Configuring Interfaces and Security Zones

Context

A security zone is a collection of networks connected through one or more interfaces. Users on the networks in a security zone have the same security attributes. Most security policies are implemented based on security zones. Each security zone identifies a network, and a firewall connects the networks. Firewalls use security zones to divide networks and mark the routes of packets. When packets travel between security zones, security check is triggered and corresponding security policies are enforced. Security zones are isolated by default.

A campus network itself is considered secure, but is faced with security threats from the outside. Therefore, allocate the Internet to the untrusted zone and the campus network to the trusted zone. Deploy security devices at the campus network egress to isolate the intranet from the Internet and defend against external threats. Allocate the data center to the DMZ, and deploy firewalls in the DMZ to isolate traffic between the campus intranet and servers in the data center. Figure 5-5 shows the interface plan for the egress network.

Figure 5-5 Campus egress network

Plan Example

Procedure

1. Choose Network > Interface. Click Add and create an Eth-Trunk.

2. Click in the row where the interface to be configured resides and modify the interface configuration.