topic Re: How to update Zone Based Firewall policy? in Network Security

How to update Zone Based Firewall policy?

pingduck — Tue, 23 Jun 2020 00:47:55 GMT

I have a ZBFW policy:

policy-map type inspect mypolicy

class type inspect whitelist

pass

class type inspect everything

inspect

But what if I need to add a new class-map:

policy-map type inspect mypolicy

class type inspect whitelist

pass

class type inspect blacklist

drop

class type inspect everything

inspect

How can I do it without removing mypolicy and recreate it again? If I remove mypolicy, it will also remove its reference within zone pairs. It is a PITA.

Re: How to update Zone Based Firewall policy?

Rob Ingram — Tue, 23 Jun 2020 07:46:18 GMT

Hi,

You don't need to remove the policy-map in order to add a class-map. You just need to edit the policy-map, add the class-map and potentially temporarily remove/re-add a class-map until you get the order you desire. Editing the policy-map therefore won't remove the zone-pairs.

HTH

Re: How to update Zone Based Firewall policy?

pingduck — Tue, 23 Jun 2020 14:31:47 GMT

You correctly pointed out that I don't need to remove the policy-map.

However, in order do what I want, I still need to remove "class type inspect everything", leaving myself unprotected and also dropping traffic, add "class type inspect blacklist" and add back "class type inspect everything". This will get significantly complicated if I have more than a few classes within policy-map. Is there no way to edit the policy-map by specifying the order?

Re: How to update Zone Based Firewall policy?

Rob Ingram — Tue, 23 Jun 2020 17:46:41 GMT

No, not for ZBFW policy-maps that I am aware of. If you need further clarification you should log a TAC call.