topic White Paper - Security Zones in General Topics

White Paper - Security Zones

_Val_ — Mon, 08 Jul 2019 12:58:20 GMT

Author

Abstract:

As security technologies grow more complex the administrator has many tools at his or her disposal to regulate and enforce traffic in firewall devices. While security zones are not new tools, an individual may underutilise the objects in daily activities. This paper attempts to explain what a security zone function in a firewall and how it applies to modern security techniques. The key benefits to a security zone is tight control of traffic and routing functions while maintaining simplified control.

For the full list of White Papers, go here.

Re: White Paper - Security Zones

Lei_Liu — Tue, 04 Feb 2020 03:41:45 GMT

Could you help me to confirm whether R77.20.87 version of SMB 1450 Appliances support Security Zones via Centralized Management of SMC ?

Re: White Paper - Security Zones

Martin_Valenta — Tue, 04 Feb 2020 05:21:21 GMT

As long as you can define zone oninterface within Topology on gateway object, then most likely yes..

Re: White Paper - Security Zones

G_W_Albrecht — Tue, 04 Feb 2020 09:29:08 GMT

We find in the new features list of R80.10:

Security Zones: Group interfaces of gateways into Security Zones for new Source and Destination definitions.

The sk10538 Check Point R77.20.xx for 600 / 700 / 1100 / 1200R / 1400 / 910 Appliance Features and Known Limitations only mentions Security Zones 2 times:

SMB-5608

Policy installation fails on a centrally manged environment with more than 255 interfaces (in total) whose "security zone" is not set to "none" (ex: internal,external, etc.).

Workaround: If there are no policy rules that use these security zones, change their configuration to "none" (in the Gateway properties -> Topology tab).

01132456

Assigning Security Zones to interfaces on a SmartProvisioning profile is not supported.

But in sk159772 Check Point R80.20 for 1500 Appliances Features and Known Limitations we read:

Blade / Feature	Locally managed	Centrally managed	Comments
Unified Access

Security Zones	Yes	Yes

It still is not explicitly stated, but sk133252 Rules mismatch on appliance cluster when manually configured Security Zones object used tells us at least that Security Zones are supported with 1400, 1100, 1200R units.

But for which purpose are they supported ? I would suspect for topology definition to do address anti-spoofing. Centrally managed SMB units had their topology imported into Dashboard, where it could not be edited.

So i would assume that R80.10 Security Zones are fully supported by Check Point R80.20 for 1500 Appliances at least...

Re: White Paper - Security Zones

MariuszT — Thu, 25 Jun 2020 11:48:29 GMT

Hi,

Is there any limitation how many security zones can be created? I cannot find this information in guides and DS (R80.20 - R80.40)?

Thanks in advance,

MariuszT

Re: White Paper - Security Zones

_Val_ — Thu, 25 Jun 2020 14:29:57 GMT

No limitations

Re: White Paper - Security Zones

ducluongtrann — Wed, 04 May 2022 08:42:03 GMT

Is there any document to prove that?

Re: White Paper - Security Zones

_Val_ — Wed, 04 May 2022 12:08:09 GMT

It is really hard to prove a negative. You realise that, right? 🙂

No limitations, unless there is a document stating there is a limitation for amount of security zones. Yet, to the best of my knowledge, it does not exist.

There are, however, other limitations, mentioned in sk128572.