. You can register at no cost to obtain a user
ID and password.
Release notes are available on MyBrocade under Product Downloads.
White papers, online demonstrations, and data sheets are available through the Brocade website.
Contacting Brocade Technical Support
As a Brocade customer, you can contact Brocade Technical Support 24x7 online, by telephone, or by e-mail. Brocade OEM customers
contact their OEM/Solutions provider.
Brocade customers
For product support information and the latest information on contacting the Technical Assistance Center, go to http://
www.brocade.com/services-support/index.html.
If you have purchased Brocade product support directly from Brocade, use one of the following methods to contact the Brocade
Technical Assistance Center 24x7.
Preface
Brocade 5600 vRouter Firewall Configuration Guide
8 53-1004253-01

Online Telephone E-mail
Preferred method of contact for non-urgent
issues:
∙My Cases through MyBrocade
∙Software downloads and licensing
tools
∙Knowledge Base
Required for Sev 1-Critical and Sev 2-High
issues:
∙Continental US: 1-800-752-8061
∙Europe, Middle East, Africa, and Asia
Pacific: +800-AT FIBREE (+800 28
34 27 33)
∙For areas unable to access toll free
number: [phone]
∙Toll-free numbers are available in
many countries.
[email protected]
Please include:
∙Problem summary
∙Serial number
∙Installation details
∙Environment description
Brocade OEM customers
If you have purchased Brocade product support from a Brocade OEM/Solution Provider, contact your OEM/Solution Provider for all of
your product support needs.
∙OEM/Solution Providers are trained and certified by Brocade to support Brocade® products.
∙Brocade provides backline support for issues that cannot be resolved by the OEM/Solution Provider.
∙Brocade Supplemental Support augments your existing OEM support contract, providing direct access to Brocade expertise.
For more information, contact Brocade or your OEM.
∙For questions regarding service levels and response times, contact your OEM/Solution Provider.
Document feedback
To send feedback and report errors in the documentation you can use the feedback form posted with the document or you can e-mail
the documentation team.
Quality is our first concern at Brocade and we have made every effort to ensure the accuracy and completeness of this document.
However, if you find an error or an omission, or you think that a topic needs further development, we want to hear from you. You can
provide feedback in two ways:
∙Through the online feedback form in the HTML documents posted on www.brocade.com.
∙By sending your feedback to [email protected].
Provide the publication title, part number, and as much detail as possible, including the topic heading and page number if applicable, as
well as your suggestions for improvement.
Preface
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 9

Preface
Brocade 5600 vRouter Firewall Configuration Guide
10 53-1004253-01

About This Guide
This guide describes firewall functionality on the Brocade 5600 vRouter (referred to as a virtual router, vRouter, or router in the guide).
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 11

About This Guide
Brocade 5600 vRouter Firewall Configuration Guide
12 53-1004253-01

Firewall Overview
∙Brocade firewall functionality........................................................................................................................................................................................13
∙Defining firewall instances..............................................................................................................................................................................................14
∙Stateful firewall and connection tracking............................................................................................................................................................... 14
∙TCP strict tracking.............................................................................................................................................................................................................. 15
∙Applying firewall instances to interfaces................................................................................................................................................................16
∙Interaction between firewall, NAT, and routing................................................................................................................................................... 16
∙Zone-based firewall............................................................................................................................................................................................................17
∙Control plane policing.......................................................................................................................................................................................................19
Brocade firewall functionality
Firewall functionality analyzes and filters IP packets between network interfaces. The most common application of functionality is to
protect traffic between an internal network and the Internet. It allows you to filter packets based on their characteristics and perform
actions on packets that match the rule. The Brocade vRouter firewall functionality provides the following features:
∙Packet filtering for traffic that traverses the router by using the in and out keywords on an interface
∙Definable criteria for packet-matching rules, including source IP address, destination IP address, source port, destination port,
IP protocol, and Internet Control Message Protocol (ICMP) type
∙General detection on IP options, such as source routing and broadcast packets
∙Ability to set the firewall globally for stateful or stateless operation
The vRouter firewall offers both IPv4 and IPv6 stateful packet inspection to intercept and inspect network activity and to allow or deny
the attempt. The advanced firewall capabilities from the vRouter include stateful failover.
Firewall cannot be applied to outbound local traffic. It can only be applied to inbound interface traffic and forwarded outbound traffic.
Firewall and fragmented packets
As per RFC 6192, fragments destined to the local CPU are dropped by the data plane. To avoid having allowed CPU-bound fragments
from being dropped, a firewall rule must be configured to allow them through the interface so that the fragments can be reassembled.
If neither firewall nor NAT is configured, packet fragments are not inspected and are forwarded unchanged. However, in accordance with
RFC 6192, any fragments that are destined to a router local address are dropped.
An input firewall allows fragments to be reassembled. For both IPv4 and IPv6, if the packets arrive on an interface for which firewall is
configured, the fragments are reassembled at input before passing to the firewall. If all the fragments of a packet are not received, then
the packet is dropped. The reassembled packet passes through the remainder of the forwarding path and firewall does not recognize
fragments at either input or output. At output, the packet is refragmented, if necessary. This behavior also applies to a packet arriving on
an interface that is assigned to a firewall zone.
When fragmented packets arrive on an interface without a firewall configured and exits on an interface with an output firewall configured,
the fragmented packets are not inspected for L4 (TCP, UDP, ICMP, or GRE) information; however, the firewall rules recognize them as
fragments. Because the system does not process L4 information, a session for this packet is not found or created. Therefore, any return
packets that are associated with this fragment flow cannot match a session and, when in the stateful state, might be dropped.
RSVP packets are sent hop-by-hop and since they can be large, they would benefit from being fragmented. The following commands
can ensure that an RSVP is responded to.
vyatta@R1# set security firewall name RSVP rule 10 action accept
vyatta@R1# set security firewall name RSVP rule 10 protocol rsvp
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 13

