Zone Based Firewall - changing rule order in policy-maps

[mat_rouch]

I have a questions about configuring ZBF at the command line. I need to insert a new class-map into one of my policy-maps.  The new class-map needs to go at the beginning of the list.  How do I move class-maps up and down at the command line?  I've found a couple of documents that show how to do it in one or another GUI environment, but I'm not using any of those.

For reference, my config looks like this:

--------------------------------------------------------------------------------                  

policy-map type inspect inside-to-Transit-policy

class type inspect Standard-Email

  inspect

class type inspect Management-Traffic

  inspect

class type inspect interoffice-traffic-outbound

  inspect

class type inspect WB-to-ANB-traffic-outbound

  inspect

class type inspect Standard-Browsing

  inspect

--------------------------------------------------------------------------------                  

class-map type inspect match-all spiceworks-outbound

match access-group name mgmt-ip-to-spiceworks

--------------------------------------------------------------------------------                  

I need to insert "spiceworks-outbound" in the policy map "Inside-to-Transit-policyy", but it needs to appear above "Management-Traffic" in the list in order to work properly.

Thanks,

-Mat

[Julio Carvajal · Accepted solution]

Hello Mat_rouch,

if doing it via CLI then you will need to delete the policy-map and then re-configure it with the right order,

There should be a way to do it without this( like with a sequence number but there is none)

regards,

Julio Carvajal

[mat_rouch]

OK, good to know.  One other question: I have tried using CCP to manage my ZBF, but CCP appears to only allow one dmz to be defined.  I need more than one.  Is there another free (or inexpensive) tool that would allow me to do this?  Or am I wrong about CCP only allowing one dmz?

-Mat

[Julio Carvajal]

Hello Mat,

I think CCP only allows up to 3, I have not played that much with the guy, I just work with CLI,

Regards

Remember to rate all of the helpful posts

[mat_rouch]

OK, thanks for the info.

[Julio Carvajal]

Hey my pleasure,

remember to rate all of the helpful posts