Security Zone

Configure Security Zone.

Notes

• Each Security Zone must have either vpns or interfaces configured, but not both.
• VPN names must reference existing LAN VPNs defined in service_profiles.lan_vpns.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
feature_profiles	Class	feature_profiles	No

feature_profiles (sdwan)

Name	Type	Constraint	Mandatory	Default Value
policy_object_profile	Class	policy_object_profile	No

policy_object_profile (sdwan.feature_profiles)

Name	Type	Constraint	Mandatory	Default Value
security_zones	List	security_zones	No

security_zones (sdwan.feature_profiles.policy_object_profile)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,32}$	Yes
vpns	List	String[Regex: ^[^&<>! "]{1,128}$]	No
interfaces	List	String[Regex: (ATM|ATM-ACR|AppGigabitEthernet|AppNav-Compress|AppNav-UnCompress|Async|BD-VIF|BDI|CEM|CEM-ACR|Cellular|Dialer|Embedded-Service-Engine|Ethernet|Ethernet-Internal|FastEthernet|FiftyGigabitEthernet|FiveGigabitEthernet|FortyGigabitEthernet|FourHundredGigE|GMPLS|GigabitEthernet|Group-Async|HundredGigE|L2LISP|LISP|Loopback|MFR|Multilink|Port-channel|SM|Serial|Service-Engine|TenGigabitEthernet|Tunnel|TwentyFiveGigE|TwentyFiveGigabitEthernet|TwoGigabitEthernet|TwoHundredGigE|Vif|Virtual-PPP|Virtual-Template|VirtualPortGroup|Vlan|Wlan-GigabitEthernet|nat64|nat66|ntp|nve|ospfv3|overlay|pseudowire|ucse|vasileft|vasiright|vmi)(\w+)((\/\d+)*(\.\d+)?)?]	No

Examples

Example-1: This example demonstrates how to configure a Security Zone with VPNs.

sdwan:
  feature_profiles:
    policy_object_profile:
      security_zones:
        - name: security_zone1
          vpns:
            - service_lan_vpn1
            - service_lan_vpn2

Example-2: This example demonstrates how to configure a Security Zone with Interfaces.

sdwan:
  feature_profiles:
    policy_object_profile:
      security_zones:
        - name: security_zone2
          interfaces:
            - GigabitEthernet1
            - GigabitEthernet2