I've found Cisco docs to be extremely vague and confusing regarding the appropriate way to configure access policies in Cisco IOS-based zone-based firewall (ZBFW).

Say I want to permit ongoing TCP connections from interface A to interface B. These interfaces are allocated each in a different security zone.

I only want to permit TCP sessions that are initiated from interface A over interface B, that is, a A-to-B zone-pair is necessary where it indicates that traffic sourced from zone A to zone B will be permitted/inspected.

So my concern is the return traffic (ie. SYN-ACK packets from zone B). Is this traffic by default permitted conn-table-style? If my access policy (policy-map action) is set to inspect will I be permitting that return traffic? Or will I need a B-to-A zone-pair to allow that traffic?

I'm pretty sure I do not need to create an additional zone-pair solely for the return traffic but I do not have an IOS router available as of now to test this.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Feb 21, 2018 at 18:28

1 Answer 1


The firewall is stateful. It understands that you are creating bidirectional a connection, and it permits return traffic for the outbound traffic. If you try to create a TCP connection from Zone A to Zone B, as permitted by the firewall, then the host in Zone B will be able to use the connection to send to the host in Zone A that created the connection, even if Zone B cannot initiate a TCP connection to Zone A.

TCP is easy for the firewall because TCP creates bidirectional connections. It is harder for connectionless protocols, like UDP, but the firewall will create states for that too, and there are parameters, e.g. timeouts, which you can adjust.

  • Thanks for confirming what I initially thought was the correct flow. Although I feel a bit conflicted over you using the word "firewall" when this is an IOS router running ZBFW feature but if that's what you meant then OK. So is this achieved by using the 'permit' action only or do I need to use 'inspect' ? What is punctually the difference? By using 'inspect' how does the router inspect this traffic? Commented Dec 3, 2017 at 18:16
  • It is a firewall, albeit software in a router. You should probably start another question or ask in Network Engineering Chat because this is not a discussion forum. The actions that the firewall can perform are: Drop, Pass, and Inspect. Drop and Pass are absolute, but Inspect gives you state-based traffic control, application inspection and control, and an audit trail. You use class and policy maps to configure the firewall.
    – Ron Maupin
    Commented Dec 3, 2017 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.