I'm trying to learn the ZBFW, mainly for CCIE studing and have a few question. These will be pretty basic, it's for the R&S not the Security, and the R&S doesn't go to much into the ZBFW.
For this example, I have R1, with gi0/0 an gi0/1. gi0/0 goes to the Internet, and gi0/1 goes to my LAN. (Very simple topology)
My main misunderstanding is the use of 'inspect, permit, and deny'
From my understanding, inspect, will inspect the traffic, and allow the return traffic, where permit permits and deny denies.... (Big shock I know)
But does permit, permit the traffic outbound, but the return traffic has to be permitted as well?
Sample Configuration(R1)
-------------------------------------
zone security OUTSIDE
zone security INSIDE
int gi0/0
description ***** To Internet Service Provider *****
ip address 150.10.10.9 255.255.255.252
zone-member security OUTSIDE
int gi0/1
description ***** To 192.168.1.0/24 LAN *****
ip address 192.168.1.1 255.255.255.0
zone-member security INSIDE
zone-pair security in-to-out source INSIDE destination OUTSIDE
class-map type inspect match any Inside2Outside-CM
match protocol http
match protocol https
match protocol smtp
match protocol pop3
policy-map type inspect Inside2Outside-PM
class type inspec Inside2Outside-CM
inspect
zone-pair security in-to-out
service-policy type inspect Inside2Outside-PM
Now, I'm assuming this would allow http,https,smtp, and pop3 to the outside interface, and also return traffic. But if I used permit instead of inspect in the policy-map, would I have to allow traffic back in?
