In this section, we'll take a look at some of the terms used during the configuration of a Zone-Based Firewall (ZBF) and their meaning. Even though there aren't too many, the following are new for this chapter:

• Zones: A zone is a security segment on a network. Each active interface on a firewall must be assigned to a security zone, such as Inside for the private local area network, Outside for any foreign network such as the internet, and DMZ for allowing traffic originating from an untrusted source to access devices on the internal network. As mentioned previously, the DMZ is a semi-trusted zone.
• Zone pairs: A zone pair is any two security zones that are paired together in a particular direction. If we want to monitor traffic originating from the Inside zone going to the Outside zone, we can simply create a zone pair named in-to-out that will be used to monitor the unidirectional flow of traffic. Each zone pair consists of a source of the traffic, the destination of the traffic, and a policy. The traffic policy is applied on the zone pair and not the interfaces when using a Zone based firewall.
• Self Zone: The self zone is the actual router device. Please note this particular zone is separate from the others and can define with policies as well.