topic Re: Best Practice for Security Zones in Network Security

Best Practice for Security Zones

alex.f. — Mon, 09 Nov 2020 17:34:52 GMT

A Customer will modernize a small/medium Network with seven FTDs (1120 / 2110) at 1 HQ and 3 Branches.

so I am looking for best practice example for Security Zones form CISCO to pitch my Migration Plan.

Re: Best Practice for Security Zones

balaji.bandi — Mon, 09 Nov 2020 17:38:06 GMT

It all depends on how your exiting environment, are you looking exiting to migrate to FTD ?

or you looking to deploy FTD greenfield and migrate ?

https://www.cisco.com/c/en/us/td/docs/security/firepower/621/asa2ftd-migration/asa2ftd-migration-guide-621/asa2ftd_migration_procedure.html

Re: Best Practice for Security Zones

alex.f. — Mon, 09 Nov 2020 18:17:56 GMT

We used the migration tool to import the existing access rules and the basic Configuration but ist created a zone for each interface.

The Customer is not so experienced and need the push in the right direction. Actually we have a Greenfield deployment of the new FTDs running with the old Concept.

Re: Best Practice for Security Zones

Nicolai Borchorst — Mon, 09 Nov 2020 18:35:28 GMT

I usually create a zone per. interface and then create a category in the ACP section for each interface. I then place all access rules sourced from that particular interface under that category, so the ACP config will end up looking like en ASA Config. Example:

Category: INSIDE_ZONE

Category: OUTSIDE_ZONE

Re: Best Practice for Security Zones

Marius Gunnerud — Mon, 09 Nov 2020 19:06:15 GMT

Security zones are used to segment your network and make it easier to classify traffic. Usually you would group interfaces that provide similar services. For example, DMZ1, DMZ2, and DMZ3 could be grouped into a single security zone called DMZ. Interface facing the internet could be placed in the Outside zone or a zone called Internet.

But it all boils down to what does your security policy dictate, and what are your network needs.

Re: Best Practice for Security Zones

balaji.bandi — Mon, 09 Nov 2020 20:24:00 GMT

My best approach Lan side 1 Zone, Outside you can make any zones since the Lan side always is only 1Zone and trusted network. if you have more then you need to create more, but i prefer to make simple so easy to manage the network, rather a complex task for engineers when required to diagnosis the issue.

Inside LAN Zone

Outside 1 Zone

WAN 2 Zone

DMZ Zone