This should match all the traffic you want to apply the policy to. ZBFW(config-sec-zone-pair)#service-policy type inspect POLICY_HTTPĪs you can see above its very similar to the 'modular' cli to configure qos etc. ZBFW(config)#zone-pair security ZP_SALES_INTERNET source ZONE_SALES destination ZONE_INTERNET ZBFW(config-pmap)#class type inspect CLASS_HTTP ZBFW(config)#policy-map type inspect POLICY_HTTP ZBFW(config)#class-map type inspect match-any CLASS_HTTP Lets configure the first zone pair. The Sales zone should only be allowed http access to the internet zone. So now there's no connectivity between the various zones.

Each interface can only be a member of one zone at a time. This is a special zone reserved for traffic destined to or sourced from the management plane of the device itself. The only exception to the default deny all is the self zone.

The default policy between zones is drop all if two interfaces are assigned to the same zone all traffic will be allowed. ZBFW(config-if)#zone-member security ZONE_INTERNET ZBFW(config-if)#zone-member security ZONE_MANAGERS ZBFW(config-if)#zone-member security ZONE_SALES From the initial configs all interfaces have connectivity to each other.įirst off lets configure the zones and assign each interface to a zone.

Just a post about the basic config and options of Cisco IOS zone based firewall using the Topology below Grab the initial configs and GNS3.

Iosv startup config.img cisco gns3