ZBFW and ICMP Behavior

Zone Based Firewalls use the inspect keyword on class maps and policy maps to inspect traffic all the way up to Layer 7 of the OSI Model. However, in such cases, when inspecting stateless communication, such as that of ICMP communication, some interesting behaviors may be observed.

ICMP is stateless, so it does not involve explicit session initiation or termination that are seen in TCP-based communication. This means that meaning any replies to ICMP packets are allowed temporarily by creating an exception in the firewall state table. This temporary allowance enables ICMP traffic to flow back to the initiator but will expire after a specific timeout period. During that time period, it may be possible to initiate additional ICMP traffic that will temporarily be allowed due to that short-lived exception that is created in the state table. This has been tested in an emulator and has been see in in practice. On the other hand, a protocol like Telnet uses TCP, which is stateful and involves specific session tracking, thus disallowing unsolicited inbound connections.

As always, such behaviors may vary from platform to platform and from OS to OS, so test them out on your topologies to confirm their behavior.

https://networklessons.com/cisco/ccie-routing-switching/zone-based-firewall-configuration-example/