How Do Zones Protect the Network?

Zones protect your network by segmenting it into smaller, more easily managed areas. Zones also protect the network by allowing you to control access to zones and traffic movement between zones.

Zones prevent uncontrolled traffic from flowing through the firewall interfaces into your network because firewall interfaces can’t process traffic until you assign them to zones. The firewall applies zone protection on ingress interfaces, where traffic enters the firewall in the direction of flow from the originating client to the responding server (c2s), to filter traffic before it enters a zone.

The firewall interface type and the zone type (Layer 2 or Layer 3) must match, which helps to protect the network against admitting traffic that doesn’t belong in a zone. For example, you can assign a Layer 2 interface to a Layer 2 zone or a Layer 3 interface to a Layer 3 zone, but assigning a Layer 2 interface to a Layer 3 zone isn’t supported.

In addition, a firewall interface can belong to one zone only. Traffic destined for different zones can’t use the same interface, which helps to prevent inappropriate traffic from entering a zone and enables you to configure the protection appropriate for each individual zone. You can connect more than one firewall interface to a zone to increase bandwidth, but each interface can connect to only one zone.

After the firewall admits traffic to a zone, traffic flows freely within that zone and isn’t logged. The more granular you make the zones, the greater the control you have over the traffic that accesses each zone, and the more difficult it is for malware to move laterally across the network between zones. Traffic can’t flow between zones unless a Security policy rule allows it and the zones are of the same zone type (Layer 2 or Layer 3). For example, a Security policy rule can allow traffic between two Layer 3 zones, but not between a Layer 3 zone and a Layer 2 zone. The firewall logs traffic that flows between zones when a Security policy rule permits interzone traffic.

By default, Security policy rules prevent lateral movement of traffic between zones, so malware can’t gain access to one zone and then move freely through the network to other targets.