Cisco IOS Software Release 12.4(6)T introduced Zone-Based Policy Firewall (ZFW), a new configuration model for the Cisco IOS Firewall feature set. This new configuration model offers intuitive policies for multiple-interface routers, increased granularity of firewall policy application, and a default deny-all policy that prohibits traffic between firewall security zones until an explicit policy is applied to allow desirable traffic.
Access list 100 is for inside-outside access.
Access list 120 is for outside-inside access.
access-list 100 permit icmp any any
access-list 120 permit icmp any any
Create the zone names.
zone security INSIDE
zone security OUTSIDE
Assign interface to a zone.
zone-member security INSIDE
zone-member security OUTSIDE
Create a class map to match the ACL.
class-map type inspect match-all INSIDE-in-CLASS
match access-group 100
class-map type inspect match-all OUTSIDE-in-CLASS
match access-group 120
Create a policy-map to match the class-map.
policy-map type inspect INSIDE-in-POL
class type inspect INSIDE-in-CLASS
policy-map type inspect OUTSIDE-in-POL
class type inspect OUTSIDE-in-CLASS
Then assign the policy map to a zone pair and apply your policy.
zone-pair security INSIDE-OUTSIDE source INSIDE destination OUTSIDE
service-policy type inspect INSIDE-in-POL
zone-pair security OUTSIDE-INSIDE source OUTSIDE destination INSIDE
service-policy type inspect OUTSIDE-in-POL
Testing try and send ping from inside to outside.
show zone security - will show you which interfaces are assigned to each zone.
R2#sh zone security
Description: System defined zone
Show access-list - shows you matches which = packets are matching acl.
Extended IP access list 100
10 permit icmp any any (2 matches)
Extended IP access list 120
10 permit icmp any any (1 match)
Dynamic logs created by the drop log statement under the policy-map
*Mar 1 00:07:43.663: %FW-6-DROP_PKT: Dropping Other session 192.168.1.1:27668 192.168.2.2:23 on zone-pair INSIDE-OUTSIDE class class-default due to DROP action found in policy-map with ip ident 22620