Hi all,
i recently have implemented the new zone-based firewall on my CISCO 1841 with 384MB memory, advipservicesk9-mz.124-15.t3 IOS image, HWIC-1ADSL and HWIC-AP-G-E Network cards. In order to avoid any possible latency introduced by the firewall during packet inspection i have decided to create a "pass all" policy in between the VOIP zone (actually the wireless subinterface) and the INTERNET zone (Dialer interface). The policy has been created leaving the class default-class with the "pass" parameter on, instead of the deafult "drop" for both traffics : from the INTERNET zone to the VOIP one and from the VOIP zone to the INTERNET one. Anyway, despite this configuration i noticed a performance degradation of the voip calls comparing to the classic firewall CBAC feature. I also noticed a slight better performance when i put the wireless subinterface in the same INTERNET zone. Anyway this is not a solution for security reasons.
