cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1823
Views
20
Helpful
3
Replies

How to update Zone Based Firewall policy?

pingduck
Beginner
Beginner

I have a ZBFW policy:

 

policy-map type inspect mypolicy

class type inspect whitelist

  pass

class type inspect everything

  inspect

 

But what if I need to add a new class-map:

 

policy-map type inspect mypolicy

class type inspect whitelist

  pass

class type inspect blacklist

  drop

class type inspect everything

  inspect

 

How can I do it without removing mypolicy and recreate it again? If I remove mypolicy, it will also remove its reference within zone pairs. It is a PITA.

3 Replies 3

Rob Ingram
VIP Master VIP Master
VIP Master

Hi,

You don't need to remove the policy-map in order to add a class-map. You just need to edit the policy-map, add the class-map and potentially temporarily remove/re-add a class-map until you get the order you desire. Editing the policy-map therefore won't remove the zone-pairs.

 

HTH

You correctly pointed out that I don't need to remove the policy-map.

 

However, in order do what I want, I still need to remove "class type inspect everything", leaving myself unprotected and also dropping traffic, add "class type inspect blacklist" and add back "class type inspect everything". This will get significantly complicated if I have more than a few classes within policy-map. Is there no way to edit the policy-map by specifying the order?

No, not for ZBFW policy-maps that I am aware of. If you need further clarification you should log a TAC call.
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers