Zone Pair Security

Zone-pair security is the central component of Zone-Based Firewall (ZBF) that binds a source zone to a destination zone and defines the traffic policy between them. A zone-pair references two previously defined security zones and optionally attaches an inspect-type policy-map via service-policy type inspect to activate stateful traffic inspection.

The self zone is a built-in IOS-XE security zone that represents traffic originated by or destined to the router itself (control-plane and management traffic). It does not need to be declared under zone_security.zones. A zone-pair where source: self governs router-originated traffic (e.g., outbound SSH/SNMP/NTP), while destination: self governs traffic terminating on the router (e.g., inbound management).

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
zone_pair_security	List	[zone_pair_security]	No

zone_pair_security (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
source	String		Yes
destination	String		Yes
description	String		No
service_policy_type_inspect	String		No

Sample Configuration

The following CLI shows zone-pair security configurations on IOS-XE devices.

zone-pair security ZP_IN_OUT source INSIDE destination OUTSIDE
 description Inside to outside traffic policy
 service-policy type inspect PM_IN_TO_OUT
!
zone-pair security ZP_OUT_IN source OUTSIDE destination INSIDE
 description Outside to inside traffic policy
 service-policy type inspect PM_OUT_TO_IN
!
zone-pair security ZP_SELF_OUT source self destination OUTSIDE
 description Router-generated traffic toward OUTSIDE

Example YAML Code

iosxe:
  devices:
    - name: Device1
      configuration:
        zone_pair_security:
          - name: ZP_IN_OUT
            source: INSIDE
            destination: OUTSIDE
            description: Inside to outside traffic policy
            service_policy_type_inspect: PM_IN_TO_OUT
          - name: ZP_OUT_IN
            source: OUTSIDE
            destination: INSIDE
            description: Outside to inside traffic policy
            service_policy_type_inspect: PM_OUT_TO_IN
          - name: ZP_SELF_OUT
            source: self
            destination: OUTSIDE
            description: Router-generated traffic toward OUTSIDE