I can't seem to get my HTTP traffic through the Zone-Based Firewall; think the NAT might be confusing me. Here is my configuration on GNS3:
R1#show run
Building configuration...
Current configuration : 1773 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip cef
!
ip domain name lab.local
ip name-server 194.168.4.100
ip name-server 194.168.8.100
!
multilink bundle-name authenticated
!
class-map type inspect match-all INSIDE-TO-OUTSIDE-CLASS
match access-group name INSIDE-TO-OUTSIDE
!
policy-map type inspect INSIDE-TO-OUTSIDE-POLICY
class type inspect INSIDE-TO-OUTSIDE-CLASS
inspect
class class-default
drop log
!
zone security INSIDE
zone security OUTSIDE
zone-pair security INSIDE-TO-OUTSIDE source INSIDE destination OUTSIDE
service-policy type inspect INSIDE-TO-OUTSIDE-POLICY
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface FastEthernet1/0
ip address 192.168.0.254 255.255.255.0
ip nat outside
ip virtual-reassembly
zone-member security OUTSIDE
duplex half
!
interface FastEthernet2/0
ip address 172.16.0.254 255.255.255.0
ip nat inside
ip virtual-reassembly
zone-member security INSIDE
duplex half
!
ip route 0.0.0.0 0.0.0.0 192.168.0.1
no ip http server
no ip http secure-server
!
ip nat inside source list NAT interface FastEthernet1/0 overload
!
ip access-list standard NAT
permit 172.16.0.0 0.0.0.255
!
ip access-list extended INSIDE-TO-OUTSIDE
permit tcp 172.16.0.0 0.0.0.255 any eq www
permit tcp 172.16.0.0 0.0.0.255 any eq domain
!
logging alarm informational
!
control-plane
!
gatekeeper
shutdown
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
login
!
end
I'm NATing the internal network (172.16.0.0/24) to 192.168.0.254 as that is private network configured on my home router. There is a default route to my home router (192.168.0.1), and that is obviously going to be NATed again (which I have no control over) before traffic leaves.
My permit statements in the class-map is for the internal 172.16.0.0/24 network... is that correct? I'm not exactly sure how Zone-Based Firewall works with NAT. Logs are showing that DNS traffic is being dropped:
*Jul 20 01:32:41.183: %FW-6-DROP_PKT: Dropping Other pkt 192.168.0.254:44646 => 208.67.222.222:53 with ip ident 27112 due to DROP action found in policy-map
Why would DNS be dropped? I thought 192.168.0.254 would be considered to be in the self zone, and therefore be permitted anyway?
