topic Configuring a Zone Without Interfaces in General Topics

Configuring a Zone Without Interfaces

shaunyt — Fri, 02 Sep 2016 11:51:59 GMT

It is possible to configure a zone without any interfaces specified?
Will the rule containing this zone be applied ?

Will traffic that match this rule be accepted from any source and destination interface?

Re: Configuring a Zone Without Interfaces

kiwi — Fri, 02 Sep 2016 13:09:52 GMT

Hi,

Yes you can configure zones without adding them to an interface :

Zone without interface

You can even configure this zone in the rulebase :

Zone in rulebase

Correct me if I'm wrong but as nothing is tied to this zone, this rule will never be matched.

-Kim.

Re: Configuring a Zone Without Interfaces

pulukas — Sat, 17 Sep 2016 14:47:28 GMT

Firewall lookup from zone to zone is matched based on the ingress and egress interface of the traffic.

so if a zone has no interfaces, the zone and associated rules will never be used for any traffic.

Re: Configuring a Zone Without Interfaces

jdelio — Mon, 19 Sep 2016 17:43:10 GMT

@shaunyt, My question for you is:

Why were you wanting to create a zone without interfaces?

What were you trying to accomplish?

Re: Configuring a Zone Without Interfaces

Anon1 — Thu, 29 Sep 2016 19:56:23 GMT

A use case would be the situation that a rule is deployed from Panorama to multiple firewalls and some dont have this zone. So commit will fail. When you add such a "dummy" zone with no interface assigned the commit will succeed.