https://community.cisco.com/t5/network-security/zbfw-simple-question/m-p/3939696#M5245 Hi,<BR />Yes, by matching on UDP protocol it should permit DNS, unless of course DNS is using TCP.<BR /><BR />HTH Sat, 12 Oct 2019 19:43:54 GMT Rob Ingram 2019-10-12T19:43:54Z https://community.cisco.com/t5/network-security/zbfw-simple-question/m-p/3939692#M5243 <P>Hi,</P><P>&nbsp;</P><P>It's very basic question but I would like to be sure because I didn't find a clear and simple answer.</P><P>When I setting up a class-map to inspect traffic (match-any) I need to choose which protocols to inspect but do I understand this correctly if I will set:</P><P>#<EM>match protocol udp</EM></P><P>does it apply to for example DNS packets which also use udp or I need to define m<EM>atch protocol dns</EM> separately?&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 21 Feb 2020 17:35:15 GMT https://community.cisco.com/t5/network-security/zbfw-simple-question/m-p/3939692#M5243 kubn2 2020-02-21T17:35:15Z https://community.cisco.com/t5/network-security/zbfw-simple-question/m-p/3939696#M5245 Hi,<BR />Yes, by matching on UDP protocol it should permit DNS, unless of course DNS is using TCP.<BR /><BR />HTH Sat, 12 Oct 2019 19:43:54 GMT https://community.cisco.com/t5/network-security/zbfw-simple-question/m-p/3939696#M5245 Rob Ingram 2019-10-12T19:43:54Z