Re: ZONE-BASED-FIREWALL

Hi!,

so you did something like:

class-map type inspect CM_ICMP
 match protocol ICMP

policy-map type inspect PM_ICMP
 class CM_ICMP
  inspect

zone security X
zone security Y

interface facing to R5
 zone-member security X

interface facing R1
 zone-member sec Y

zone-pair security FROM_Y_TO_X source Y destination X
 service-policy type inspect PM_ICMP

is this your configuration?

if not can you send in yours?

On Wed, Oct 3, 2012 at 2:54 PM, Mohammad Mousa <mohd-mousa_at_hotmail.com>wrote:

> Hi Guys, I have a question about ZBF, as far as I know that the ZBF is
> taking the concept from the CBAC by permiting all the traffic that
> initiated from inside to the outside and permit the return traffic.I
> defined the policy-map to pass the ICMP and class-default as well.
> R1------R2----R5 (Router2) have four interfaces, one of them is in Zone
> X (interface facing R5) and the others in zone Y. When I pinged from
> R1-R5, I saw the output of the ICMP debuging and the packets reached R5,
> but the traffice didn't come back to R1. When I put the zone-pair both
> direction, it worked fine! please advice me, correct me if I'm wrong !Thank
> you all.
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
>
>
>
>
>
>

-- 
@ccie99999
Blogs and organic groups at http://www.ccie.net