topic Zone Based Firewall - changing rule order in policy-maps in Network Security

Zone Based Firewall - changing rule order in policy-maps

mat_rouch — Tue, 12 Mar 2019 01:27:32 GMT

I have a questions about configuring ZBF at the command line. I need to insert a new class-map into one of my policy-maps. The new class-map needs to go at the beginning of the list. How do I move class-maps up and down at the command line? I've found a couple of documents that show how to do it in one or another GUI environment, but I'm not using any of those.

For reference, my config looks like this:

--------------------------------------------------------------------------------

policy-map type inspect inside-to-Transit-policy

class type inspect Standard-Email

inspect

class type inspect Management-Traffic

inspect

class type inspect interoffice-traffic-outbound

inspect

class type inspect WB-to-ANB-traffic-outbound

inspect

class type inspect Standard-Browsing

inspect

--------------------------------------------------------------------------------

class-map type inspect match-all spiceworks-outbound

match access-group name mgmt-ip-to-spiceworks

--------------------------------------------------------------------------------

I need to insert "spiceworks-outbound" in the policy map "Inside-to-Transit-policyy", but it needs to appear above "Management-Traffic" in the list in order to work properly.

Thanks,

-Mat

Zone Based Firewall - changing rule order in policy-maps

Julio Carvajal — Fri, 12 Apr 2013 17:39:13 GMT

Hello Mat_rouch,

if doing it via CLI then you will need to delete the policy-map and then re-configure it with the right order,

There should be a way to do it without this( like with a sequence number but there is none)

regards,

Julio Carvajal

Zone Based Firewall - changing rule order in policy-maps

mat_rouch — Mon, 15 Apr 2013 13:43:53 GMT

OK, good to know. One other question: I have tried using CCP to manage my ZBF, but CCP appears to only allow one dmz to be defined. I need more than one. Is there another free (or inexpensive) tool that would allow me to do this? Or am I wrong about CCP only allowing one dmz?

-Mat

Zone Based Firewall - changing rule order in policy-maps

Julio Carvajal — Mon, 15 Apr 2013 16:30:47 GMT

Hello Mat,

I think CCP only allows up to 3, I have not played that much with the guy, I just work with CLI,

Regards

Remember to rate all of the helpful posts

Zone Based Firewall - changing rule order in policy-maps

mat_rouch — Mon, 15 Apr 2013 18:25:42 GMT

OK, thanks for the info.

Re: Zone Based Firewall - changing rule order in policy-maps

Julio Carvajal — Mon, 15 Apr 2013 18:27:42 GMT

Hey my pleasure,

remember to rate all of the helpful posts