Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Zone-base Firewall


i have been doing some ZBF configuration on 2811 router with IOS version "advsecurityk9-mz.124-15.T10"

i configured a zone-pair from inside to outside with its policy-map and class-map (for the traffic that are initiated from inside),

the flow is 90% form inside to outside. i also configured zone-pair from outside to inside for the other 10% opposite traffic.

the problem is that some traffic are being stopped from inside to outside, and i am not able to track it or log it somehow.

my class-map is based on access-list (very long one). since i cannot log a line in an access-list, for example: deny ip any any log (not permitted)

i tried:

1- "show ip inspect session" but i cannot see any output (i read that it is for CBAC)

2-  "show policy-map type inspect zone-pair" displays some counter for established session

The question is, how i can see the sessions and what is being blocked?


class-map type inspect match-any c2
match access-group name fromOut
class-map type inspect match-any c1
match access-group name fromIn
policy-map type inspect fromIn

class type inspect c1
class class-default
  drop log
policy-map type inspect fromout
class type inspect c2
class class-default
  drop log

Thank and Regards,


  • Firewalling
Cisco Employee

Re: Zone-base Firewall

Hey George,

To view the sessions being created, use the command "show policy-map type inspect zone-pair NAME sessions". Replace NAME with the name of the corresponding zone-pairs.

To enable logging of dropped packets by zone based firewall, use the command "ip inspect log drop-pkt". You should then be able to see syslogs of dropped packets (along with details of zone-pair and class-map being hit).

Hope this helps!!

Thanks and Regards,


New Member

Re: Zone-base Firewall

edited as the answer is above.