topic Re: VSX provisioning tool - VS topology - Security Zone support? in Firewall and Security Management

VSX provisioning tool - VS topology - Security Zone support?

Mark_Ewest — Wed, 19 Oct 2022 15:44:37 GMT

Hello Fine Community!

Quick question regarding VSX provisioning tool. I've used this tool over the years to build/manage interfaces on Virtual Systems - but more recently have been utilizing Security Zones on interfaces. Is anyone aware of support for tagging an interface with a Security Zone via VSX provisioning tool? I've searched some documentation, but haven't found much (perhaps I'm just missing it, or perhaps this is not available [yet?]). Any insights appreciated. Below is a basic example of a command I use; but ideally could also tag the eth0.123 interface with "InternalZone" on the same line. Apologies if I've missed a similar post on this topic!

add interface name eth0.123 ip x.x.x.x/24 topology internal_this_network

Re: VSX provisioning tool - VS topology - Security Zone support?

genisis__ — Wed, 19 Oct 2022 20:01:04 GMT

Not see anything myself, I would also like to know if there is a way to enable anti-spoofing in detect and log mode per interface.

Re: VSX provisioning tool - VS topology - Security Zone support?

Chris_Atkinson — Thu, 20 Oct 2022 06:18:32 GMT

In future versions there will be a shift towards APIs for VSX.

With that said the last I saw regarding the VSX provisioning tool pertained to "defined by routed" behavior... i.e.

PRJ-32534,
PMTR-74770

VSX

UPDATE: It is now possible to define interface topology as "defined by routes" using the VSX provisioning tool.

Will check the status regarding Zones and revert.

Re: VSX provisioning tool - VS topology - Security Zone support?

Mark_Ewest — Thu, 20 Oct 2022 13:45:23 GMT

Got it, yea a shift towards APIs makes sense and I was kind of wondering how much more new functionality will be added to the VSX provisioning tool if that was the case. But didn't know if APIs would leverage the provisioning tool on the backend or be independent. I have more questions than answers 🙂 Thanks for your input.

Re: VSX provisioning tool - VS topology - Security Zone support?

_Val_ — Fri, 21 Oct 2022 08:11:47 GMT

Just to make sure, we are now working on VSX Pro - a completely new architecture for virtualized security, and it will have native APIs for management. You will not need the provisioning tool with it anymore, AFAIK.

That said, it will not be available before some time the next year.

Re: VSX provisioning tool - VS topology - Security Zone support?

genisis__ — Fri, 21 Oct 2022 19:46:45 GMT

Would be really good to get more info on VSX Pro!

Re: VSX provisioning tool - VS topology - Security Zone support?

_Val_ — Mon, 24 Oct 2022 08:42:54 GMT

I promise we will talk about that as soon as we can 🙂 But before, please let R&D do their magic.

Re: VSX provisioning tool - VS topology - Security Zone support?

Mark_Ewest — Fri, 28 Oct 2022 13:29:54 GMT

Just wanted to say thanks to @_Val_ and @Chris_Atkinson for the comments! Will certainly look forward to hearing more about VSX Pro and native Mgmt APIs.

Re: VSX provisioning tool - VS topology - Security Zone support?

amoruck — Fri, 17 Nov 2023 11:37:54 GMT

Hello,

Any news regarding this feature/project? is there any other way to configure security zone/anti-spoofing for VSX virtual system interfaces?

Re: VSX provisioning tool - VS topology - Security Zone support?

Chris_Atkinson — Fri, 17 Nov 2023 13:12:23 GMT

Further changes are expected with the release of R82.