ZyXEL Communications 1000 User Manual

Chapter 17 Zones

ZyWALL USG 1000 User’s Guide

Zones effectively divide traffic into three types--intra-zone traffic, inter-zone 
traffic, and extra-zone traffic--which are affected differently by zone-based 
security and policy settings.

• Intra-zone traffic is traffic between interfaces or VPN tunnels in the same zone. 

For example, in 

, traffic between VLAN 2 and the 

Ethernet is intra-zone traffic. 

• In each zone, you can either allow or prohibit all intra-zone traffic. For example, 

in 

, you might allow intra-zone traffic in the LAN zone 

but prohibit it in the WAN zone. 

• You can also set up firewall rules to control intra-zone traffic (for example, DMZ-

to-DMZ), but many other types of zone-based security and policy settings do 

not affect intra-zone traffic.

Inter-zone traffic is traffic between interfaces or VPN tunnels in different zones. 
For example, in 

, traffic between VLAN 1 and the Internet 

is inter-zone traffic. This is the normal case when zone-based security and policy 
settings apply.

• Extra-zone traffic is traffic to or from any interface or VPN tunnel that is not 

assigned to a zone. For example, in 

, traffic to or from 

computer C is extra-zone traffic. 

• Some zone-based security and policy settings may apply to extra-zone traffic, 

especially if you can set the zone attribute in them to Any or All. See the 

specific feature for more information.

• See 

 for related information on these screens.

• See 

 for an example of configuring Ethernet interfaces, 

port groups, and zones.