Hi to all,
need to deploy the folling IOS firewall Zone Based configuration to a running remotely router.
I'M CONNECTED WITH SSH ...
HOW IS IT POSSIBLE WITHOUT DISCONNETING ME ?
(I know the reload command and also the rollback command).
Q1) When I try to insert on the 1st interface the "zone-member security trust" or "zone-member security untrust" I LOST THE ROUTER CAUSE THE OTHER INTERFACES ARE NOT CONFIGURED: HOW I CAN ACTIVATE THE ZONE-MEMBER COMMAND ON THE ROUTER WITHOUT LOST IT ?
Q2) it's possible (like Juniper JUNOS) made alla the new configuration and execute the "commit now" when I've finished ?
Q3) Is there any other feature on cisco IOS to allow to configure the router, check the configuration and only AFTER put it on the running config (the only tip i?ve found is to modify the startup config and load in or merge the running config with another conf...)?
* FOLLOWING THE NEW LINES CONFIGURATION:
!
class-map type inspect match-any untrust-trust-cmap
match protocol telnet
match protocol ssh
!
policy-map type inspect untrust-trust-pmap
class type inspect untrust-trust-cmap
inspect
class class-default
!
!
class-map type inspect match-any trust-untrust-cmap
match protocol tcp
match protocol udp
!
!
policy-map type inspect trust-untrust-pmap
class type inspect trust-untrust-cmap
inspect
class class-default
!
zone security trust
zone security untrust
!
zone-pair security trust-untrust source trust destination untrust
service-policy type inspect trust-untrust-pmap
!
zone-pair security untrust-trust source untrust destination trust
service-policy type inspect untrust-trust-pmap
!
interface FastEthernet0/0
zone-member security trust
int dialer 0
zone-member security untrust
interface ATM0/0
zone-member security untrust
Regards.
Roberto Taccon