Defining firewall instances
Firewalls filter packets on interfaces. Use of the firewall feature has two steps:
1. Define a firewall instance and save it under a name. A firewall instance is also called a firewall rule set, where a rule set is just a
series of firewall rules. You define the firewall instance and configure the rules in its rule set in the firewall configuration node.
2. Apply the instance to an interface or a zone by configuring the interface configuration node for the interface or zone. After the
instance is applied to the interface or zone, the rules in the instance begin filtering packets on that location.
Firewall rules
Firewall rules specify the match conditions for traffic and the action to be taken if the match conditions are satisfied. Traffic can be
matched on a number of characteristics, including source IP address, destination IP address, source port, destination port, IP protocol,
and ICMP type.
Rules are executed in numeric sequence, according to the rule number, from lowest to highest. If the traffic matches the characteristics
specified by a rule, the action of the rule is executed; if not, the system “falls through” to the next rule.
The action can be one of the following:
∙Accept: Traffic is allowed and forwarded.
∙Drop: Traffic is silently discarded.
To avoid having to renumber firewall rules, a good practice is to number rules in increments of 10. This increment allows room for the
insertion of new rules within the rule set.
Implicit Action
All firewall rule sets on the vRouter have, by default, an implicit final action of “pass all”; that is, traffic not matching any rule in the rule set
is passed. When firewall rules are present the implicit action can be automatically modified so as to allow the 'return traffic' to PASS
rather than DROP. The firewall rules have no effect on the implicit action as the firewall rules are ineffective in those instances. This
default action can be changed by using security firewall name <name> default-action <action> on page 53, it appends a hidden explicit
rule to a named group of rules, and prevents any implicit action from being performed.
Exclusion rules
Note that you should take care in employing more than one “exclusion” rule, that is, a rule that uses the negation operator (exclamation
mark [!]) to exclude a rule from treatment. Rules are evaluated sequentially, and a sequence of exclusion rules could result in unexpected
behavior.
Stateful firewall and connection tracking
The vRouter CLI interacts with the Connection Tracking System, a module that provides connection tracking for various system
functions, such as firewall and Network Address Translation (NAT). On the firewall, connection tracking allows for stateful packet
inspection.
Stateless firewalls filter packets in isolation, is based on static source and destination information. In contrast, stateful firewalls track the
state of network connections and traffic flows and allow or restrict traffic based on whether its connection state is known and authorized.
For example, when an initiation flow is allowed in one direction, the responder flow is automatically and implicitly allowed in the return
direction. While typically slower under heavy load than stateless firewalls, stateful firewalls are better at blocking unauthorized
communication.
Firewall Overview
Brocade 5600 vRouter Firewall Configuration Guide
14 53-1004253-01

