Prisma SD-WAN Administrator’s Guide
    : ZBFW Zones
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma
    3. Prisma SD-WAN
    4. Prisma SD-WAN Administrator’s Guide
    5. Prisma SD-WAN Security Policies
    6. ZBFW Contructs
    7. ZBFW Zones
    Download PDF

    Prisma SD-WAN Administrator’s Guide

    ZBFW Zones

    Table of Contents

    ZBFW Zones

    ZBFW zones are bound to sites through site bindings.
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN
    • Active Prisma SD-WAN license
    Zones specify enforcement boundaries where traffic subject to inspection and filtering. Each zone maps to networks attached to physical interfaces, logical interfaces, or sub-interfaces of a device. These zone-level interfaces serve as a proxy for physical circuits and virtual circuits, such as VLAN, Layer 3 VPN, and Layer 2 VPN circuits. You can manage and secure every interface in a zone independently.
    • Allow or deny every interface in zone access to other zones within an enterprise network.
    • Segregate interface traffic by blocking all access not explicitly allowed by the security policies of an enterprise.
    • Isolate networks that have private or secure information by restricting access to it from public networks.
    An area includes source and destination zones with network IDs for a site and is associated with one or more WAN, LAN, or VPN. Attach a zone to multiple networks, but each network type LAN, WAN, or VPN would be connected to one location.
    Typically, most organizations create three to four zones to segregate traffic using the model’s guest zone, one or more corporate LAN zones, an outside zone for internet underlay, and a corporate WAN zone for private WAN and VPN over the internet or private WAN.
    Define the network segments that allow or restricts the application access to control traffic between LAN or between LAN and WAN and, through site bindings, bind zones to the appropriate LAN and WAN interfaces at each site.
    In Security Policy rules, specify the source and destination zones to which the rule applies. You must establish one or more source and destination zones for each security rule to configure. The source zone identifies the network from where traffic originates and the destination zone identifies the destination traffic of the network.

    © 2024 Palo Alto Networks, Inc. All rights reserved.