Lab Objective
Configure two security zones on a router, assign interfaces to each, define a class-map and policy-map inspecting traffic from the inside zone to the outside zone, apply it to a zone pair, and verify outbound connections work while unsolicited inbound connections are blocked.
Lab Purpose
The ACLs covered extensively earlier in this series are stateless — permitting return traffic requires either a separate explicit rule or relying on the ACL's own limited state tracking via the established keyword. The Zone-Based Firewall (ZBFW) provides genuine stateful inspection, automatically permitting return traffic for any connection initiated from a trusted zone without needing a matching inbound rule.
Lab Topology
R1
Gi0/0 (INSIDE zone): 192.168.240.1/24
Gi0/1 (OUTSIDE zone): 203.0.113.60/30
Goal: hosts on the inside can initiate
connections outbound; unsolicited inbound
connections from outside are blockedTask 1: Configure Basic Addressing
Configure both interfaces as shown.
Task 2: Create the Security Zones
Create zones named INSIDE and OUTSIDE, and assign the respective interfaces to each.
Task 3: Define a Class-Map and Policy-Map for Inspection
Create a class-map matching all traffic, and a policy-map applying stateful inspection to it.
Task 4: Create the Zone Pair and Apply the Policy
Create a zone pair from INSIDE to OUTSIDE and apply the inspection policy to it.
Task 5: Verify Outbound Connections Succeed
Confirm a host on the inside can successfully reach an external server.
Task 6: Verify Unsolicited Inbound Connections Are Blocked
Confirm an external host cannot initiate a new connection toward an inside host.
Solution and Verification
R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.240.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ip address 203.0.113.60 255.255.255.252
R1(config-if)# no shutdownR1(config)# zone security INSIDE
R1(config-sec-zone)# exit
R1(config)# zone security OUTSIDE
R1(config-sec-zone)# exit
R1(config)# interface gigabitethernet0/0
R1(config-if)# zone-member security INSIDE
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# zone-member security OUTSIDER1(config)# class-map type inspect match-any INSIDE-TO-OUTSIDE-CLASS
R1(config-cmap)# match protocol tcp
R1(config-cmap)# match protocol udp
R1(config-cmap)# match protocol icmpR1(config)# policy-map type inspect INSIDE-TO-OUTSIDE-POLICY
R1(config-pmap)# class type inspect INSIDE-TO-OUTSIDE-CLASS
R1(config-pmap-c)# inspect
-- "inspect" is what enables stateful
-- tracking -- it remembers connections
-- initiated in this direction so return
-- traffic is automatically permittedR1(config)# zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
R1(config-sec-zone-pair)# service-policy type inspect INSIDE-TO-OUTSIDE-POLICYInsidePC (192.168.240.10)> curl http://[external server]
-- Successful HTTP connectionR1# show policy-map type inspect zone-pair sessions
Zone-pair: IN-TO-OUT
Class-map: INSIDE-TO-OUTSIDE-CLASS
tcp connections: 1
Established Sessions
192.168.240.10:52341 -> [ext-server]:80 ...
-- The connection is tracked statefully,
-- confirming return traffic is being
-- automatically permittedExternalHost> curl http://192.168.240.10
-- Connection times out
-- No zone pair exists in the reverse
-- direction (OUTSIDE to INSIDE), so
-- unsolicited traffic initiated from
-- outside has no policy permitting it
-- and is dropped by defaultKey Takeaway
ZBFW's default behavior between any two zones is deny-all unless an explicit zone pair and policy exist for that specific direction — configuring only an INSIDE-to-OUTSIDE zone pair with inspect automatically and statefully permits the return traffic for connections initiated inward, while leaving unsolicited outside-to-inside traffic blocked by the implicit inter-zone deny, all without needing a second, separate zone pair in the reverse direction.