HSRP Multicast with ZBFW

[Matthew]

I am currently using interface based ACL's and during my configuration of HSRP I had to allow my secondary routers IP to multicast to the address of 224.0.0.2 and just the same on the secondary one for the IP on the primary router. If I convert to a zone based firewall what will I have to do to allow HSRP to work properly?

Current configuration:

Primary:

IP: 192.168.1.11

VIP: 192.168.1.1

permit udp host 192.168.1.12 host 224.0.0.2 eq 1985

Standby:

IP: 192.168.1.12

VIP:192.168.1.1

permit udp host 192.168.1.11 host 224.0.0.2 eq 1985

[Philip D'Ath]

Zone based firewall is more for traffic between interfaces, not to an interface (all though there is the "self" zone).  While an interface ACL affects traffic entering an interface, rather than passing between interfaces.

If you have no rules defined between the HSRP zone and "self" it should just work.  If you lock HSRP zone to "self" down then you may need to add rules.