Followup: zone-based firewall performance
The Zone-based firewall performance post has generated a few interesting comments. William Chu and an anonymous reader posted links to a Cisco ZBFW performance document. The document claims that the performance of TCP session inspection was significantly increased in 12.4(4)T (which would apply to CBAC as well, since zone-based firewalls were introduced in 12.4(6)T), but the maximum HTTP throughput numbers for ZBFW are way lower than the Cisco IOS Firewall Performance (table 3 of the Cisco Integrated Firewall Solutions document). One could only guess that the discrepancy does not indicate that CBAC is twice as fast as ZBFW but illustrates the gap between the real-life test scenarios and marketing figures.
David has also mailed me an interesting observation: CBAC inspects all traffic exiting (or entering) an interface; ZBFW inspects only inter-zone traffic. This distinction does not matter in common scenarios where there is not much traffic between external interfaces, but it could become important if you use IOS firewall to filter traffic between two IP networks and have multiple transit interfaces in each network.
Regarding the comment about David's observation; I'm not sure I understand the significance. If you need to apply policy between interfaces, they need to be in different zones. Unless I'm mistaken, that's the well-known expecatation for using Zone Firewall. Granted, this behavior has limits in cases where very large numbers are all assigned to unique zones, because managing the number of zone-pairs could become tedious. In this case, the firewall would need to offer a capability to apply intra-zone policy between interfaces. I bet that if you wait long enough, you'll see this happen.
I'll write another post detailing the design I wrote about ... obviously I have a bit of a problem getting the wording right every now and then :) After all, English is not my native language.