Summary

In this chapter, you’ve seen how you can configure the Cisco IOS transparent firewall using the zone-based configuration commands. When designing the zone-based transparent firewall, keep in mind these guidelines:

• Only a single zone pair is checked for every packet traversing the router.

• If a packet is bridged through the router, the router checks the zone pair policy configured between the physical interface zones.

• If a packet is routed, the router checks the zone pair policy between the zones of the BVI interface and the outbound IP interface.

• If a packet is sent to the router itself, the router checks the zone pair policy between the zone of the BVI interface and the self zone.

• Configuring a zone pair between a bridged and a routed zone makes no sense (because it will never be used).

• Although you could, do not apply the same zone on bridged and routed interfaces; that will only lead to confusion.