If you have any important information or tools attached to devices in your network, then you need good network security. An essential tool for security is the firewall.<\/p>\n\n\n\n
Of course, firewalls have seen a lot of development over the years, so if you want modern solutions, then you need to know about modern firewalls. It\u2019s time to learn about zone-based firewalls.<\/p>\n\n\n\n
If a firewall is a technology that inspects traffic to protect your network, then a zone-based firewall is one of the most advanced designs in this field. It is available with modern Cisco technology, and it provides more thorough and efficient firewall protection.<\/p>\n\n\n\n
Before we get too deep in the weeds, a few notes need to be addressed. First, zone-based firewalls are still stateful firewalls, meaning they track the individual sessions within the network. That makes its functionality similar to other types of firewalls.<\/p>\n\n\n\n
But, zone-based technology does depart from the context-based access control (CBAC) that was dominant in the realm of firewalls for many years. Zone technology is what replaces CBAC, and in order to understand exactly what that means, we need to zoom in.<\/p>\n\n\n\n
As you might imagine, the \u201czone\u201d is the key piece to zone-based firewall protection. In this respect, the firewall assigns zones to the network. (More accurately, the network administrator can pick the zones when they set up the firewall.)<\/p>\n\n\n\n
The zones are based on the physical configuration of the network. You could create a zone around a specific Wi-Fi mesh. You could create it around a printing hub. There are many options (and the most common will be explained later). The point is that once the zones are set, the firewall specifically monitors traffic that travels between zones. If traffic stays within a zone, it doesn\u2019t have to pass through the firewall. When traffic does go through a zone, the rest of the firewall process is normal. Traditional checks and mechanisms will inspect that traffic to ensure the network is safe.<\/p>\n\n\n\n
So, what do the zones look like? Ideally, each router exists in its own zone. When traffic goes between routers, that merits a firewall inspection. It\u2019s also possible to create smaller zones within the network of a single router.<\/p>\n\n\n\n
Either way, the idea is that zone-based firewalls increase security according to network segmentation. This doubles down on the idea of pre-quarantining problems by segmenting the network in the first place.<\/p>\n\n\n\n
While that does explain the zones, we still need to cover the firewall mechanisms when inspections take place. The configuration policy is called Cisco Activity Language (CPL). This governs the firewall\u2019s behavior when it intervenes in network traffic.<\/p>\n\n\n\n
CPL is how you set your policies, and while this is a modern language, it\u2019s still providing traditional intervention options. You can whitelist or blacklist traffic according to criteria. You can use heuristics to inform firewall decision-making. There\u2019s really no need to reinvent firewalls at this point.<\/p>\n\n\n\n
It really comes down to setting your zones to ensure traffic is inspected when and where you want.<\/p>\n\n\n\n
With all of that covered, we can explore zone-based firewalls another way by comparing them to other firewall mechanisms. The best comparison probably involves CBAC.<\/p>\n\n\n\n
With CBAC, each interface needs its own individual configuration. This is done via an access list that uses large tables to inspect and compare traffic in order to make decisions about access. While this does create effective interventions, it’s slow and clunky and eats up a lot of IT labor. For a large network, CBAC requires a lot of configuration.<\/p>\n\n\n\n
One of the great advantages of a zone design is that it simplifies implementation without sacrificing efficacy. Each zone can have its own access and traffic policies, but because the firewall only has to inspect cross-zone traffic, the application of the intervention is simpler.<\/p>\n\n\n\n
On top of that, you aren\u2019t individually configuring different firewalls across each node of the network. You only have to configure according to zones, and if a single zone needs multiple firewalls, you can copy policies accordingly.<\/p>\n\n\n\n
We can add perspective by considering how firewalls fit into your network topology. The most common design of zone firewalls uses a three-zone system. You have the public, private, and DMZ zones. For large networks, you can create multiples of each zone, but you still typically split policies for any zone into one of these categories.<\/p>\n\n\n\n
This helps you simplify network implementation and execution.<\/p>\n\n\n\n
Let\u2019s take a closer look at each type of zone to see what that reveals.<\/p>\n\n\n\n
The public zone includes any traffic that comes from outside your network. In other words, this zone includes the internet.<\/p>\n\n\n\n
Small networks typically only have one public zone, but larger networks might have multiple ISP access points. Regardless, ISP zones have public rule sets that often apply wider access to users paired with stronger traffic security.<\/p>\n\n\n\n
Private zones are for devices that sit inside your network and do not directly access traffic outside of the private network. Many printers would fit into such a zone, as do many other devices.<\/p>\n\n\n\n
As far as architecture goes, it\u2019s reasonable to set up multiple private zones according to traffic types and use cases. You might put a camera security system in its own zone. Or, an enterprise network might put the accounting department in a single zone. It\u2019s really up to the administrator, and the zone strategy amplifies the benefits of network segmentation.<\/p>\n\n\n\n
The last type of zone is the DMZ (demilitarized zone). This is another way of identifying a neutral zone. Neutral zones segment devices that interface with public traffic. The best examples include web servers and mail servers.<\/p>\n\n\n\n
You can think of the DMZ zone as sitting somewhere between the public and private zones. DMZ devices do communicate outside of the private network, but they don\u2019t fully access the greater internet. They provide specific access and communications, and that\u2019s why they should be treated with their own set of firewall procedures.<\/p>\n\n\n\n
That really covers the gist of zone-based firewalls. They\u2019re a great way to make firewall protection more efficient, and they\u2019re gaining popularity across networks of all shapes and sizes.<\/p>\n\n\n\n
Additional Learning Center Resources<\/p>\n\n\n\n
If you have any important information or tools attached to devices in your network, then you need good network security. An essential tool for security is the firewall. Of course, firewalls have seen a lot of development over the years, so if you want modern solutions, then you need to know about modern firewalls. It\u2019s […]<\/p>\n","protected":false},"author":3,"featured_media":855,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-networking-equipment"],"acf":[],"contentshake_article_id":"","yoast_head":"\n