Contents

Configuring security zones· 1

About security zones· 1

Basic concepts· 1

Security zone-based packet processing rules· 1

Application scenarios· 1

About interzone policies· 2

Interzone policy types· 2

Advantages of security policies· 4

Restrictions and guidelines: Security zone configuration· 4

Security zone configuration tasks at a glance· 4

Creating a security zone· 5

Adding members to a security zone· 5

Specifying a permitted protocol 6

Specifying the default action for packets between interfaces in different security zones· 7

Enabling logging for the default action· 7

Display and maintenance commands for security zones· 7

 

Configuring security zones

About security zones

You can configure security zones to implement security zone-based security management.

Basic concepts

The security zone feature includes the following basic concepts:

·     Security zone—A security zone is a collection of interfaces that have the same security requirements.

·     System-defined security zones—The device provides the following system-defined security zones: Local, Trust, DMZ, Management, and Untrust. The system creates these security zones automatically when one of following events occurs:

¡     The first command for creating a security zone is executed.

¡     The first command related to creating an interzone policy is executed.

System-defined security zones cannot be deleted.

·     DMZ—A demilitarized zone is a network that is separate from the internal network and the external network both logically and physically. Typically, a DMZ contains devices for the public to access, such as the Web servers and FTP servers.

Security zone-based packet processing rules

The following table describes how the device handles packets when security zone-based security management is configured:

 

Packets	Action
Packets between an interface that is in a security zone and an interface that is not in any security zone	Discard.
Packets between two interfaces that are in the same security zone	Discard by default.
Packets between two interfaces that belong to different security zones	Forward or discard, depending on the matching interzone policy. If no policy is applied or the policy does not exist or does not take effect, the packets are discarded.
Packets between two interfaces that are not in any security zone	Discard.
Packets originated from or destined for the device itself	Forward or discard, depending on the matching interzone policy. By default, these packets are discarded.

 

Application scenarios

As a best practice, use security zone-based security management if the firewall is connected to multiple network segments or the network topology might change.

The traditional security management technology is based on interfaces. To filter packets, you must apply interzone policies on the inbound and outbound interfaces of a firewall. When the firewall is connected to multiple network segments, deploying interzone policies is time consuming and complicated. If the network topology changes, you might have to reconfigure interzone policies.

About interzone policies

Interzone policies identify data flows and control packet forwarding based on security zones, as shown in Figure 1. You can assign interfaces with the same security requirements to the same security zone, and assign interfaces with different security requirements to different security zones. For example, you can assign the interface connected to the internal network to security zone trust, and assign the interface connected to the Internet to security zone Untrust. Then, you can deploy interzone policies between the security zones to control packet forwarding.

If the network topology changes, you only need to change interface assignments. You do not need to modify the interzone policies.

Figure 1 Security zones and interzone policies

 

Interzone policy types

Interzone policies fall in to the following types: packet filtering, ASPF, and security policy. Packet filtering and ASPF can be applied on zone pairs. Security policies are based on security zones and are configured globally.

Packet filtering

Packet filtering controls packet forwarding between security zones by using packet quintuple information, including the source IP address, source port number, destination IP address, destination port number, and protocol number. For more information about packet filtering, see ACL configuration in ACL and QoS Configuration Guide.

As shown in Figure 2, to allow only employees in the Marketing department to access the Internet, configure rule-1 and rule-2. The default rule denies access requests from the Finance department. Then, apply packet filtering policies to both directions of the Trust-Untrust zone pair.

Figure 2 Packet filtering

 

ASPF

Advanced Stateful Packet Filter (ASPF) records information about packets permitted by packet filtering policies to forward responses to the packets between security zones. For more information about ASPF, see "Configuring ASPF."

As shown in Figure 3, to allow only employees in the Marketing department to access the Internet, you can configure rule-1 and ASPF. The default rule denies access requests from the Finance department but also denies responses to packets from the Marketing department. ASPF enables the device to forward responses to packets from the Marketing department to the Marketing department.

Figure 3 Packet filtering and ASPF

 

Security policy

Security policies are configured globally and take effect globally. They can be used not only to replace packet filtering, but also to control packet forwarding based on users and applications. Security policies can also use DPI application profiles to perform DPI for matching packets. For more information about security policies, see "Configuring security policies."

As shown in Figure 4, to allow only employees in the Marketing department to access the Internet and forbid access to shopping websites, configure a security policy. The security policy can also implement DPI on web pages. The default rule denies access requests from the Finance department.

Figure 4 Security policy application

 

Advantages of security policies

As described in "Interzone policy types," security policies have the following advantages over the other types of interzone policies:

·     More flexible and visible management—Security policies can identify packets based on not only quintuple information but also users.

·     Precise and granular management—Security policies can identify packets based on protocols (for example, HTTP) and applications (for example, webpage-based games, videos, and shopping).

·     DPI—By partnering with DPI, it can also provide security protection services such as antivirus and intrusion protection.

Restrictions and guidelines: Security zone configuration

Security policies take precedence over packet filtering policies. Packets matching security policies are processed based on the security policies.

