ccna 4 cn practice skills assessment - pt

ccna 4 cn practice skills assessment - pt.Pass-Similar to the allow statement in an ACL. The "pass" behavior does not track the status of connections or sessions within the streamscape. The "passThe "pass" behavior only allows data to flow in one direction. To allow the return flow sen to pass in the opposite direction, the appropriate policy must be applied. To apply a rate limit to a specified traffic class, use the police option in conjunction with the inspect or pass command.4.3.2.2 Rules for Local Area Policy FirewallsAs traffic travels between member interfaces in a zone, the membership of the router network connections 11 in the zone are subject to multiple control interface behavior rulesDetection. Administrators configure zones before assigning interfaces to zones. If traffic flows between all interfaces of a router, each connection must be a member of a region. Administrators can assign interfaces to only one security zone. Traffic flow between member interfaces of the same zone is allowed by default. To allow traffic to enter or leave a zone member interface, you must configure a policy for allowing or detecting traffic between this zone and other zones. Traffic cannot flow between a zone member interface and a non-zone member interface. Administrators can only apply pass-through, detect, and drop between the two zonesdrop behavior. Interfaces that are not assigned to a zone can still use the classic firewall's stateful packet inspection configuration. Even if the administrator does not want an interface on the router to become a zone firewall. Policy I. part of the zone firewall policy, it may still be necessary to place that interfaceinto a zone. The administrator can then configure a pass-all policy (also called a dummy policy) between that X domain and other zones that require flow conscription o 4.3.2.3 Policy-Based Firewall Rules for RoutersThe rules for ZBF differ when the router is involved in different traffic. The rules are related to whether the router is the source or the destination of the traffic.When an interface is configured as a member of a zone, hosts connected to this interface must be contained to this zone, but traffic flowing into and out of this router interface is not controlled by the zone policy. Instead, all interfaces on the router automatically become members of their own zone. To restrict IP traffic from being forwarded to IP addresses in different zones of the router, a policy must be applied. Policies can set blocking, permitting, or detecting behavior for traffic that travels between a zone and the router's own zone (and vice versa). If there is no policy between the zone and its own zone, then all traffic will be allowed to go to the router's interface without being detected.Policies can be defined using the own area, or by using the source or destination area. The own area is a system-defined area that does not require any interface to be configured as a member. An area pair that includes its own area and associated policies is applied to traffic destined for or generated by a router. It cannot be applied to traffic traversing a router.