Security Zones Architecture

Overview

The rule applied depend whether the traffic is part of an inbound or an outbound connection. A connection is inbound if its establishing packet passed from a lower to a higher security zone. A connection is outbound if its establishing packet passed from a higher to lower security zone.

At present, outside is the lowest security zone. Then in ascending order: public, lab and servers.

Outside Zone

Outgoing connections from higher security zones receive routable addresses in the global IP address block when passing into this zone.

Public Zone

Incoming connections are allowed from the outside zone to access departmental public services: notably the web server, professor and faculty web pages, and our external domain name service. Outgoing connections from the public zoner are required to secondary other name servers and to respond to pings.

Lab Zone

Incoming connections are allowed from the outside zone to allow remote access for students to the lab and to receive email addressed to the lab machines. In order to enforce student privacy, only authenticated channels can pass inward. Outgoing connections of any sort are permitted to the Internet. Pings and certain other ICMP messages are also allowed.

Server Zone

All outgoing connections are allowed, to the lab zone or outside side. Incoming connections are restricted to fully authenticated connections. An incoming connection is allowed from the public zone so that the public web server can retrieve faculty and staff web pages. Incoming email is allowed.

NAT and XLATE's

• Network Address Translation (NAT)
• Access Control Lists (ACL's)

NAT

Each zone attaches to the PIX through one of its interfaces and is part of a separate Local Area Network. It is equivalent to speak of the public zone or the PIX's public interface, for instance. The outside zone attaches to the university backbone, and has an address inside the space of university backbone addresses - 129.171.32.9. The backbone sees the PIX as a router behind which lie all machines in the class C IP address block 192.31.89.0/24.

However, no machines of that address lie behind the PIX. Every other interface is assigned a network of the type known as private-local. These addresses are suppressed if found on the backbone and are therefore unroutable outside of the department. Access between these interfaces and the outside interface, and among inner interfaces, requires that the addresses be rewritten on passage from interface to interface. The control of which machines have rewritten addresses, and under what conditions a rewriting is allowed, is the key mechanism by which the PIX controls access between interfaces, and therfore, between zones.

To pass between interfaces, the PIX maintains a translation table in which it creates xlate slots. A xlate slot is (this is a simplified explanation) the four items:

   (inner-interface, outer-interface) global-address, local-address

• A packet passing from the inner to outer interface will have its source address rewritten from local-address to global-address. A packet passing from the outer to inter interface will have its destination address rewritten from global-address to local-address.

Before a connection can be established between zones, a xlate slot must exist. Xlate slots are either allocated statically during the PIX configuration or they are created dynamically when needed. Outbound connections will use a static slot if it exists, but if not, an xlate slot can be created dynamically. Inbound connections must use a static xlate slot.

Inbound connections

An inbound connection is a connection initiatiated by a packet coming from a lower security interface to a higher security interface. The xlate slot for such a connection must configured manually, it is static. If there is no matching xlate slot, the packet is dropped. Here is the configuration line creating the static xlate slot which permits access to our public server:

   static (public,outside) 192.31.89.3 172.18.0.2 

Outbound connections

An outbound connection is a connection initiatiated by a packet on a higher security interface heading to a lower security interface. If a static xlate slot for an outbound connection does not exist staticly, a dynamic slot can be created. A pair of configuration lines allow the creation of dynamic xlate slots:

   nat (lab) 2 0.0.0.0 0.0.0.0 0 0
   global (outside) 2 192.31.89.133-192.31.89.231

An example machine, say 172.19.1.123, could create the following xlate slot on first attempting to connect outside the department:

   (lab,outside) 192.31.89.156 172.19.1.123

ACL's and Connections

Once a connection is set up, packets for the connection flow unhindered, whichever way the packet passes through the PIX. Setting up a connection requires two steps:

1. An xlate slot must exist or be created.
2. The Access List for the incoming interface must rule on the connection's creation.

ACL's (Access Lists) apply for both inbound and outbound connections. For inbound connections, it is the ACL of the lower security interface that rules; for outbound connections, the ACL of the higher security interface applies. In the previous example, we created a static xlate to offer the services of our public server to the outside world. A web request will find this xlate and then attempt to create a connection. This access list line allows that connection:

   access-list acl_out permit tcp any host 192.31.89.3 eq www 

Document History