port forward SSH on port 29003

[creepingdeath]

objective
=========

port forward SSH protocol on port 29003 using zone based firewall to a LAN host (172.16.2.1) running SSHD


current way I do port forwards
==============================

ip port-map user-sftp port tcp 29002

zone security ZONE-out
zone security ZONE-in

zone-pair security ZP-out-to-in source ZONE-out destination ZONE-in
 service-policy type inspect PM-out-to-in
exit

interface Vlan1
 zone-member security ZONE-in
exit

interface Dialer0
 zone-member security ZONE-out
exit

class-map type inspect match-all CM-sftp
 match protocol user-sftp
 match access-group name AL-creepy-pc
exit

policy-map type inspect PM-out-to-in
 class type inspect CM-sftp
  inspect
 class class-default
  drop
 exit
exit

ip nat inside source static tcp 172.16.2.1 29002 interface Dialer0 29002

ip access-list extended AL-creepy-pc
 permit ip any host 172.16.2.1
exit

the above example works fine, i created the "ip port-map" because I was using a non standard protocol.
problem: the IOS already has SSH protocol defaulting to port 22, is there anyway I could have something like below, but use port 29003

class-map type inspect match-all CM-ssh
 match protocol ssh
 match access-group name AL-creepy-pc
exit

policy-map type inspect PM-out-to-in
 class type inspect CM-ssh
  inspect
 class class-default
  drop
 exit
exit

I found the following command: "ip port-map ssh port tcp 29003", would that work?

the reason I ask is... with my basic understanding of the firewall... the IOS has different inspection rates depending on the traffic passing through.

eg. the IOS can inspect packets in greater depth if it is a layer 7 (application) packet and the IOS has the protocol built in (like HTTP)
eg. the IOS will inspect the packet in less dpeth if the IOS only knows the packet is TCP or UDP

now, if I could use the following command: "match protocol ssh" but on port 29003, would the IOS inspect the packets in greater depth than if I did the following to do the port forward:

ip access-list extended AL-ssh
 permit tcp any host 172.16.2.1 eq 29003
exit

class-map type inspect match-all CM-ssh
 match class-map AL-ssh
exit

policy-map type inspect PM-out-to-in
 class type inspect CM-ssh
  inspect
 class class-default
  drop
 exit
exit

sorry if I make no sense.

thanks.

 

[burtsbees]

Updating PAM is generally for CBAC, but should work for ZBF.

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!