Its very weird question but i want some suggestion for you. We have edge router ASR1000 where BGP running and 10G internet connection is terminated. Now i want to configure ACL on router to keep bad traffic outside and only allow specific port. Following scenario.

[Internal Public IP]------------[ASR1000]-------------[INTERNET]

Now how do i allow my Internal Public IP subnet to access everything on internet. In stateful firewall you can do it because it hold state of connection but Router ACL isn't stateful.

How do i solve this problem?

  1. Inside to outside everything allow
  2. Outside to inside only specific traffic
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 6, 2017 at 22:53

1 Answer 1


On IOS/IOS-XE you can use either reflexive ACL's or use stateful inspection with Cisco Context Based Access Control (CBAC) or Zone Based Firewall (ZBF).

ZBF is the current way to do stateful inspection. It works by creating zones and applying the zones to interfaces. Then you create a class-map to identify traffic and use a policy map to inspect the traffic that you identified in the class map. You then create a 'Zone Pair' in which you define a traffic flow (inside to outside) and apply the policy map to that pair. IOS will then perform stateful inspection on that traffic like any other firewall.

Documentation for ZBF on IOS XE is here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.