Cannot keep P2P blocked with ZFW

Unanswered Question
Feb 19th, 2010

I have configured a router with ZFW and from my testing I can confirm that almost everything is working the way it should except the P2P blocking. It doesn't seem to block anything in the P2P arena and I've tried Gnutella, Kazaa, and Bittorent and all of them are able to make a connection, search and download. I even have DPI enabled to make sure it can't use http but it still manages to get out.

Once in a while the router does log a message (below) but it's not consistent.

*Feb 19 20:26:15.689: %APPFW-6-P2P_PORT_HOP: gnutella using 9699 port -  tcp session 10.32.2.30:3976 70.121.190.197:9699 on zone-pair in-out class CM_INSPECT

Feb 19 20:26:48.641: %FW-6-LOG_SUMMARY: 1 packet were dropped from 10.32.2.30:3985 => 24.141.184.178:36486 (target:class)-(in-out:CM_P2P)

class-map type inspect match-any CM_INSPECT
match protocol dns
match protocol https
match protocol icmp
match protocol imap
match protocol tcp
match protocol udp


class-map type inspect match-all CM_HTTP
match protocol http

class-map type inspect http match-any CM_PORTMISUSE
match  request port-misuse p2p
match  request port-misuse tunneling
match  req-resp protocol-violation


class-map type inspect match-any CM_P2P
match protocol edonkey signature
match protocol gnutella signature
match protocol kazaa2 signature
match protocol fasttrack signature
match protocol bittorrent signature
match protocol gnutella

policy-map type inspect http PM_HTTPDPI
class type inspect http CM_PORTMISUSE
  log
  reset


policy-map type inspect PM_INSPECT
class type inspect CM_P2P
  drop log
class type inspect CM_HTTP
  inspect
  service-policy http PM_HTTPDPI
class type inspect CM_INSPECT
  inspect
class class-default
  drop   
        
zone security outside
zone security inside

zone-pair security in-out source inside destination outside
service-policy type inspect PM_INSPECT

interface BVI1
ip address 10.32.2.1 255.255.255.0
ip nat inside
ip virtual-reassembly
zone-member security inside

interface FastEthernet4
ip address dhcp
ip nat outside
ip virtual-reassembly
zone-member security outside
speed 100
full-duplex

Any help is appreciated!!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Actions

This Discussion