By default, the vRouter firewall is stateless. If you want the firewall to operate stateless in general, you can configure state rules within a
specific rule set. Alternatively, you can configure the firewall globally to operate statefully.
Global state policies that are configured apply to all IPv4 and IPv6 traffic that is destined for, originating from, or traversing the router. In
addition, after they have been configured, global state policies override any state rules configured within the rule set.
TCP strict tracking
The TCP strict tracking of stateful firewall rules for traffic can be enabled by using security firewall tcp-strict on page 83. This command
also enables the user to toggle between loose or strict stateful behaviors for TCP.
Stateful tracking must be enabled through either a state rule or global rule. When firewall is globally stateful, policies for established,
related, and invalid traffic must be defined.
Under the stateful policy, firewall tracks the state of network connections and traffic flows, and allows or restricts traffic based on whether
the connection state is known and authorized. For example, when an initiation flow is allowed in one direction, stateful firewall
automatically allows responder flows in the return direction.
The statefulness policy applies to all IPv4 and IPv6 traffic that is destined for, originating from, or traversing the router. In firewall, global
statefulness overrides any state rules configured within rule sets.
TCP strict tracking disabled—The firewall is stateless and the rules governing statefulness must be configured through the rule set.
TCP connections are validated by the following criteria:
Perform SEQ/ACK numbers check against boundaries. (Reference: Rooij G., “Real stateful TCP packet filtering in IP Filter,” 10th USENIX
Security Symposium invited talk, Aug. 2001.)
The four boundaries are defined as follows:
∙I) SEQ + LEN <= MAX {SND.ACK + MAX(SND.WIN, 1)}\
∙II) SEQ >= MAX {SND.SEQ + SND.LEN - MAX(RCV.WIN, 1)}
∙III) ACK <= MAX {RCV.SEQ + RCV.LEN}
∙IV) ACK >= MAX {RCV.SEQ + RCV.LEN} - MAXACKWIN
TCP strict tracking enabled—The above validation is performed. In addition, the validation against the correct TCP sequencing of flags
(or validation of TCP stateful transitions) is also performed.
The following stateful transitions are invalid when a packet is received with the following flag pattern:
Forward flow:
SYN-ACK FLAG to SS, ES, FW, CW, LA, TW, CL FIN FLAG to SS, SR, S2 ACK FLAG to SS, S2
NOTE
S2 is an identical SYN sent from either side of the connection.
Reverse flow:
SYN FLAG to SR, ES, FW, CW, LA, TW, CL
FIN FLAG to SS, SR
Keys to the codes above are as follows:
vyatta@vyatta:~$ show session-table
TCP state codes: SS - SYN SENT, SR - SYN RECEIVED, ES - ESTABLISHED,
FW - FIN WAIT, CW - CLOSE WAIT, LA - LAST ACK,
TW - TIME WAIT, CL - CLOSE, LI - LISTEN
Firewall Overview
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 15

Applying firewall instances to interfaces
After defining firewall instances, you can apply them to interfaces, where the instances act as packet filters. Firewall instances filter
packets in one of the following ways, depending on what direction you specify when you apply the firewall instance:
in: If you apply firewall instances with the in direction, the firewall filters packets entering the interface. These packets can be traversing
the vRouter or be destined for the router.
out: If you apply instances with the out direction, the firewall filters packets leaving the interface. These packets can be traversing the
vRouter or originating on the vRouter.
local: If you apply instances with the local, the firewall filters packets destined for the vRouter. The special interface "lo" can be used to
affect packets received on any interface. Note that these instances are run after any "in" instances that may be on the interface.
You can apply many firewall instances to an interface on each direction. They are applied in the order that they are configured on the
interface and direction.
Interaction between firewall, NAT, and routing
The processing order of the various services that might be configured within the vRouter is one of the most important concepts to
understand when working with firewall functionality. If the processing order of the services is not carefully configured, the results
achieved might not be what you expect.
Traffic flow through firewall, NAT, and routing
The following figure shows how traffic flows through the firewall, NAT, and routing services within the vRouter. Notice the order of firewall
instances, destination Network Address Translation (DNAT), routing decisions, and source Network Address Translation (SNAT).
FIGURE 1 Traffic flow through firewall, NAT, and routing components
Scenario 1: firewall instances applied to inbound traffic
In this scenario, firewall instances are applied to inbound (in) traffic on an interface. Notice that firewall instances are evaluated before
DNAT and routing decisions, and after SNAT.
Firewall Overview
Brocade 5600 vRouter Firewall Configuration Guide
16 53-1004253-01

Scenario 2: firewall instances applied to outbound traffic
In this scenario, firewall instances are applied to outbound (out ) traffic on an interface. Notice that firewall is evaluated after DNAT and
routing decisions, and after SNAT.
Zone-based firewall
Ordinary firewall rule sets are applied on a per-interface basis to act as a packet filter for the interface. In a zone-based firewall, interfaces
are grouped into security “zones,” where each interface in a zone has the same security level.
Packet-filtering policies are applied to traffic flowing between zones. Traffic flowing between interfaces that lie in the same zone is not
filtered and flows freely because the interfaces share the same security level.
The following figure shows an example of a zone-based firewall implementation. This example has these characteristics:
∙Three transit zones exist (that is, points where traffic transits the router): the private zone, the demilitarized zone (DMZ), and the
public zone.
∙The dp0p1p4 interface lies in the public zone; the dp0p1p1 and dp0p1p2 interfaces lie in the private zone; and the dp0p1p3
interface lies in the DMZ.
∙The arrows from one zone to another zone represent traffic-filtering policies that are applied to traffic flowing between zones.
∙Traffic flowing between LAN 1 and LAN 2 remains within a single security zone. Thus, traffic from LAN1 to LAN2, and
conversely, flows unfiltered.
Firewall Overview
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 17

