Contents

Configuring security zones· 1

About security zones· 1

Basic concepts· 1

Security zone-based packet processing rules· 1

Application scenarios· 1

Restrictions: Hardware compatibility with security zone feature· 2

About interzone policies· 2

Interzone policy types· 3

Security zone configuration tasks at a glance· 5

Creating a security zone· 5

Adding members to a security zone· 5

Creating a zone pair 6

Specifying the default action for packets between interfaces in the same security zone· 6

Enabling filtering based on virtual service IP address· 7

Display and maintenance commands for security zones· 7

Security zone configuration examples· 7

Example: Configuring security zones· 7

 

Configuring security zones

About security zones

You can configure security zones to implement security zone-based security management.

Basic concepts

The security zone feature includes the following basic concepts:

·     Security zone—A security zone is a collection of interfaces that have the same security requirements.

·     System-defined security zones—The device provides the following system-defined security zones: Local, Trust, DMZ, Management, and Untrust. The system creates these security zones automatically when one of following events occurs:

¡     The first command for creating a security zone is executed.

¡     The first command related to creating a interzone policy is executed.

System-defined security zones cannot be deleted.

·     DMZ—A demilitarized zone is a network that is separate from the internal network and the external network both logically and physically. Typically, a DMZ contains devices for the public to access, such as the Web servers and FTP servers.

Security zone-based packet processing rules

The following table describes how the device handles packets when security zone-based security management is configured:

 

Packets	Action
Packets between an interface that is in a security zone and an interface that is not in any security zone	Discard.
Packets between two interfaces that are in the same security zone	Discard by default.
Packets between two interfaces that belong to different security zones	Forward or discard, depending on the matching interzone policy. If no policy is applied or the policy does not exist or does not take effect, the packets are discarded. For more information, see "Creating a zone pair."
Packets between two interfaces that are not in any security zone	Forward.
Packets originated from or destined for the device itself	Forward or discard, depending on the matching interzone policy. By default, these packets are discarded.

 

Application scenarios

As a best practice, use security zone-based security management if the firewall is connected to multiple network segments or the network topology might change.

The traditional security management technology is based on interfaces. To filter packets, you must apply interzone policies on the inbound and outbound interfaces of a firewall. When the firewall is connected to multiple network segments, deploying interzone policies is time consuming and complicated. If the network topology changes, you might have to reconfigure interzone policies.

Restrictions: Hardware compatibility with security zone feature

Hardware	Security zone compatibility
MSR810, MSR810-W, MSR810-W-DB, MSR810-LM, MSR810-W-LM, MSR810-10-PoE, MSR810-LM-HK, MSR810-W-LM-HK, MSR810-LMS-EA	Yes
MSR810-LMS, MSR810-LUS	No
MSR2600-6-X1, MSR2600-10-X1	Yes
MSR 2630	Yes
MSR3600-28, MSR3600-51	Yes
MSR3600-28-SI, MSR3600-51-SI	Yes
MSR3600-28-X1, MSR3600-28-X1-DP, MSR3600-51-X1, MSR3600-51-X1-DP	Yes
MSR3610-I-DP, MSR3610-IE-DP	Yes
MSR3610-X1, MSR3610-X1-DP, MSR3610-X1-DC, MSR3610-X1-DP-DC	Yes
MSR 3610, MSR 3620, MSR 3620-DP, MSR 3640, MSR 3660	Yes
MSR3610-G, MSR3620-G	Yes

‌

About interzone policies

Interzone policies identify data flows and control packet forwarding based on security zones, as shown in Figure 1. You can assign interfaces with the same security requirements to the same security zone, and assign interfaces with different security requirements to different security zones. For example, you can assign the interface connected to the internal network to security zone trust, and assign the interface connected to the Internet to security zone Untrust. Then, you can deploy interzone policies to between the security zones to control packet forwarding.

If the network topology changes, you only need to change interface assignments. You do not need to modify the interzone policies.

