i recently have implemented the new zone-based firewall on my CISCO 1841 with 384MB memory, advipservicesk9-mz.124-15.t3 IOS image, HWIC-1ADSL and HWIC-AP-G-E Network cards. In order to avoid any possible latency introduced by the firewall during packet inspection i have decided to create a "pass all" policy in between the VOIP zone (actually the wireless subinterface) and the INTERNET zone (Dialer interface). The policy has been created leaving the class default-class with the "pass" parameter on, instead of the deafult "drop" for both traffics : from the INTERNET zone to the VOIP one and from the VOIP zone to the INTERNET one. Anyway, despite this configuration i noticed a performance degradation of the voip calls comparing to the classic firewall CBAC feature. I also noticed a slight better performance when i put the wireless subinterface in the same INTERNET zone. Anyway this is not a solution for security reasons.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...