Zone-pair : Inside-to-Guest
Source Zone : Inside
Destination Zone : Guest
Service-policy inspect : Zone-Inside-to-Guest
Class-map : Default-Inspection(match-any)
Action : inspect
Class Map type inspect match-any Default-Inspection (id 10)
Description: Default protocol Inspection class
Match protocol tcp
Match protocol udp
Match protocol icmp
My question is: I cannot make it work the ZBF between my internal zones. As you can see above, I've got Zone-Pair: Inside-to-Guest with 'inspect'. Unfortunately, when I tried to ping for the first time, i received:
%FW-6-DROP_PKT: Dropping icmp session GUEST:0 INSIDE:0 due to policy match failure with ip ident 0
It indicated that the traffic going BACK was blocked... WHY? There is 'inspect'
So I created a new pair: Guest-to-Inside and I changed everything to pass. It DID work. But that is not what I wanted! I wanted INSIDE to access GUEST but Guest should not access Inside. I assumed I could do it with 'inspect' but it did now work.
Let me add that I have an exactly the same zone-pair and classes/policies for Inside-to-Outside and it does work with inspect.
Why can I not 'inspect' between my internal zones? Is it because there is no NAT?