I configured the zone based firewall and the rules seem to work fine. However, the speeds are really bad. Even when just using pass actions it only reaches 1.5 Gbit/s (with the firewall turned off it reaches 9-10 Gbit/s). This even happens with very minimal ZBF config. There is an VM-Host connected to the first 10GE interface, the VMs reach 10 Gbit/s when using iperf without ZBF active, after enabling they slow down. class-map type inspect match-any cmap--test match protocol tcp match protocol udp ! policy-map type inspect pmap--test class type inspect cmap--test inspect class class-default drop ! zone security test-in zone security test-out zone-pair security in-to-out source test-in destination test-out service-policy type inspect pmap--test ! interface TenGigabitEthernet0/0/0.1 encapsulation dot1Q 1000 ip address 192.168.1.1 255.255.255.192 zone-member security test-in ! interface TenGigabitEthernet0/0/0.2 encapsulation dot1Q 2000 ip address 192.168.0.1 255.255.255.0 zone-member security test-out Is there any way to improve ZBF performance? ... View more