A customer had a hardware failure the other day and I went and replaced the router. It was an ISR4231 and was running Zone Based Firewall. I originally had set this router up so I know at one time everything was working. After the replacement, we were getting one-way audio (PSTN connection via FXO). We had this problem initially, but the fix was not well documented in the TAC case. However if I removed the ZBF then audio would work in both directions. I rebuilt the firewall from scratch allowing SIP, RTP, etc but audio was still being blocked. I had but all interfaces in the same zone (INSIDE) except for the internet connection. This is supposed to allow all communications between interfaces in the same zone, but no bueno. Added it to the self zone but that didn’t make a difference either. In doing some research I found that you can also create a ‘default’ zone.
From the Security Configuration Guide: Traffic from a zone interface to a nonzone interface or from a nonzone interface to a zone interface is always dropped; unless default zones are enabled (default zone is a nonzone interface).
I think I’m starting to get it. What if I only have one zone (OUTSIDE) and all the others are in the default zone?? That works. I still don’t know why/where the audio was being blocked, but not having the internal interfaces in a zone fixed the issue. You have to manually add the default zone in the firewall config!
ROUTER(config-if)#zone-member security ? self System defined Zone ROUTER(config)#zone security ? WORD Name of security zone ROUTER(config)#zone security default ? <cr> ROUTER(config)#zone security default ROUTER(config-sec-zone)#? Zone configuration commands: description Zone description exit Exit from zone configuration mode no Negate or set default values of a command ROUTER(config-sec-zone)#descr DEFAULT ZONE - NO POLICY ROUTER(config-sec-zone)#exit ROUTER(config)#interface gi0/0 ROUTER(config-if)#zone-member security ? default DEFAULT ZONE - NO POLICY self System defined Zone ROUTER(config-if)#zone-member security default ROUTER(config-if)#end ROUTER#show zone security default zone default Description: DEFAULT ZONE - NO POLICY Member Interfaces: GigabitEthernet0/0