CHAPTER 10: MODULAR POLICY FRAMEWORK CONFIGURATION In this Chapter we will see the key concepts behind Modular Policy Framework (MPF). MPF is quite complex and extensive so I will only describe the basic features of it and the most useful concepts as implemented in real world networks. MPF Overview ‘The Modular Policy Framework provides greater granularity and tlexibility in implementing network and security policies with the ASA appliance. The MPF mechanism can be used for example to apply Quality of Service (prioritization) for voice traffic, to rate-limit specific remote access VPN connections, to apply TCP connection limits to specific traffic flows, to apply deep packet (Layer 7) inspection on specific flows of traffic ete. When configuring MPF, the traffic i first identified (traffic matching) with a Class-Map, then actions are applied to the matched traffic using a Policy-Map, and finally the whole policy is enabled on an interface or globally using a Service-Policy. As described above, there are three main components of a Modular Policy Framework: A Class-Map component, a Policy-Map component and a Service-Policy component. © Class-Map: This is used to identify a traffic flow that we want to apply policies on. You can create either a Layer’/4 Class Map or a Layer 7 Class Map. In this Chapter we will focus only on Layer3/4 class maps. This type of class map matches traffic based on protocols, ports, IP addresses and other Layer3/4 characteristics of the traffic flow. On the other hand, a Layer7 Class Map matches traffic based on application characteristics (for example a certain URL, name in an HTTP traffic flow or even a certain FTP command in an FTP connection). © Policy-Map: After the firewall appliance identifies the traffic flow with a Class-Map, a Policy-Map is used to apply certain actions (or policies) to the selected class of traffic. An example of a policy-map is to limit the maximum number of TCP connections towards a Web Server on the DMZ toa certain number. Another example of a policy-map is to apply high priority to voice packets between two cites, Similarly with Class Maps, an administrator can create a Layer3/4 Policy-Map or a Layer 7 Policy-Map. 4+ Service-Policy: The Service-Policy component is used to apply the configured policy framework to an Interface or Globally on the appliance. The ASA appliance supports one Service-Policy per interface and one Globally. ‘The diagram below illustrates the structure of the Cisco ASA Modular Policy Framework. Keep this structure in mind to help you understand the various configuration examples and scenarios that we will describe later on, Modular Policy Framework Structure ® Create a class-map to identify traffic with “match” commands @ n the class-map into a Policy-Map and specify actions ® Enable the policy on an Interface or Globally using a Service-Policy Class-Map [class name] (Match traffic commands) y Policy-Map [policy name] Class [class name] Actions y Service-Policy [policy name] Apply to Interface or Globally 95,CONFIGURING CLASS-MAPS As stated above, in this Chapter we will focus only on Layer3/4 Class-Map. This type of class map classifies traffic based on Layer3 or Layer‘ attributes, such as IP address, port number, DSCP values etc. The configuration involves two steps: First configure a name for the class-map and then use the “match” command under the class-map configuration mode in order to identify the traffic flow. ASA(config)# class-map [class name] € assign a name to the class of traffic ASA(config-cmap)# match access-list [ACL name] €match traffic based on ACL ASA(config-emap)# match port /tep/udp] [eq [Link] | range port port}@match based on ports ASA(config-cmap)# match any €match any traffic ASA(config-cmap)# match default-inspection-traffic €match the default ports for the supported applications. More on this later ASA(config-cmap)# match dscp [value] € match specific dscp value(s) in the IP header. E.g dscp ef means “match expedited forwarding packets” which are usually voice packets. ASA(config-cmap)# match precedence [value] €match specific precedence value(s) in the IP header. Similar with dsep. ASA(config-cmap)# match tunnel-group (tunnel name] €match specific site-to-site VPN tunnel or even remote access VPN group ASA(config-cmap)# match flow ip destination-address this must be used together with the tunnel-group command above ASA(config-cmap)# match rtp [start port-end port] €match port range of RTP traffic Default Class-Map and default-inspection-traffic By default, an out-of-the-box Cisco ASA appliance has a class-map already configured which matches the default-inspection-traffic. You can view this default class-map in the configuration by using the “show run class-map” command. ASA(config)# show run class-map class-map inspection default match default-inspection-traffic 96‘The keyword “detault-inspection-trattic’ is a special name which