ccna 4 chapter 7

ccna 4 chapter 7.Multiple detection policies and ACLs on several interfaces of a router make it difficult to associate policies for traffic across multiple interfaces.Policies cannot be bound to a host group or subnet through an ACL. All traffic passing through an interface is subject to the same inspection.Processing is too dependent on ACLs.4.3 Zone Based Policy Firewall 111 zones establish the security perimeter of the network. The zone itself defines a boundary at which policy restrictions are placed on traffic that is to enter other network zones. The default policy between zones is to deny all traffic. If not explicitly configured, all traffic transmitted between zones is blocked. This differs from the classic firewall model, which allows it by default unless the ACL is explicitly blocked. Although many ZPF commands are similar to classic firewall commands, they are not identical. The second notable change is the introduction of the CiscoCommonClassificationPolicyLanguage (C3PL). This new configuration policy language provides a modular approach to firewall functionality. The benefits of ZPF include the following.It does not depend on ACLs.Router state is blocking unless explicitly allowed. Using C3PL, policies are easy to read and troubleshoot.A single policy can affect any traffic, eliminating the need for multiple ACLs or performing detection.When determining whether to implement a classic firewall or a zone policy, it is important to note that both configurations can be used on a single router, but not on an interface at the same time. For example, an interface cannot be configured as a member of a security zone and perform IP detection at the same time.4.3.1.3 Zone Policy Based Firewall DesignCommon ZPF designs are LAN-to-Internet firewalls, firewalls with public servers, redundant firewalls, and complex firewalls. The design of a zone policy based firewall has the following steps. Step 1 Determine the zones - Based on the different levels of security, the network infrastructure has to be divided into separate zones. In this step, the administratordoes not need to consider the physical implementation of the firewall (number of devices, depth of defense, redundancy, etc.), but rather focuses on how to divide the infrastructure into separate zones. For example, the public network to which the internal network is connected is a zone.