Which Cisco Firewall solution requires zone definition?

Context-Based Access Control (CBAC) is an older stateful inspection firewall feature found on Cisco IOS routers that does not use zone definitions.

Cisco AMP (Advanced Malware Protection) is an endpoint and network security solution for malware detection and prevention, not a firewall that requires zone definitions.

Cisco Zone-Based Firewall (ZBFW) operates on the principle of defining security zones (e.g., inside, outside, DMZ) and then applying policies to control traffic flow *between* these zones. All traffic passing through the firewall must explicitly flow between two zones, making zone definition essential for its operation.

Cisco ASA (Adaptive Security Appliance) is a perimeter firewall that primarily uses interfaces and security levels (or interface pairs) to define trust boundaries, rather than explicitly named zones like ZBFW.