Zone Based Firewalls

Zone Based Firewalls

Zone based firewall is feature which is used to allow or deny traffic from one Zone to another.

Any zone has following components:

• Source zone—A VPN or group of VPN from where the data traffic flows originate.
• Destination zone— A VPN or group of VPN to where the data traffic flows terminate. A VPN can be part of only one zone
• Zone-based firewall policy—A data policy, similar to a localized data policy, which is a conditions that must be permitted for data traffic flow from the source zone to the destination zone. Zone-based firewalls can match IP prefixes, IP ports, and the protocols TCP, UDP, and ICMP. Matching flows can be accepted or dropped, and the packet headers can be logged. Non matching flows are dropped by default.
• Zone pair—a container that associates a source zone with a destination zone and that applies a zone-based firewall policy to the traffic that flows between the two zones.

When flows are match based on Zone pair, it can be processed in following ways:

• Inspect—The packet's header can be inspected to determine its source address and port.
• Pass—allow the packet to pass or sent to the destination zone without inspecting the packet's header at all.

Below figure explains the scenario:

Above figure describes three VPNs which are configured on a vEdge router.  VPN 3, has shared resources to which restriction is needed. And users in VPN 1, are allowed to access the resources in VPN 3, while users in VPN 2 are not allowed to access to these resources in VPN 3. We also want data traffic flow from VPN 1 to VPN 3, but not from VPN 3 to VPN 1

Zone-based firewalls perform stateful inspection of TCP, UDP, and ICMP flows between zones. They examine the source and destination IP addresses and ports in the packet headers, as well as the packet's protocol. Then, based on the configured zone-based policy, they allow traffic to pass between the zones or they drop the traffic