Changing from ZBF back to the old style firewall

[grunger106]

Hi

I have an 887, I'm having trouble wrapping my head around the ZBF.

I would like to change it to the old style firewall, but using the CCP it says I must delete the ZBF policys first - fair enough, I deleted all the rules so the firewall looks blank, but it still doesn't want to let me change the firewall mode - saying I must remove all the policies first...

What am I doing wrong? I'd prefer no to have to reset the router and start over....

Thanks

[cadet alain]

Hi,

to configure CBAC just remove the interfce from zones with the command:

interface x/x

no zone sec

to see the zone name to which interface belongs just type show run int x/x

Regards.

Alain.

[grunger106]

Thanks for your help!

Should I remove all the rules, zone pairs etc first?

I presume I'd need to do this on both the dialer and vlan1 interfaces?

Do you know how to do this via CCP? I'm still learning the terminal....

[cadet alain]

Hi,

I can only help you with the CLI as I rarely use GUIs to configure.

You just need to remove the interfaces from the zones to be able to configure CBAC on them.

But to get a clean config and get rid of self zone policies just do a show run to get the config and delete

class-maps , policy-maps, zones and service-policies by prepending them with a no.

eg: class-map type inspect TEST ----> no class-map type inspect TEST.

if you've got a problem just post your show run then i'll post back the commands to enter to get rid of all zbf config.

Regards.

Alain.

[ilwadhi.r]

Hey

Just a word of caution,  make sure you remove zone from all interfaces at the same time,Else it may bring down your network, Also make sure you do it in an appropriate down time.

check all interface and remove zone from them in a single go.

To Check interface  run

Sh run | beg interface

Find out interfaces on which a zone is applied

Remove Zones from all the interfaces in a single go

interface x/x

no zone sec

!

interface y/y

no zone sec

!

HTH

Rahul

[grunger106]

GRE now passing perfectly over CBAC...

And I'll need to be learning IOS and then ZBF then!

Thank you both