Figure 1 Security zones and interzone policies

 

Interzone policy types

Interzone policies fall in to the following types: packet filtering, ASPF, and object policy. Packet filtering, ASPF, and object policies are applied on zone pairs.

Packet filtering

Packet filtering controls packet forwarding between security zones by using packet quintuple information, including the source IP address, source port number, destination IP address, destination port number, and protocol number. For more information about packet filtering, see ACL configuration in ACL and QoS Configuration Guide.

As shown in Figure 2, to allow only employees in the Marketing department to access the Internet, configure rule-1 and rule-2. The default rule denies access requests from the Finance department. Then, apply packet filtering policies in both directions of the Trust-Untrust zone pair.

Figure 2 Packet filtering

 

ASPF

Advanced Stateful Packet Filter (ASPF) records information about packets permitted by packet filtering policies to forward responses to the packets between security zones. For more information about ASPF, see ASPF configuration in Security Configuration Guide.

As shown in Figure 3, to allow only employees in the Marketing department to access the Internet, you can configure rule-1 and ASPF. The default rule denies access requests from the Finance department but also denies responses to packets from the Marketing department. ASPF enables the device to forward responses to packets from the Marketing department to the Marketing department.

Figure 3 Packet filtering and ASPF

 

Object policy

Object policies are configured globally and applied on zone pairs to filter packets. For more information about object policies, see object policy configuration in Security Configuration Guide.

As shown in Figure 4, to allow only employees in the Marketing department to access the Internet and forbid access to shopping websites, configure an object policy. Then, apply the policy to zone pair Trust-to-Untrust. The default rule denies access requests from the Finance department.

Figure 4 Object policy application

 

Security zone configuration tasks at a glance

To configure security zones, perform the following tasks:

·     Creating a security zone

·     Adding members to a security zone

·     Creating a zone pair

·     (Optional.) Specifying the default action for packets between interfaces in the same security zone

·     (Optional.) Enabling filtering based on virtual service IP address

Creating a security zone

1.     Enter system view.

system-view

2.     Create a security zone and enter security zone view.

security-zone name zone-name

By default, no security zones exist.

Adding members to a security zone

About security zone members

A security zone can include member types listed in Table 1.

Table 1 Security zone members and objects that the members identify

Security zone member	Objects that each member identifies
Layer 3 interface: ·     Layer 3 Ethernet interface ·     Layer 3 logical interface, such as a Layer 3 subinterface	All packets received or sent on the interface
Layer 2 interface-VLAN combination	All packets received or sent on the interface that carry the specified VLAN tag

 

Procedure

1.     Enter system view.

system-view

2.     Enter security zone view.

security-zone name zone-name

3.     Add members to the security zone.

Choose one option as needed:

¡     Add a Layer 3 Ethernet interface.

import interface layer3-interface-type layer3-interface-number

By default, a security zone does not have Layer 3 Ethernet interface members.

You can perform this step multiple times to add multiple Layer 3 Ethernet interface members.

¡     Add Layer 2 interface-VLAN combinations.

import interface layer2-interface-type layer2-interface-number vlan vlan-list

By default, a security zone does not have Layer 2 interface-VLAN combination members.

You can perform this step multiple times to add multiple Layer 2 interface-VLAN combination members.

Creating a zone pair

About zone pairs

A zone pair has a source security zone and a destination security zone. The device examines received first data packets and uses zone pairs to identify data flows. Then, the device uses interzone policies applied to the matching zone pairs to process the data flows.

You can use the zone-pair security source any destination any command to define the any-to-any zone pair. This zone pair matches all packets from one security zone to another security zone. A zone pair between specific security zones has a higher priority than the any-to-any zone pair.

For packets between the Management and Local security zones, the device uses only interzone policies applied to the zone pairs of the two security zones. By default, the device drops packets between the Management and Local zones.

