Introduccin Cisco-Pix

Firewall

Ing. Civil en Sistemas

Ricardo E. Gmez M.

ESTRUCTURA FUNCIONAMIENTO
ESQUEMA DE PROTECCION A.S.A.
-Adaptative Security Algoritm
- Stateful y Orientado a la Conexin.
- Flujo de sesiones se basa en :
* Direccin Fuente Destino
* Secuencia TCP
* Nmero de Puertos
-Puede controlar tanto trfico saliente como entrante.
CUT-THROUGH PROXY
-Metodo de verificacin de usuarios, sirve para denegar o permitir acceso
para cualquier tipo de aplicacin TCP o UDP

APLICACIONES RED FIREWALL

LAN-1: 192.168.1.X
VPN Cliente

CISCO-PIX
Server
FTP

INTERNET
Segmento IP Pblica
PAT: 200.54.156.42/29

Server smtp

-Acceso Internet
- Accseso Controlado
- VPN Client StoS
- Fix Up
- Ruteo Interno
LAN-2: 172.30.1.X

DIAGRAMA RED FIREWALL

LAN-1: 192.168.1.X

CISCO-PIX
506-E
INTERNET

Segmento IP Pblica
PAT: 200.54.156.42/29

ACCESO INTERNET
LAN-1: 192.168.1.X

CISCO-PIX
506-E
e1

e0

Inside
192.168.1.1

Ouside
200.54.156.42

interface ethernet0 auto

interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
...................................................
ip address outside 200.54.156.42 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
...................................................
global (outside) 1 200.54.156.43-200.54.156.45
netmask 255.255.255.248
global (outside) 1 200.54.156.46
...................................................
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 200.54.156.41 1
...................................................
conduit permit icmp any any
...................................................
telnet 192.168.1.0 255.255.255.0 inside

N.A.T. P.A.T.
NAT
- Permite

ocultar los host`s del interior de la red.

- La asociacin de las IP`s del NAT con los User es uno a uno
- Permite Protocolo de Sealizacin H.323

global (outside) 1 200.54.156.43-200.54.156.45 netmask 255.255.255.248

PAT
- Port Address Traslation
- Permite la asociacin de varias IP inside a una sola outside
- Permite realizar Over Flow.
- No permite protocolo de Sealizacin H.323
global (outside) 1 200.54.156.46

CONTROL USUARIOS
LAN-1: 192.168.1.X

CISCO-PIX
506-E
e1
inside

e0
ouside

El PIX NO filtra:
- Usuarios sobre un ambiente Dinmico.
- Usuarios por Horarios y Fechas.
- Sitios Internet por palabra en URL.
- No entrega privilegios por User y Pass.
- El acceso de una Zona insegura a otra
segura slo se hace a travs de N.A.T.

nat (inside) 1 192.168.1.0 255.255.255.0

.............................................................
.............................................................
nat (inside) 1 192.168.1.10 255.255.255.255
nat (inside) 1 192.168.1.11 255.255.255.255
nat (inside) 1 192.168.1.12 255.255.255.255
nat (inside) 1 192.168.1.13 255.255.255.255
.............................................................
............................................................
access-list USER permit tcp host 192.168.1.10 any
access-list USER permit udp host 150.81.30.10 any
access-list USER permit icmp host 150.81.30.10 any
..............................................................
access-list USER permit ip host 150.81.30.65 any
..............................................................
..............................................................
access-list USER permit tcp host 192.168.1.10 any eq 22
access-list USER permit tcp host 192.168.1.10 any eq ftp-data
access-list USER permit tcp host 192.168.1.10 any eq ftp
access-list USER permit udp host 192.168.1.10 any eq snmp
................................................................
access-group USER in interface inside

SERVIDORES - INSIDE
LAN-1: 192.168.1.X

CISCO-PIX
506-E
e1
inside

e0
ouside
200.54.156.43

Server
SMTP-Web
192.168.1.5

static (inside,outside) 200.54.156.43

192.168.1.5 netmask 255.255.255.255
................................................................
access-list 101 permit tcp any host 200.54.182.143 eq smtp
access-list 101 permit tcp any host 200.54.182.143 eq www

