Cisco Systems 2.5 Zone Window

Chapter34 Zone-Based Policy Firewall
Zone Window
34-2
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
3. Define class-maps that describe traffic that must have policy applied as it
crosses a zone-pair.
4. Define policy-maps to apply action to your class-map’s traffic.
5. Apply policy-maps to zone-pairs.
6. Assign interfaces to zones.
The sequence of tasks is not important, but some events must be completed in
order. For instance, you must configure a class-map before you assign a class-map
to a policy-map. Similarly, you cannot assign a policy-map to a zone-pair until
you have configured the policy. If you try to complete a task that relies on another
portion of the configuration that you have not configured, SDM does not allow
you to do so.
Zone Window
A zone, or security zone, is a group of interfaces to which a security policy can be
applied. The interfaces in a zone should share common functions or features. For
example, two interfaces that are connected to the local LAN might be placed in
one security zone, and the interfaces connected to the Internet might be placed in
another security zone.
For traffic to flow among all the interfaces in a router, all the interfaces must be a
member of one security zone or another. It is not necessary for all rout er interfaces
to be members of security zones.
Zone-based Policy General Rules describes the rules governing interface behavior
and the flow of traffic between zone-member interfaces.
This window displays the name of each security zone, the interfaces that it
contains, and any associated zone pairs that the zone is a member of. A zone can
be a member of multiple zone pairs.
Click Add to create a new zone.
Click Edit to choose different interfaces for an existing zone.
Click Delete to remove a zone. A zone that is a member of a zone pair cannot be
deleted.