Best practice for setting security policies between trusted zones?

[lln_neteng]

Is it best practice to combine all trusted zones into one policy? (See below)

Or Split them out like this (See Below)

[skrall]

We really do not have any "Best Practices" with regard to this because different customers/industries have different needs. This is often done to simplify the ruleset especially if there are 2 or more zones with identical security requirements. The paloalto logs traffic that traverse zones so this is sometimes preferred to having 3 interfaces all part of zone = trust. Combining all of the zones  in one rule can also fix or compensate for some of the "side effects" of creating an "Any/Any/Deny" rule for cleanup and logging.

Steve Krall