Hello team,
I have to create a new envirotment where Traffict ( signals) coming from outside ( internet ) has to match in one of my ip publics, I have to nat by portforwarinng to a dmz and that it. Only with ACL ( without ZBF) it works, but with ZBF does not work and I can see it does not match in classmap. If I put classmap permit protocol it works but if I put an ACL does not work.
Router(config)#zone security INSIDE
Router(config)#zone security OUTSIDE
Router(config)#zone security DMZ
Router(config)#interface gigabitEthernet 0/0/1
Router(config-if)#zone-member security DMZ
Router(config)#interface gigabitEthernet 0/0/3
Router(config-if)#zone-member security INSIDE
Router(config)#interface gigabitEthernet 0/0/2
Router(config-if)#zone-member security OUTSIDE
Router(config)#class-map type inspect match-any ESCENSE-OUTSIDE-TO-DMZ-CLASS
Router(config)#match access-group name ESCENSE-OUTSIDE-TO-DMZ-ACL ---> With this fail but with protocol tcp only work
policy-map type inspect OUTSIDE-TO-DMZ-PM
class type inspect ESCENSE-OUTSIDE-TO-DMZ-CLASS
inspect
class class-default
drop log
Router(config)#zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
Router(config)#zone-pair security OUT-TO-IN source OUTSIDE destination INSIDE
Router(config)#zone-pair security OUT-TO-DMZ source OUTSIDE destination DMZ
service-policy type inspect OUTSIDE-TO-DMZ-PM
Router(config)#zone-pair security IN-TO-DMZ source INSIDE destination DMZ
service-policy type inspect INSIDE-TO-DMZ-PM
Router(config)#zone-pair security DMZ-TO-IN source DMZ destination INSIDE
service-policy type inspect DMZ-TO-INSIDE-PM
ip nat inside source static tcp 10.44.63.134 8000 ip public 8000 extendable
ip nat inside source static tcp 10.44.63.130 9880 ip public 9880 extendable
ip nat inside source static tcp 10.44.63.136 16001 ip public 16001 extendable
ip nat inside source static tcp 10.44.63.137 16002 ip public 16002 extendable
ip nat inside source static tcp 10.44.63.138 16003 ip public 16003 extendable
