Cisco Zone-based firewall issue/ not receiving return traffic

AlexandrePerreault66 — Tue, 12 Mar 2019 00:40:24 GMT

Hi,

I have created a Cisoc IOS Zone based firewall on my cisco 3945 router. I have an issue receiving any returning traffic. Here is a simplified version of my issue.

I have two zone pairs: Internal to Outside and Outside to Internal.

In the zone pair Out-to-Int I have a few rules allowing connections to specific servers on specific ports. The default class-map drops any non-matching packets.

In the zone pair Int-to-Out I have a rule saying internal PCs can access any destination on the internet over “any” service. When I put the action as “Inspect” I cannot connect to the internet. It’s as if my return traffic is not detected by the firewall and instead gets dropped by the default class map in the Out-to-Int pair.

To make it work I need to do two changes. I need to choose Allow instead of Inspect and I need to change the default class-map on the Out-to-Int pair to “allow” for unmatched traffic. But this is not good because I have a default allow on my out-to-int pair.

Am I misunderstanding something? Shouldn’t the inspect action on the Int-to-Out zone allow for return traffic no matter what rules I applied on the Out-to-Int pair? Thank you in advance for your help.

Cisco Zone-based firewall issue/ not receiving return traffic

Karsten Iwen — Sun, 23 Dec 2012 18:40:36 GMT

Please share your config. Then we can see what's wrong there.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

topic Cisco Zone-based firewall issue/ not receiving return traffic in Network Security

Cisco Zone-based firewall issue/ not receiving return traffic

Cisco Zone-based firewall issue/ not receiving return traffic