SERVIDOR DMZ
LAN-1: 192.168.1.X

CISCO-PIX 515E

Server
FTP

e1

e0

Inside
192.168.1.1

Ouside
200.54.156.42
DMZ
192.168.0.1

Server FTP-WEB
200.54.156.43
192.168.0.2

nameif ethernet2 DMZ security20

...........................................................
ip address DMZ 192.168.0.1 255.255.255.0
................................................
static (inside,DMZ) 192.168.1.0 192.168.1.0
netmask 255.255.255.0 0 0
...................................................
static (DMZ,outside) 200.54.156.43 192.168.0.2
netmask 255.255.255.255 0 0
......................................................
conduit permit tcp host 200.54.156.43 eq ftp any
conduit permit tcp host 200.54.156.43 eq www any
.........................................................
alias (inside) 200.54.156.42 192.168.0.2
255.255.255.255

FIXUP - PROTOCOL
LAN-1: 192.168.1.X

IP SRC

IP DST

PORT

A.B.C.D.

X.X.X.X

PPP

----

-----

---

---

-----

---

fixup protocol ftp 21

fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80

CISCO-PIX
506-E
e1

e0

Inside
192.168.1.1

Ouside
200.54.156.42

fixup protocol ils 389

fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521

VPN CLIENTE
LAN-1: 192.168.1.X

CISCO-PIX

INTERNET

Server
FTP

VPN Cliente

LAN-2: 172.30.1.X

VPN CLIENTE
LAN-1: 192.168.1.X

CISCO-PIX

INTERNET

Server
FTP

VPN Cliente

POOL VPN
172.30.100.X

* VPN CLIENT tiene sus puertos y protocolos abiertos.

* VPN CLIENT, NO permite acceder a Internet por la
misma interface Outside.
* VPN CLIENT, NO permite el paso de Broadcast.

LAN-2: 172.30.1.X

CISCO VPN CLIENT

CISCO-PIX
POOL VPN
SOPORTE
192.168.100.X
192.168.0.X

INTERNET

ACCESO CONMUTADO

VPN Cliente

access-list 101 permit ip 192.168.0.0 255.255.255.0

192.168.100.0 255.255.255.0
............................................
nat (inside) 0 access-list 101
ip local pool remoto 192.168.100.1-192.168.100.10
.................................
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup userA address-pool remoto
vpngroup userA idle-time 1800
vpngroup userA password ******

PARAMETROS VPN
CONJUNTO TRANSFORMADA
crypto ipsec transform-set myset esp-des esp-md5-hmac
ESP: Encapsulation Security Payload, define la confidencialidad, autenticacin e integridad de los
datos(payload)/ Cifrado de Payload de los paquetes con un algoritmo de encryptacin
DES: Algoritmo de Encriptacin de 56 bits
MD5: Autentificacin

IPSEC

ESP
DES / 3DES

AH
HMAC-MD5 / HMAC SHA

HMAC-MD5 / HMAC SHA

PARAMETROS VPN
ISAKMP: Internet Security Association and Key Management Protocol
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
CRYPTO MAP
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap interface outside

ACCESO PIX - VPN

access-list 80 permit ip host 200.54.156.42 192.168.100.0 255.255.255.0
....................................................
telnet 192.168.100.0 255.255.255.0 outside
isakmp nat-traversal ( usuarios VPN que utilizan NAT para acceder a Intenet )

CISCO-PIX

192.168.0.X

INSIDE

OUTSIDE

192.169.0.1

200.54.156.42

INTERNET

POOL VPN
SOPORTE
192.168.100.X

NAT

VPN Cliente-1
VPN Cliente-2

MULTI-USUARIOS VPN
NAT

CISCO-PIX
OUTSIDE

INTERNET

VPN Cliente-1

VPN Cliente-2

200.54.156.42
VPN Cliente-3

- PIX indica a usuario que l ser su nuevo gateway,

todos los paquetes slo conocen al PIX como gateway.
- Usuario Pierde su entorno de red.
- Usuario Pierde Acceso a Internet.
SPLIT TUNNEL
access-list split permit ip 192.168.0.0 255.255.255.0 192.168.100.0 255.255.255.0
.........................................
vpngroup aeropuerto1 split-tunnel split

MONITOREO INTERNET

....................
logging on
logging buffered debugging
logging trap debugging
logging host inside 10.10.10.2
...................

RnR entrega informacin:

Uso Bsico de acceso a Internet.
20 IP`s de URL ms visitados.
Bytes Inbound/Outbound por IP.
Protocolos y Puertos utilizados.
Errores y Advertensias.
Puede filtrar una IP especifica.

MONITOREO INTERNET