topic Zone-based Policy Firewalls and Subinterfaces in Network Security

Zone-based Policy Firewalls and Subinterfaces

thralkhan — Tue, 12 Mar 2019 00:14:02 GMT

I was posed a question and am not sure of the answer.

Can you assigne separate zones to subinterfaces on the same intface with ZPF?

In other words, if I have 3 subinterfaces leaving one physical interface on a router, can I have 3 separate zones?

The rule states that there can be only one zone per interface, but is that physical, virtual, or either?

Thanks

Zone-based Policy Firewalls and Subinterfaces

Julio Carvajal — Thu, 25 Oct 2012 17:00:41 GMT

Hello Dean,

Yes you can setup that ( one zone per sub-interface)

Regards,

Julio

Zone-based Policy Firewalls and Subinterfaces

leonardomachado — Thu, 28 Feb 2013 13:36:40 GMT

Hi jcarvaja,

I have a similar question, but in another way:

I have 2 sub interface in a single physical interface.

If I set this PHYSICAL interface into a zone, will the zone policies be valid for all sub interfaces? Or do I have to explicitly set each sub interface to the same zone?

Thanks,

Leo.

Zone-based Policy Firewalls and Subinterfaces

Andrew Phirsov — Thu, 28 Feb 2013 16:26:02 GMT

You have to explicitly allocate each subinterface to a certain zone.

Re: Zone-based Policy Firewalls and Subinterfaces

shanegmason10227 — Wed, 13 Nov 2019 09:51:05 GMT

How is that done?

Re: Zone-based Policy Firewalls and Subinterfaces

shanegmason10227 — Wed, 13 Nov 2019 09:52:42 GMT

Can you provide more details or steps into how to achieve this/?

Re: Zone-based Policy Firewalls and Subinterfaces

Matt Wilson — Sun, 17 Nov 2019 08:09:17 GMT

Create your zones:

zone security lan1
zone security lan2
zone security lan3
...

On your sub interfaces:

!
interface GigabitEthernet0/1.1
 zone-member security lan1
!
interface GigabitEthernet0/1.2
 zone-member security lan2
!
interface GigabitEthernet0/1.3
 zone-member security lan3
!
...

Simples!

Re: Zone-based Policy Firewalls and Subinterfaces

shanegmason10227 — Sun, 17 Nov 2019 12:47:53 GMT

Thanks much, appreciate it.

I realise the issue was a limitation with packet tracer. Packet tracert do
not have the zone member command for sub interfaces.