Router with ACL and Zone-Based-Firewall (ZBF)

[Rene Mueller]

Hello,

I am using a ISR4351 Router and want to configure a little bit of security. My question is, does it make sense to configure an ACL to an interface and also put the same Interface into a Zone for zone-based FW configuration? What takes preference when I configured both to an Interface?

Regards

René

[Karsten Iwen]

Just think about what you typically achieve with interface-ACL when you don't use ZBF:

1. Filtering traffic that should go through the router. That is traditional firewalling and has always to be done with ZBF-policies between the zones. As this function has a default deny, you need them anyway and have no need to configure interface-ACLs.
2. Restricting traffic to the router. Using interface-ACLs was quite easy with the legacy CBAC firewall, but ZBF gives you full control with the self-zone. Although you have a default allow here, this is the way to go to restrict that traffic.

Given that, interface ACLs are nearly never needed.