topic Re: Overlap-Zone difference Vsys in General Topics

Overlap-Zone difference Vsys

Pattarachai — Fri, 17 May 2019 07:11:24 GMT

HI Expert ,

I would like to know that it can be possible about overlap zone name but difference Vsys such as I would to defind name Zone "Trust" on vsys1 and would to zone name "Trust" on vsys2 as well

Please suggest to me

Thank you

Re: Overlap-Zone difference Vsys

kiwi — Fri, 17 May 2019 08:35:18 GMT

Hi @Pattarachai ,

Yes you can use the same zone names in different vsys.

Cheers !

-Kiwi.

Re: Overlap-Zone difference Vsys

jeremy.larsen — Fri, 17 May 2019 20:00:53 GMT

"Just because you can do something doesn't mean you should"

Having managed a multi-vSYS environment, I can definitely recommend you NOT do this. You can because the vSYS are considered completely separate systems. But to keep things straight in your own head, I would recommend defining your zones with meaningful and specific names. This means you will most likely have different zone names in each vSYS naturally. Thoughts?

Re: Overlap-Zone difference Vsys

BPry — Fri, 17 May 2019 21:18:07 GMT

@jeremy.larsen,

Depends on why you are using multi-vsys to begin with. In certain instances where I utilize multi-vsys in local government buildings to seperate out say Law Enforcement from the rest of the County I wouldn't necissarly say that a zone named "County Untrust" or "LEA Untrust" would really make that big of an difference over just "untrust". It might matter slightly more if you configure in the GUI instead of the XML or CLI, but you do have the dropdown up top specifying what VSYS you are on currently.

It's also something that I've done on purpose when I template the XML file for utilization in Jinja2 for shared security policies where I might only want to make an "Internet Access" policy once or a similar shared policy that I would otherwise have to create in both security rulebases manually. Granted this is an extreme edge-case and something most people would never think of even doing, but reasons to utilize shared zone names do exist.