If you apply an object policy and a packet filtering policy to a zone pair, the object policy takes precedence.

Procedure

1.     Enter system view.

system-view

2.     Create a zone pair and enter zone pair view.

zone-pair security source { source-zone-name | any } destination { destination-zone-name | any }

Specifying the default action for packets between interfaces in the same security zone

About the default action for packets between interfaces in the same security zone

The system uses the default action for packets that are exchanged between interfaces in the same security zone in the following situations:

·     A zone pair from the security zone to the security zone itself is not configured.

·     A zone pair from the security zone to the security zone itself is configured, but no interzone policy is applied to the zone pair.

Procedure

1.     Enter system view.

system-view

2.     Specify the default action for packets exchanged between interfaces in the same security zone.

¡     Set the default action to permit.

security-zone intra-zone default permit

¡     Set the default action to deny.

undo security-zone intra-zone default permit

By default, the default action is deny.

Enabling filtering based on virtual service IP address

About filtering based on virtual service IP address

This feature enables the device to filter packets from external networks to internal servers by virtual service IP address in scenarios where server load balancing is deployed. By default, this feature is disabled. Before matching each of the packets against ACLs, the device translates the destination IP address (the virtual service IP address) to the real server IP address. For more information about packet filtering, see ACL configuration in ACL and QoS Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Enable filtering based on virtual service IP address for zone pairs.

zone-pair vsip-filter enable

By default, filtering based on virtual service IP address is disabled.

Display and maintenance commands for security zones

Execute display commands in any view.

 

Task	Command
Display security zone information.	display security-zone [ name zone-name ]
Display zone pair information.	display zone-pair security

 

Security zone configuration examples

Example: Configuring security zones

Network configuration

As shown in Figure 5, a security protection device (Device) connects the corporate network to the Internet. The corporate network needs to provide Web services for only internal users.

To ensure corporate network security, configure the device as follows:

·     Assign GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 to security zones Trust, DMZ, and Untrust, respectively.

·     Configure zone pairs and apply interzone policies to control access as follows:

¡     Allow internal users to access the Web server and the Internet.

¡     Forbid external users to access the internal network and the Web server.

¡     Forbid the Web server to access the internal network.

Figure 5 Network diagram

‌

Procedure

1.     Assign IP address to the interfaces on the device and configure routes to ensure network connectivity. (Details not shown.)

2.     Add interfaces to security zones:

# Add interface GigabitEthernet 1/0/1 to security zone Trust.

<Device> system-view

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/1

[Device-security-zone-Trust] quit

# Add interface GigabitEthernet 1/0/2 to security zone DMZ.

[Device] security-zone name dmz

[Device-security-zone-DMZ] import interface gigabitethernet 1/0/2

[Device-security-zone-DMZ] quit

# Add interface GigabitEthernet 1/0/3 to security zone Untrust.

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/3

[Device-security-zone-Untrust] quit

3.     Configure ACL 3500 to permit IP traffic.

[Device] acl advanced 3500

[Device-acl-ipv4-3500] rule permit ip

[Device-acl-ipv4-3500] quit

4.     Configure zone pairs and apply interzone policies:

# Create a zone pair with the source security zone Trust and destination security zone Untrust.

[Device] zone-pair security source trust destination untrust

# Apply ACL 3500 to the zone pair.

[Device-zone-pair-security-Trust-Untrust] packet-filter 3500

[Device-zone-pair-security-Trust-Untrust] quit

# Create a zone pair with the source security zone Trust and destination security zone DMZ.

[Device] zone-pair security source trust destination dmz

# Apply ACL 3500 to the zone pair.

[Device-zone-pair-security-Trust-DMZ] packet-filter 3500

[Device-zone-pair-security-Trust-DMZ] quit

Verifying the configuration

# Verify that internal hosts can access the Internet and the Web server. (Details not shown.)

# Verify that access requests initiated from the Internet and the DMZ zone to the internal network are denied. (Details not shown.)