Dears,
I have a internet router configured and controlled with plenty deny and permit access-list, i am moving to the zone based firewall ,i am planning to call all the permit statement leaving the deny statement becz deny by default will fall in class-default which is configured to drop the packets, but i get a error as below is it will affect the traffic flow. And also confirm to me is it the correct way of migration.
%No specific protocol configured in class outbound-to-internet for inspection. All protocols will be inspected
For example as below
ip access-list extended outbound-leased-line
permit udp host X.X.X.X host 2.2.2.2 eq isakmp
permit etc etc etc
class-map type inspect outbound-to-internet
match access-group name outbound-leased-line
Policy-map type inspect outbound-inspection
class type inspect outbound-to-internet
inspect
class class-default
drop
Thanks