Security zone configuration tasks at a glance

To configure security zones, perform the following tasks:

1.     ‍Creating a security zone

2.     Adding members to a security zone

3.     (Optional.) Specifying a permitted protocol

4.     (Optional.) Specifying the default action for packets between interfaces in different security zones

5.     (Optional.) Enabling logging for the default action

Creating a security zone

1.     Enter system view.

system-view

2.     Create a security zone and enter security zone view.

security-zone name zone-name

By default, the device has the following security zones: Local, Trust, DMZ, Management, and Untrust.

Adding members to a security zone

About this task

A security zone can include member types listed in Table 1.

Table 1 Security zone members and objects that the members identify

Security zone member	Objects that each member identifies
Layer 3 interface: ·     Layer 3 Ethernet interface ·     Layer 3 logical interface, such as a Layer 3 subinterface	All packets received or sent on the interface
Layer 2 interface-VLAN combination	All packets received or sent on the interface that carry the specified VLAN tag
VLAN	All packets that carry the specified VLAN tag. This type of security zones applies only to bridge forwarding. For more information about bridge forwarding, see bridge forwarding configuration in Layer 2—LAN Switching Configuration Guide.
IPv4 subnet	All packets sourced from or destined for the IPv4 subnet.
IPv6 subnet	All packets sourced from or destined for the IPv6 subnet.
Service chain	All packets that carry the specified service chain.

 

If a security zone has multiple types of members, a packet is matched in the following order: service chain, subnet, interface, and VLAN. The match operation stops when the first matching member is found.

Procedure

1.     ‍Enter system view.

system-view

2.     Enter security zone view.

security-zone name zone-name

3.     Add members to the security zone.

Choose one option as needed:

¡     Add a Layer 3 Ethernet interface.

import interface layer3-interface-type layer3-interface-number

By default, a security zone does not have Layer 3 Ethernet interface members.

You can perform this step multiple times to add multiple Layer 3 Ethernet interface members.

¡     Add Layer 2 interface-VLAN combinations.

import interface layer2-interface-type layer2-interface-number vlan vlan-list

By default, a security zone does not have Layer 2 interface-VLAN combination members.

You can perform this step multiple times to add multiple Layer 2 interface-VLAN combination members.

¡     Add VLANs.

import vlan vlan-list

By default, a security zone does not have VLAN members.

You can perform this step multiple times to add multiple VLAN members.

¡     Add an IPv4 subnet.

import ip ip-address { mask-length | mask } [ vpn-instance vpn-instance-name ]

By default, a security zone does not have IPv4 subnet members.

You can perform this step multiple times to add multiple IPv4 subnet members.

¡     Add an IPv6 subnet.

import ipv6 ipv6-address prefix-length [ vpn-instance vpn-instance-name ]

By default, a security zone does not have IPv6 subnet members.

You can perform this step multiple times to add multiple IPv6 subnet members.

¡     Add a service chain.

import service-chain path path-id [ reversed ]

By default, a security zone does not have service chain members.

To match the forward traffic of a service chain, add the service chain without the reversed keyword. To match the backward traffic, add the service chain with the reversed keyword. You can perform this step multiple times to add multiple service chain members.

Specifying a permitted protocol

About this task

By default, the device permits packets only between security zones Local and Management. It denies packets between security zone Local and other security zones. To permit packets of the specified protocols between security zone Local and other security zones, you can specify permitted protocols on interfaces or configure interzone policies.

After you specify a permitted protocol on an interface, the device will permit packets of the specified protocol from the device that is connected to the interface. The packets will not be limited based on security policies or traffic policies.

You can configure the manage command multiple times to specify multiple permitted protocols.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Specifying a permitted protocol.

manage { { http | https | ping | ssh | telnet } { inbound | outbound } | { netconf-http | netconf-https | netconf-ssh | snmp } inbound }

By default, no permitted protocols are specified. The device permits packets only from other devices that are connected through interfaces in security zone Management.

Specifying the default action for packets between interfaces in different security zones

About this task

For packets exchanged between interfaces in different security zones, the device drops the packets by default if no interzone policy is applied to the zone pair. You can set the default action to permit or deny for such packets.

Procedure

1.     Enter system view.

system-view

2.     Specify the default action for packets exchanged between interfaces in different security zones.

¡     Set the default action to permit.

security-zone inter-zone default permit

¡     Set the default action to deny.

undo security-zone inter-zone default permit

By default, the default action is deny.

Enabling logging for the default action

About this task

If the received packets cannot match any interzone policy, the device performs the default action to process the packets. For more information, see "Security zone-based packet processing rules."

By default, the system does not log the packet processing of the default action. You can configure this feature to enable logging for the default action.

Procedure

1.     Enter system view.

system-view

2.     Enable logging for the default action.

security-zone default-policy logging enable

By default, logging is disabled for the default action.

Display and maintenance commands for security zones

Execute display commands in any view.

 

Task	Command
Display security zone information.	display security-zone [ name zone-name ]