> For the complete documentation index, see [llms.txt](https://tethra.gitbook.io/syte/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tethra.gitbook.io/syte/2023/network-security/2.md).
# 2
Content
1. [#security-zones-overview](#security-zones-overview "mention")
2. [#network-interfaces-and-security-zones](#network-interfaces-and-security-zones "mention")
3. [#interfaces-type](#interfaces-type "mention")
4. [#virtual-routers-and-layer-3-interfaces](#virtual-routers-and-layer-3-interfaces "mention")
### Security Zones overview
#### Network Segmentation
* Divides network into multiple areas, each protected by a firewall
* Firewall used to control and secure access to the data and resources in that area
* Things to watch out on:
* User-to-Data access requirements must be considered when deciding how to segment the network
* Principle of least privilege when segmenting the network should be implemented
* Data security regulations/standards that apply to the organizations should be considered.
Palo Alto networks use the concept of security zones to secure and manage networks
Security zones are a logical way to group physical and virtual interfaces on the firewall - systems with similar security needs are grouped into the same zone.
* :star:More granular the zones are and the corresponding security policy rules that control traffic between the zones, the more the attack surface is reduced
* The smaller each zone is, the greater control you have over the traffic that access each zone.
* Malware have more difficulty moving laterally between zones.
### Network Interfaces and security zones
* Firewall models include **in-band** interfaces that are used to control network traffic flowing across an enterprise
* Each interface is assigned to a single zone, but each firewall interface/zone can support can include multiple logical logical interfaces called subinterfaces
* Subinterfaces can be used to support VLANs
#### Interface Types and Zone Types
There are numerous method to integrate Palo Alto Networks firewall into the environment.
PAN-OS has different zone types and interface types, that can be used simultaneously on the same firewall if used on different firewall interfaces.
Different zone types support only specific interface types:
1. Tap Zone\
\- For tap interfaces
2. Layer 2 Zone\
\- For Layer 2 interfaces
3. Tunnel Zone\
\- No interfaces assigned\
\- :star: Used for tunnel content inspection, specifically for scenarios involving tunnel-in-tunnel encapsulation.
4. Virtual Wire Zone\
\- Virtual wire interfaces
5. Layer 3 Zone\
\- Layer 3 interfaces\
\- VLAN interfaces\
\- Loopback interfaces\
\- Tunnel interfaces
{% hint style="info" %}
MGT and HA interfaces are not assigned to a zone.\
\
HA interfaces are used for synchronization of a pair of firewalls deployed in a high availability configuration. They do not control normal network traffic, as such are not placed in a security zone.\
\
MGT interfaces are used only for firewall management and is not assigned to a zone.
{% endhint %}
* Zones are case-sensitive
* Interfaces must be of the appropriate zone to be assigned to a zone
* Interfaces not assigned to a zone do not process traffic.
{% hint style="info" %}
Sixth zone type - External is a zone that allows traffic to pass between virtual systems when multiple virtual systems are configurated on the same firewall.\
\
:pray: Only some firewall models support virtual systems though...
{% endhint %}
### Interfaces Type
1. Tap\
\- Firewall can use a tap interface to connect to a switch's SPAN or mirror port. \
\- Once connected to the switch, a tap interface passively collects, and logs monitored traffic\
\- Tap mode deployment is often used to initially discover the types of applications and user traffic flowing across a network\
\- Usually used for evaluation and audit of existing networks\
\- :white\_check\_mark: No changes to the existing network design\
\- :x: Firewall cannot block any traffic
2. Virtual Wire\
\- Typically used when no switching or routing is required\
\- Firewall can be inserted into an existing topology without requiring any re-allocation of network addresses/redesign on the network topology using virtual wire\
\- All firewall shipped from the factory have Ethernet ports 1 and 2 preconfigured as virtual wire interfaces\
\- The virtual wire object provides the data path between the two virtual wire interfaces\
\- :white\_check\_mark: Protection and decryption features of the devices can all be used (App-ID, Content-ID,User-ID, and SSL decryption)\
\- NAT functionality is provided in this mode
3. Layer 3\
\- Firewall can replace any current firewall deployment.\
\- All virtual wire mode capabilities with the addition of Layer 3 services - virtual routers, VPN and routing protocols.
{% hint style="info" %}
Firewall can be mixed and matched with the interface types on a single device.\
\
Eg. Firewall can be deployed in a tap mode for one portion, and a virtual wire/Layer 3 in another
{% endhint %}
### Virtual Routers and Layer 3 Interfaces
A function of the firewall that participates in Layer 3 routing.
* Firewall uses virtual routers to obtain routes to other subnets by manually defining static routes or through dynamic routes
* BGP v4, OSPF v2 and v3, RIP v2
* Support multicast routing
* PIM-SM (sparse mode)
* PIM-SSM (source specific multicast)
#### Multiple Static Default Routes
* Static default routes can be configured
* Route with the lowest metric is used when there are two or more routes to the same destination
* Path monitoring is used by a firewall to determine whether a static route is functioning
* Firewall will switch the default route during path failure
### đź’€Confused as I am? Here's more Resources that explain what's going on!
{% embed url="" %}
{% embed url="" %}
On Tap Interface
{% endembed %}