Marco, > On 12 Dec 2025, at 21:10, Marco Moock via cisco-nsp > <[email protected]> wrote: > > Am 11.12.2025 um 11:24:51 Uhr schrieb Lukasz Bromirski: > >> First of all, you should move to ZBFW from CBAC, CBAC is deprecated. > > Is the behavior there different?
Yes, unfortunately (IMHO). With ZBFW you'll be closer to your idea with ACLs that you'll have to include to pass the traffic because inspection by default doesn't open everything. Best way to avoid doing that is to apply different policy-pairs between the same interfaces in both directions, but this quickly becomes complex. -- Łukasz Bromirski CCIE R&S/SP #15929, CCDE #2012::17, PGP Key ID: 0xFD077F6A _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