denotes matching ot several default applications and protocols on their default ports, as shown on the table below. Protocol/Application Protocol Type (tcp/udp) Port CTIQBE (Computer Telephony Interface) TCP 2748 DNS UDP 53 FIP TCP 2 GTP (GPRS Tunneling Protocol) UDP 2123 “requires special license 3386 11323 11225 TOP 1720 11323 RAS UDP 1718-1719 HTTP TCP 80 ICMP N/A N/A ILS (LDAP) TCP 389) TPSee Pass-Through UDP 500 MGCP (Media Gateway Control Protocol) UDP 2427,2727 NetBIOS Name Server UDP 137,138 (Source ports) PPTP. TCP 1723 RADITIS Accounting, ume 1646 RSH TCP Sit RTSP TCP 554 SIP ] ‘TCP/UDP 5060 SCP (Cisco Skinny) TeP 2000 ‘SMTP-ESMTP TCP 5 SNMP UDP 61,162 SQU*Net TeP i521 SUN RPG UDP ii TRIP, UDP i) XDMCP UDP 17 ‘Most of the applications and protocols shown above are inspected by the ASA in its default configuration. For example, an FTP communication through the ASA between an FTP client and 7server uses a Control connection on port Z1 and a Vata connection on port ZU. Normally a statetul tial connection is on firewall would not allow such a communication to go through because the i port 21 and the return FTP data traffic is on a different port (20). Using the “default-inspection- traffic” mechanism described above (together with the “inspect” command under Global policy- ‘map configuration), the Cisco ASA will inspect the FTP traffic in order to allow both the control and the data connection flows to pass through with no problems. The rest of the protocols from the Table above either exhibit similar behavior with FTP or generally require some special “handling”, therefore they are inspected by the firewall on the application layer for proper communication. For example, the voice signaling protocol H323 has tobe inspected on the application layer in order for the firewall to allow the voice RTP (Real Time Protocol) traffic (which works on random range of UDP ports) to pass through the ASA for a successful VoIP communication. Configuration Example for Class-Map Consider a scenario where we want to apply some specific policies for the traffic reaching our company’s Web Server from the Internet. Maybe we need to apply a restriction on the maximum number of simultaneous TCP connections allowed to reach our Web Server. Also, we want to prioritize voice traffic having a DSCP value of “ef” (expedited forwarding) that goes through a specific site-to-site IPSec VPN tunnel. We will create two class-maps which will classify the traffic that we described above ASA(config)# access-list websrv_traffic permit tcp any host [Link] eq 80 € assume our public web server is host [Link] ASA(config)# class-map HTTP_To_Weh Server & create a class-map far the http traffic ASA(config-cmap)# match access-list websrv_traffic €match traffic going to web server ASA(config)# class-map L2L_Voice_Traffic €create a class-map for the voice lan-to-lan traffic ASA(config-cmap)# match tunnel-group SITE_B VPN match IPSec tunnel group SITE B VPN ASA(config-cmap)# match dscp ef match EF type traffic (i.e voice) Keep in mind the configuration snapshot above because we will refer to it later on when we will describe Policy Maps. 98,CONFIGURING POLICY MAPS After classifying the traffic with a class-map, we need to assign this class-map into a Policy-Map which is responsible to apply some actions (policies) on the selected traffic (i.e traffic that matches “match” statement in the class-map). We will focus only on Layer3/4 Policy Maps. ‘The security appliance supports one Policy-Map per interface and one Global Policy-Map. Also, each Policy-Map can support multiple Class-Maps and multiple actions on traffic. For instance, in the configuration example shown in the previous section for class-maps, we have configured two class- maps, namely “HTTP_Ta_Web,Server” and Vo ‘¢Traffic". We can assign hath class-maps into a single Policy-Map and apply actions on them. To configure a Policy-Map, first configure a name for it, then assign a class-map (using the “class” command) and then configure actions for the specific class-map. ASA(config)# policy-map [policy name] € assign a name to the policy map ASA(config-pmap)# class [class-map name] assign a class-map ASA(config-pmap-c}# [configure actions] “here configure actions for the specific class-map ASA(config-pmap-c}# exit ASA(config-pmap)# class [class-map name] assign a second class-map on the same policy ASA(config-pmap-c}# [configure actions] configure actions for the second class-map ‘The availahle categories af “actians’ that can he configured an a policy-map are the fallawing: CSC: send the traffic to Content Security and Control service module, IPS: send the traffic to the Intrusion Prevention System service module, set connection: enforce connection limits on traffic. inspect: apply protocol inspection services. police: apply rate limiting for traffic priority: apply priority for voice traffic (Low Latency Queuing-LLQ) 99,