ZyXEL ZyWALL USG 2000 User Guide - Page 378

Chapter 17 Zones 17.1.2 What You Need to Know Effects of Zones on Different Types of Traffic Zones effectively divide traffic into three types--intra-zone traffic, inter-zone traffic, and extra-zone traffic--which are affected differently by zone-based security and policy settings. Intra-zone Traffic • Intra-zone traffic is traffic between interfaces or VPN tunnels in the same zone. For example, in Figure 285 on page 377, traffic between VLAN 2 and the Ethernet is intra-zone traffic. • In each zone, you can either allow or prohibit all intra-zone traffic. For example, in Figure 285 on page 377, you might allow intra-zone traffic in the LAN zone but prohibit it in the WAN zone. • You can also set up firewall rules to control intra-zone traffic (for example, DMZto-DMZ), but many other types of zone-based security and policy settings do not affect intra-zone traffic. Inter-zone Traffic Inter-zone traffic is traffic between interfaces or VPN tunnels in different zones. For example, in Figure 285 on page 377, traffic between VLAN 1 and the Internet is inter-zone traffic. This is the normal case when zone-based security and policy settings apply. Extra-zone Traffic • Extra-zone traffic is traffic to or from any interface or VPN tunnel that is not assigned to a zone. For example, in Figure 285 on page 377, traffic to or from computer C is extra-zone traffic. • Some zone-based security and policy settings may apply to extra-zone traffic, especially if you can set the zone attribute in them to Any or All. See the specific feature for more information. Finding Out More • See Section 6.5.8 on page 107 for related information on these screens. • See Section 7.1 on page 119 for an example of configuring Ethernet interfaces, port groups, and zones. 378 ZyWALL USG 2000 User's Guide