Cisco IOS Firewall

This document offers basic configuration guidelines for the relevant portions of IPsec VPN configuration. If a detailed configuration reference is required for IPsec VPN configuration, please browse to the IPsec configuration references included in each of the configuration examples.

Cisco IOS® Software-based routers offering both Zone-Based Policy Firewall and IPsec VPN connectivity provide improved security and more intuitive configuration if IPsec connections use one of the interface-based VPN options, such as site-to-site VTI, DMVPN, or IPsec VTI for site-to-site and Easy VPN client connections.

If non-VTI IPsec is employed, you must exercise caution when you configure the firewall policy for VPN. The zone policy must specifically allow access by IP address to protected hosts for remote VPN sites' hosts or clients if they are in a different zone than the VPN traffic's ingress interface, where encrypted traffic will be sent to and received from remote VPN sites or clients. Access policy must be configured by including an access control list (ACL) enumerating the source addresses of the VPN clients and the destination addresses of the hosts the VPN clients will be allowed to reach. If the access policy is not properly configured, the policy could expose vulnerable hosts to hostile traffic.

DMVPN employs a virtual interface (interface tunnel [number]) for IPsec VPN connectivity. When the DMVPN interface is assigned to a security zone, traffic routing to and from other interfaces in the router are subjected to zone-to-zone firewall policy.

If the DMVPN interface is assigned to the same security zone as another interface (for example, Gigabit Ethernet 0/0), traffic moving between hosts on the DMVPN and hosts connected to Gigabit Ethernet 0/0 will freely pass with no policy application.

This basic example illustrates a DMVPN interface in the "VPN" zone, the FastEthernet 0/1 interface in the "safe" zone, and the FastEthernet 0/0 interface in the "hostile" zone. Policy is applied according to the following matrix:

For more information on Dynamic Multipoint VPN, please see: http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd801af458.shtml

For a conceptual discussion of Zone-Based Policy Firewall, please see: http://www.cisco.com/en/US/products/ps6350/products_feature_guide09186a008072c6e3.html

Similar to DMVPN, site-to-site VTI employs a virtual interface (interface tunnel [number]) for IPsec VPN connectivity. When the site-to-site VTI interface is assigned to a security zone, traffic routing to and from other interfaces in the router are subjected to zone-to-zone firewall policy. If the site-to-site VTI interface is assigned to the same security zone as another interface (for example, Gigabit Ethernet 0/0), traffic moving between hosts on the site-to-site VTI connection and hosts connected to Gigabit Ethernet 0/0 will freely pass with no policy application.

This basic example illustrates a site-to-site VTI interface in the "VPN" zone, the FastEthernet 0/1 interface in the "safe" zone, and the FastEthernet 0/0 interface in the "hostile" zone. Policy is applied according to the following matrix:

For more information on site-to-site VTI configuration, please see: http://www.cisco.com/en/US/products/ps6635/products_white_paper0900aecd8029d629.shtml

For a conceptual discussion of Zone-Based Policy Firewall, please see: http://www.cisco.com/en/US/products/ps6350/products_feature_guide09186a008072c6e3.html

Easy VPN VTI differs from DMVPN and site-to-site VTI in that instead of using an "interface tunnel [number]" configuration, an "interface virtual-template type tunnel [number]" configuration is used to apply IP attributes for IPsec Easy VPN clients. Network Address Translation (NAT), quality of service (QoS), intrusion prevention, and other IP policy applications may be applied to the virtual-template interface, as well as classic or Zone-Based Policy Firewall.

This basic example illustrates an Easy VPN-VTI interface in the "VPN" zone, the FastEthernet 0/1 interface in the "safe" zone, and the FastEthernet 0/0 interface in the "hostile" zone. Policy is applied according to the following matrix:

For more information for Easy VPN with IPsec VTI, please see: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6635/prod_white_paper0900aecd803645b5.shtml

For a conceptual discussion of Zone-Based Policy Firewall, please see: http://www.cisco.com/en/US/products/ps6350/products_feature_guide09186a008072c6e3.html

Some types of IPsec VPN differ from tunnel-interface- (VTI-)based VPN in that instead of using an "interface tunnel [number]" or "interface virtual-template type tunnel [number]" configuration, a crypto map is applied to one or more interfaces in a router, and traffic passing the interface is checked to see if it matches the cryptographic policy. Traffic matching the policy is encrypted and sent over the IPsec VPN connection. IPsec VPN features such as classic site-to-site connections, classic EasyVPN, and GET VPN all apply this type of configuration. Non-interface-based IPsec VPN generally requires more complex configuration than VTI-based VPN features for application of features such as network address translation (NAT), quality of service (QoS), intrusion prevention, as the traffic must be specifically selected from all traffic flowing through clear-text interfaces, and may require feature application on multiple interfaces to catch all cleartext traffic that will enter or leave a router through an IPsec tunnel.

This basic example illustrates an IPsec crypto map applied to the FastEthernet 0/0 interface in the "Hostile" zone, and connection to the protected network on the FastEthernet 0/1 interface in the "safe" zone. Policy is applied according to the following matrix:

For a conceptual discussion of Zone-Based Policy Firewall, please see: http://www.cisco.com/en/US/products/ps6350/products_feature_guide09186a008072c6e3.html