topic Changing from ZBF back to the old style firewall in Network Security

Changing from ZBF back to the old style firewall

grunger106 — Mon, 11 Mar 2019 21:32:46 GMT

I have an 887, I'm having trouble wrapping my head around the ZBF.

I would like to change it to the old style firewall, but using the CCP it says I must delete the ZBF policys first - fair enough, I deleted all the rules so the firewall looks blank, but it still doesn't want to let me change the firewall mode - saying I must remove all the policies first...

What am I doing wrong? I'd prefer no to have to reset the router and start over....

Thanks

Changing from ZBF back to the old style firewall

cadet alain — Fri, 30 Sep 2011 18:15:00 GMT

Hi,

to configure CBAC just remove the interfce from zones with the command:

interface x/x

no zone sec

to see the zone name to which interface belongs just type show run int x/x

Regards.

Alain.

Changing from ZBF back to the old style firewall

grunger106 — Sun, 02 Oct 2011 06:51:00 GMT

Thanks for your help!

Should I remove all the rules, zone pairs etc first?

I presume I'd need to do this on both the dialer and vlan1 interfaces?

Do you know how to do this via CCP? I'm still learning the terminal....

Changing from ZBF back to the old style firewall

cadet alain — Sun, 02 Oct 2011 10:07:12 GMT

Hi,

I can only help you with the CLI as I rarely use GUIs to configure.

You just need to remove the interfaces from the zones to be able to configure CBAC on them.

But to get a clean config and get rid of self zone policies just do a show run to get the config and delete

class-maps , policy-maps, zones and service-policies by prepending them with a no.

eg: class-map type inspect TEST ----> no class-map type inspect TEST.

if you've got a problem just post your show run then i'll post back the commands to enter to get rid of all zbf config.

Regards.

Alain.

Changing from ZBF back to the old style firewall

ilwadhi.r — Sun, 02 Oct 2011 19:52:54 GMT

Hey

Just a word of caution, make sure you remove zone from all interfaces at the same time,Else it may bring down your network, Also make sure you do it in an appropriate down time.

check all interface and remove zone from them in a single go.

To Check interface run

Sh run | beg interface

Find out interfaces on which a zone is applied

Remove Zones from all the interfaces in a single go

interface x/x

no zone sec

interface y/y

no zone sec

HTH

Rahul

Changing from ZBF back to the old style firewall

grunger106 — Mon, 03 Oct 2011 20:10:09 GMT

GRE now passing perfectly over CBAC...

And I'll need to be learning IOS and then ZBF then!

Thank you both