Router stateful ACL

Question

Its very weird question but i want some suggestion for you. We have edge router ASR1000 where BGP running and 10G internet connection is terminated. Now i want to configure ACL on router to keep bad traffic outside and only allow specific port. Following scenario.

[Internal Public IP]------------[ASR1000]-------------[INTERNET]

Now how do i allow my Internal Public IP subnet to access everything on internet. In stateful firewall you can do it because it hold state of connection but Router ACL isn't stateful.

How do i solve this problem?

1. Inside to outside everything allow
2. Outside to inside only specific traffic

Answer 1

On IOS/IOS-XE you can use either reflexive ACL's or use stateful inspection with Cisco Context Based Access Control (CBAC) or Zone Based Firewall (ZBF).

ZBF is the current way to do stateful inspection. It works by creating zones and applying the zones to interfaces. Then you create a class-map to identify traffic and use a policy map to inspect the traffic that you identified in the class map. You then create a 'Zone Pair' in which you define a traffic flow (inside to outside) and apply the policy map to that pair. IOS will then perform stateful inspection on that traffic like any other firewall.

Documentation for ZBF on IOS XE is here:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/xe-3s/sec-data-zbf-xe-book/sec-zone-pol-fw.html