zone based firewall cisco ios router

I am trying to set up a zone based firewall for my 881 router.  I know what the commands are.  But I do not fully understand the "inspect" command.  I know the inspect command inspects traffic but what does that mean?  does it just create logs or what?
mmercaldiAsked:
Who is Participating?
 
alewis9777Commented:
CBAC is now deprecated.  Zone based has taken its place in configuring a stateful inspection based on zones (inzone, outzone).

Think of the inspect command like this:  When traffic comes into or out of an interface the inspect command does whats called a stateful inspection meaning that it not only looks at the header of the packet but it actually looks at contents of the packet to determine what it actually is.  A stateful inspection can do this all the way up to the application layer which gives you much better protection and control over your traffic.

0
 
e1extCommented:
It investigates the traffic passing through the interface. I think you need to read article about CBAC (Context-Based Access Control).  Also what do you mean by "zone based firewall"? What kind of result do you expect in the network?
0
 
Nayyar HH (CCIE RS)Network ArchitectCommented:
When you use "inspect" it enables the ZFW to apply basic TCP or UDP inspection (at least), however it ZFW is "aware" of the protocol it will apply application-aware inspection. With application-aware inspection, ZFW understands the protocol and will permit secondary channels through that are associated with the primary channel that was already permiitted.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
mmercaldiAuthor Commented:
oh ok so it slows down traffic as well right?
0
 
Nayyar HH (CCIE RS)Network ArchitectCommented:
Yes, There will be some latency introduced but this doesnt usually impact application performance.
0
 
mmercaldiAuthor Commented:
ah so thats why people do not use inspect on everything, groovy
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.