Application Inspection of ZBF Router

Question

Hello there,
I just wanna verify what I've learned about:
Stateful Inspection (packet filtering up to L5)  and
Application Inspection (packet filtering up to L7)
Regarding an IOS ZBF (IOS ver 12.4(20)T on a router, do these commands implement Application Inspection ?
(I mean: do they satisfy a protocol like ftp and enable the router to learn about dynamic ports and unwanted activities?)
class-map type inspect match-any CM
match protocol ftp
match protocol http
policy-map type inspect PM
   class type inspect CM
   inspect
zone-pair security IN-OUT source inside destination outside
service-policy type inspect PM
or  do they implement Stateful Inspection only ? if so yes, how to add  Application Inspection feature (on ftp traffic ,for example)?
1 more question, is "application-specific matching" another expression of "application inspection feature" ?
thanks !

Answer 1

Have u looked at the example in the above maintioned link ?
Define class-maps that describe the traffic that you want to permit             between zones, according to policies described earlier:
conf t
class-map type inspect match-any internet-traffic-class
  match protocol http  match protocol https  match protocol dns  match protocol icmp
Configure a policy-map to inspect traffic on the class-maps you             just defined:
conf t
policy-map type inspect private-internet-policy
  class type inspect internet-traffic-class
   inspect
Configure the private and Internet zones and assign router             interfaces to their respective zones:
conf t
zone security private
zone security internet
int bvi1           
zone-member security private
int fastethernet 0
zone-member security internet
Configure the zone-pair and apply the appropriate             policy-map.
Note: You only need to configure the private Internet zone pair at                 present in order to inspect connections sourced in the private zone traveling                 to the Internet zone:
conf t
zone-pair security private-internet source private destination internet
  service-policy type inspect private-internet-policy
This completes the configuration of the Layer 7 inspection policy             on the private Internet zone-pair to allow HTTP, HTTPS, DNS, and ICMP             connections from the clients zone to the servers zone and to apply application             inspection to HTTP traffic to assure that unwanted traffic is not allowed to             pass on TCP 80, HTTP’s service port.
Define class-maps that describe the traffic that you want to permit             between zones, according to policies described earlier:
conf t
class-map type inspect match-any L4-inspect-class
match protocol tcp match protocol udp match protocol icmp
Configure policy-maps to inspect traffic on the class-maps you just             defined:
conf t
policy-map type inspect clients-servers-policy
class type inspect L4-inspect-class
  inspect
Configure the clients and servers zones and assign router             interfaces to their respective zones:
conf t
zone security clients
zone security servers
int vlan 1           
zone-member security clients
int vlan 2
zone-member security servers
Configure the zone-pair and apply the appropriate             policy-map.
Note: You only need to configure the clients-servers zone-pair at                 present, to inspect connections sourced in the clients zone traveling to the                 servers zone:
conf t
zone-pair security clients-servers source clients destination servers
  service-policy type inspect clients-servers-policy
This completes the configuration of the Layer 4 inspection policy             for the clients-servers zone-pair to allow all TCP, UDP, and ICMP connections             from the client zone to the server zone. The policy does not apply fixup for             subordinate channels, but provides an example of simple policy to accommodate             most application connections.
Obviously, "Inspect" is used for both L4 (tcp, udp) and L7 (http, dns) inspection.
So, It depends on the protocol being inspected, not on the keyword "inspect".
But I'm not sure what's going on with icmp ? It is in both cases matched and inspected.