FIGURE 2 Zone-based firewall overview
By default, all traffic coming into the router and originating from the router is allowed.
Note the following additional points about zone-based firewalls:
∙An interface can be associated with only one zone.
∙An interface that belongs to a zone cannot have a per-interface firewall rule set applied to it, and conversely.
∙Traffic between interfaces that do not belong to any zone flows unfiltered, and per-interface firewall rule sets can be applied to
those interfaces.
∙By default, all traffic to a zone is dropped unless explicitly allowed by a filtering policy for a source zone (from_zone) .
∙Filtering policies are unidirectional; they are defined as a “zone pair” that identifies the zone from which traffic is sourced
(from_zone ) and the zone to which traffic is destined (to_zone ). In the preceding figure, these unidirectional policies can be
seen as follows:
– From private to DMZ
– From public to DMZ
– From private to public
– From DMZ to public
– From public to private
– From DMZ to private
Firewall Overview
Brocade 5600 vRouter Firewall Configuration Guide
18 53-1004253-01

Control plane policing
Control plane policing (CPP) provides protection against attacks on the Brocade 5600 vRouter by allowing you to configure firewall
policies that are assigned to desired interfaces and applying these policies to packets both entering and leaving the vRouter.
For the vRouter, CPP supports the addition of local keyword that can be applied to firewall policies for specific firewall interface types.
CPP is implemented when the local keyword is used in firewall policies that are assigned to any type of vRouter interface type
supporting firewall functionality (an interface type that currently supports in and out directions) except for an administrator-defined
loopback interface. The system loopback interface, lo, has the local keyword assigned to it by default, and any attempt to assign a local
firewall to a user-defined loopback interface causes an error. A local firewall policy with CPP runs on packets that are destined for the
vRouter.
To configure CPP, define firewall policies or rule sets and assign them to the desired interfaces by using the local keyword. For the lo
interface, assign firewall policies to control the flow of packets from the control plane. Assign firewall policies to other data plane
interfaces to control the flow of packets to the control plane.
A few explicit differences exist between firewall policies that are assigned to the local keyword and all other firewall policies:
∙Sessions are not created on a stateful rule match.
∙Strict protocol tracking is silently ignored.
∙Packets that do not match a firewall rule are allowed to pass into and out of the control plane.
For the first two explicit differences, regardless of whether a matched rule implies stateful or strict protocol tracking, these attributes of
the rule are silently ignored. This behavior is required because packets entering or leaving the control plane also pass through an input or
output interface and the possibility of performing duplicate state tracking can result in false-positive state transitions, which lead to
packet drop. To enforce stateful behavior, strict protocol tracking, or both, add appropriate rules to the input or output interfaces as
desired.
The third difference enables packets that are unmatched by a policy or rule set to pass. This behavior is the direct opposite of all other
firewall behavior. Other firewalls have an implicit drop rule for all packets that do not match an existing rule in the rule set. This behavior is
implemented as a convenience for the administrator to allow various control plane packets, such as DHCP, IPv6 ND, BGP, and so forth,
to pass without requiring the administrator to create specific rules for these packets. Administrators can have full control over this
behavior and can add an explicit drop rule to the firewall group, if desired.
CPP is described in RFC 6192, and a suggested configuration for filtering rules is included in that document. Administrators are
encouraged to review RFC 6192 for a list of suggested ACLs and configuration filtering rules for control plane policing.
The Brocade 5600 vRouter also includes a template of suggested filtering rules that you can incorporate into your CPP configuration.
This rule set excludes various routing protocol packets from filtering and provides a default policing rule to rate-limit all other packets
entering the control plane. The template CPP configuration also assigns the rule set to the lo system loopback interface.
The template rule set is located on the vRouter in: /opt/vyatta/etc/cpp.conf. After reviewing the template configuration, you can add this
rule set to your existing configuration by using the merge command in configuration mode:
vyatta@R1# merge /opt/vyatta/etc/cpp.conf
vyatta@R1# commit
vyatta@R1# save
Administrators may also choose to modify the template rules to meet their particular needs.
Firewall Overview
Brocade 5600 vRouter Firewall Configuration Guide
53-1004253-01 19

Firewall Overview
Brocade 5600 vRouter Firewall Configuration Guide
20 53-1004253-01