5

What I don't understand is how I should use zones.

Say, for example, I have to build a network for a company. I would start by looking at the different departments (e.g. Sales, Management) and design VLANs/subnets for each one of them.

But how can I apply zones to this network? Would I assign a zone to each VLAN/subnet? I've seen an article that assigns IP address ranges to zones, so I believe a zone maps to a subnet/vlan.

Or would I have to create completely different zones, for example Inside, Outside, DMZ.

FWIW, I'm using a PaloAlto Firewall.

Improve this question

2 Answers 2

Reset to default
4

This is Zone Based Firewalling. There are no hard and fast rules as to how you relate your zones to your VLANs but you might for example have 4 VLANs: HR, Finance, Manufacturing and Marketing.

You could then create a Zone for each VLAN, allowing complete firewall control between each of those VLANs (subnets).

However, you might have two zones (which are on two separate /24s) that need to communicate to each other but have no use for firewalling (i.e. there doesn't need to be any security restrictions between these VLANs). In that instance you could have both those VLANs in a single zone which therefore won't be firewalled.

Update

You have two options - you either configure 3 separate interfaces on the Firewall (each with their own zone as you said) and connect those to the three interfaces on the router.

OR

Configure a trunk on the router and the Firewall with sub-interfaces which are VLAN tagged. I think in this instance for you, it will be simpler and easier to understand with the 3 individual cables and interfaces on the router/firewall.

Improve this answer
4
  • Thanks man. Can you maybe answer the question I've placed below Zac67's answer? Basically, a zone consists of 1 or more firewall ports, right? So if I have 3 subnets on a separate router, wouldnt I need to use 3 ports (1 for each zone) on my firewall as well, and create 3 links between them?
    – user1534664
    May 27, 2017 at 13:59
  • See updated answer.
    – Osyrus Solutions
    May 27, 2017 at 14:03
  • 1
    My general rule is one zone per vlan, typically.
    – Tom O'Connor
    May 31, 2017 at 18:51
  • @TomO'Connor Yes, I agree but I wanted to cover all options in my answer.
    – Osyrus Solutions
    Jun 1, 2017 at 9:56
2

(Security) zones are what you define by your firewall rules. Usually you map the subnets and VLANs you've created to these. Depending on your security requirements, a zone can consist of more than one subnet/VLAN - you might prefer routing subnets within a single zone through L3 switches instead of your firewall.

Improve this answer
2
  • Thanks for your reply. It answers my original question. Can you please consult me with the following: A zone is a group of physical ports on the firewall. Lets say I have a router attached to the firewall with three subnets, one for each router interface. I want to map a security zone for each subnet. I dont understand how this is implemented, because the router is plugged into a single port on the firewall, not three different ports.
    – user1534664
    May 27, 2017 at 13:11
  • A zone can be whatever you define it as. It can be connected to a single physical port, trunked ports, logical ports or something else. Some firewalls even allow you to use the device types they detect (which isn't really secure, of course). In your firewall rules, you map all those clients to different policies, defining your zones. E.g. your client zone uses subnets 10.0.1.0/24, 10.0.2.0/24 and 10.0.3.0/24 while your DMZ zone uses 10.1.0.0/24. Then you define your rules: allow clients to DMZ, any port; allow clients to Internet, ports 80 and 443; allow DMZ to Internet, ports 25, 80, 443;...
    – Zac67 ♦
    May 27, 2017 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.