hi Fabio, I think i solve it (or for my case it works). It is possible to use the inspect action on a policy for the Self-Zone, but you have to keep in mind this:
when you use this kind of config:
class-map type inspect match-any out-self-cmap
match protocol ssh
match protocol https
match protocol snmp
exit
policy-map type inspect out-self-pmap
class type inspect example-cmap
inspect
class class-default
drop log
exit
exit
you are doing an inspection for the whole protocol (ssh, https or snmp), this is a L7 inspection, if you try to attach the policy-map with a zone-pair that involves the self-zone the system won't allow you.
To solve this you can "trick" the inspection, so you don't inspect the whole protocol, instead, you only inspect a given port (ssh:22 TCP, https:443 TCP, snmp:161 UDP). so the configuration will be something like this:
ip access-list extended ssh-acl
remark This acl allows the SSH session from two HQ PCs to the Router
remark of the Branch Office (the inside or LAN IP of the Remote Router is
remark 192.168.8.1 and the outside or WAN IP is 10.10.10.2
permit tcp host 192.168.10.20 host 192.168.8.1 eq 22
permit tcp host 192.168.10.30 host 192.168.8.1 eq 22
deny tcp any any eq 22
exit
ip access-list extended https-acl
remark This acl allows the HTTPS session from all HQ PCs to the Router
remark of the Branch Office (the inside or LAN IP of the Remote Router is
remark 192.168.8.1 and the outside or WAN IP is 10.10.10.2
permit tcp 192.168.10.0 0.0.0.255 host 192.168.8.1 eq 443
deny tcp any any eq 443
exit
ip access-list extended snmp-acl
remark This acl allows the SNMP session from one HQ Server to the Router
remark of the Branch Office (the inside or LAN IP of the Remote Router is
remark 192.168.8.1 and the outside or WAN IP is 10.10.10.2
permit udp host 192.168.10.100 host 192.168.8.1 eq 161
deny udp any any eq 161
exit
class-map type inspect match-any out-self-cmap
match access-group name ssh-acl
match access-group name https-acl
match access-group name snmp-acl
exit
policy-map type inspect out-self-pmap
class type inspect out-self-cmap
inspect
class class-default
drop log
exit
exit
zone-pair security out-self source out-zone destination self
service-policy type inspect out-self-pmap
exit
exit
This way you are doing L4 inspection over the port and the router will allow you to attach the policy-map to the zone-pair which includes de sefl-zone. And as you can see, you are monitoring and manage the device through the Inside IP not the Outside. I did this configuration for my case and it is working, I can do ssh, https (SDM) and snmp monitoring.
As a bonus, if you are the kind of person who enjoy configure through the CLI, don´t forget to allow the Routing protocol messages or adjacencies. Once you start to work on the self zone you have to be careful, if you are using OSPF or EIGRP you have to allow the message from this protocol to establish the adjacencies. This will help you:
ip access-list extended ospf-acl
permit ospf any any
exit
class-map type inspect match-all ospf-cmap
match access-group ospf-acl
exit
policy-map type inspect out-self-pmap
class type inspect out-self-cmap
inspect
class type inspect ospf-cmap
pass
class class-default
drol-log
By the way, if you use "pass" traffic from the "out-zone" to the "self-zone" is not necessary to create the traffic back from the "self" to the "out-zone" because this traffic is allowed by default. you have to use the back traffic policies if you are passing the traffic between two zones different of "self-zone".
I hope this help you Fabio.
Regards
