Best Practice for Security Zones

[alex.f.]

A Customer will modernize a small/medium Network with seven FTDs (1120 / 2110) at  1 HQ and 3 Branches.

so I am looking for best practice example for Security Zones form CISCO to pitch my Migration Plan.

[balaji.bandi]

It all depends on how your exiting environment, are you looking exiting to migrate to FTD ?

or you looking to deploy FTD greenfield and migrate ?

https://www.cisco.com/c/en/us/td/docs/security/firepower/621/asa2ftd-migration/asa2ftd-migration-guide-621/asa2ftd_migration_procedure.html

[alex.f.]

We used the migration tool to import the existing access rules and the basic Configuration but ist created a zone for each interface.

The Customer is not so experienced and need the push in the right direction. Actually we have a Greenfield deployment of the new FTDs running with the old Concept.

[balaji.bandi · Accepted solution]

My best approach Lan side 1 Zone, Outside you can make any zones since the Lan side always is only 1Zone and trusted network. if you have more then you need to create more, but i prefer to make simple so easy to manage the network, rather a complex task for engineers when required to diagnosis the issue.

Inside LAN Zone 

Outside 1  Zone

WAN 2  Zone 

DMZ Zone

[Nicolai Borchorst]

I usually create a zone per. interface and then create a category in the ACP section for each interface. I then place all access rules sourced from that particular interface under that category, so the ACP config will end up looking like en ASA Config. Example:

Category: INSIDE_ZONE

<All rules sourced from the Inside Zone>

Category: OUTSIDE_ZONE

<All rules sourced from the internet>

[Marius Gunnerud]

Security zones are used to segment your network and make it easier to classify traffic.  Usually you would group interfaces that provide similar services.  For example, DMZ1, DMZ2, and DMZ3 could be grouped into a single security zone called DMZ.  Interface facing the internet could be placed in the Outside zone or a zone called Internet.

But it all boils down to what does your security policy dictate, and what are your network needs.