I configured the zone based firewall and the rules seem to work fine. However, the speeds are really bad. Even when just using pass actions it only reaches 1.5 Gbit/s (with the firewall turned off it reaches 9-10 Gbit/s).
This even happens with very minimal ZBF config. There is an VM-Host connected to the first 10GE interface, the VMs reach 10 Gbit/s when using iperf without ZBF active, after enabling they slow down.
class-map type inspect match-any cmap--test
match protocol tcp
match protocol udp
!
policy-map type inspect pmap--test
class type inspect cmap--test
inspect
class class-default
drop
!
zone security test-in
zone security test-out
zone-pair security in-to-out source test-in destination test-out
service-policy type inspect pmap--test
!
interface TenGigabitEthernet0/0/0.1
encapsulation dot1Q 1000
ip address 192.168.1.1 255.255.255.192
zone-member security test-in
!
interface TenGigabitEthernet0/0/0.2
encapsulation dot1Q 2000
ip address 192.168.0.1 255.255.255.0
zone-member security test-out
Is there any way to improve ZBF performance?
