Configuring Zone based Firewall

Configuring Zone based Firewall

Below is the steps defined for CLI.

CLI Configuration Procedure:

Create lists of IP prefixes:

Configure a source zone ,this is a group of VPNs from which data traffic flows.

Configure a destination zone, this is a group of VPNs to which data traffic flows.

Create a zone-based firewall policy:

Create a series of match–action pair sequences:

Define match parameters for the data traffic:

Define actions to take when a match occurs:

Define the default action, when data traffic does not match the conditions:

If you do not include VPN 0 in any of the zones that you configure in a zone-based firewall, by default, packets are able to reach destination zones that are accessible only over the public internet. You can also disallow this traffic.

Create a zone pair, and define the source and destination zones in that pair and the zone-based firewall policy to apply to the flows between those two zones:

Example 1 isolating two VPNs

Here let see the topology, which describes the following and also defines the flow between different VPNs.