Zone Pair Security

Zone-pair security is the central component of Zone-Based Firewall (ZBF) that binds a source zone to a destination zone and defines the traffic policy between them. A zone-pair references two previously defined security zones and optionally attaches an inspect-type policy-map via service-policy type inspect to activate stateful traffic inspection.

The self zone is a built-in IOS-XE security zone that represents traffic originated by or destined to the router itself (control-plane and management traffic). It does not need to be declared under zone_security.zones. A zone-pair where source: self governs router-originated traffic (e.g., outbound SSH/SNMP/NTP), while destination: self governs traffic terminating on the router (e.g., inbound management).

Diagram

Classes

iosxe

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No

devices (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
zone_pair_security	List	zone_pair_security	No

zone_pair_security (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
source	String		Yes
destination	String		Yes
description	String		No
service_policy_type_inspect	String		No

Sample Configuration

The following CLI shows zone-pair security configurations on IOS-XE devices.

zone-pair security ZP_IN_OUT source INSIDE destination OUTSIDE
 description Inside to outside traffic policy
 service-policy type inspect PM_IN_TO_OUT
!
zone-pair security ZP_OUT_IN source OUTSIDE destination INSIDE
 description Outside to inside traffic policy
 service-policy type inspect PM_OUT_TO_IN
!
zone-pair security ZP_SELF_OUT source self destination OUTSIDE
 description Router-generated traffic toward OUTSIDE

Example YAML Code

iosxe:
  devices:
    - name: Device1
      configuration:
        zone_pair_security:
          - name: ZP_IN_OUT
            source: INSIDE
            destination: OUTSIDE
            description: Inside to outside traffic policy
            service_policy_type_inspect: PM_IN_TO_OUT
          - name: ZP_OUT_IN
            source: OUTSIDE
            destination: INSIDE
            description: Outside to inside traffic policy
            service_policy_type_inspect: PM_OUT_TO_IN
          - name: ZP_SELF_OUT
            source: self
            destination: OUTSIDE
            description: Router-generated traffic toward OUTSIDE