topic Both support zone-base by my in Network Security

Which Cisco 881 supports Zone Bazed Firewall?

Oleksii Borodin — Tue, 12 Mar 2019 08:54:06 GMT

Which of this routers supports Zone Bazed Firewall?

cisco881-sek-k9
cisco881-k9
cisco891-k9

I cann't find an answear in documentation. If you find an answear in documentation, post the URL link on this document, please.

Use the Cisco feature

Rahul Govindan — Wed, 08 Feb 2017 14:28:29 GMT

Use the Cisco feature Navigator to check if a feature is supported on a platform or software release.

http://cisco.com/go/cfn

For Zone based Firewall, looks like both 881 and 891 support it with Advanced security or Advanced ip services license.

Hi

Francesco Molino — Wed, 08 Feb 2017 14:34:12 GMT

You can look on Cisco IOS Feature navigator website.

Based on it, it seems that 881 is supporting ZBFW with universal Data IOS image. However, 891 doesn't seems to support it.

You also have the datasheet:

- here for 881: http://www.cisco.com/c/en/us/products/collateral/routers/887-integrated-services-router-isr/data_sheet_c78_459542.html

- here for 891: http://www.cisco.com/c/en/us/products/collateral/routers/800-series-routers/data_sheet_c78-519930.html

Based on datahseets, it seems that both of them support ZBFW.

I'll trust more datasheet than Cisco IOS feature navigator.

Sorry for these small informations.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

Both K9 and SEC/K9 support

Marius Gunnerud — Wed, 08 Feb 2017 19:29:50 GMT

Both K9 and SEC/K9 support ZBFW. If memory serves me correctly the only difference between the two is that SEC/K9 is a for export license and limits the number of IPsec tunnels you are allowed to have as well as rate limits the max bandwidth for VPNs. To get past this issue you need to purchase an HSEC-K9 license.

Please remember to select a correct answer and rate helpful posts

About Cisco 881:

Oleksii Borodin — Fri, 10 Feb 2017 09:38:13 GMT

About Cisco 881:

You can see here http://www.cisco.com/c/en/us/products/collateral/routers/887-integrated-services-router-isr/data_sheet_c78_459542.html that

Models	Universal Image	Default Feature Set	First Cisco IOS Software Release
Cisco 881 SEC	Data	Advanced IP	12.4(20)T, 15.1(4)M
C881-K9	Data	Advanced Security	15.3(3)M2, 15.4(1)T

In Table 5. Cisco IOS Software Features on Cisco 880 Series: Advanced Security Feature Set

Security features : Zone-based policy firewall

But

In Table 7. Cisco IOS Software Features on Cisco 880 Series: Advanced IP Services Feature Set

Security features : Zone-based policy firewall is absent.

About Cisco 891:

I found here http://www.cisco.com/c/en/us/products/collateral/routers/800-series-routers/data_sheet_c78-519930.html that in Cisco IOS Software: Advanced IP Features Zone-based firewall supported. Additionally ISR 891 supports IOS 15.4(1)T specified for ISR 881, as Advanced Security with Zone-Based firewall.

As I see:

cisco881-sec-k9 - doesn't support ZBF. But you can obtiain it with HSEC-K9 license.
cisco881-k9 - support ZBF
cisco891-k9 - support ZBF

Could I solve this problem for by using software 15.3(3)M2, 15.4(1)T for ISR 881-sec-k9?

Both support zone-base by my

Marius Gunnerud — Fri, 10 Feb 2017 10:00:24 GMT

Both support zone-base by my understanding:

Q. What are the two configuration models for Cisco IOS Firewall?

A. There are two configuration models for Cisco IOS Firewall. The traditional configuration model, Classic Firewall (formerly known as Context-Based Access Control, or CBAC), and the new configuration model, Zone-Based Policy Firewall.

Classic Firewall will continue to be maintained for the foreseeable future, but will not be significantly enhanced with new features. Instead, the strategic development direction for Cisco IOS Firewall is carried by Zone-Based Policy Firewall.

Q. Do all of the router platforms support the same Cisco IOS Firewall functions?

A. No. Cisco Integrated Services Routers (Cisco 800 Series Routers; Cisco 1800, 2800, and 3800 Series Integrated Services Routers), Cisco 7200 Series Routers, and the Cisco 7301 Router support both Classic Cisco IOS Firewall and Zone-Based Policy Firewall; Cisco ASR 1000 Series Aggregation Services Routers support only the Zone-Based Policy Firewall.

http://www.cisco.com/c/en/us/products/collateral/security/ios-firewall/prod_qas09186a008010a40e.html

Please remember to select a correct answer and rate helpful posts