A zone – or security zone – is a Versa construct that groups network interfaces and networks sharing the same security requirements into a single named object. Zones serve as source and destination match criteria in SD-WAN, access-control, and TLS-decryption policy rules, and can carry an optional zone protection profile that screens incoming traffic for floods, scans, and malicious packets.
Key takeaways
- A zone groups interfaces and networks that share security requirements.
- Zones match traffic in SD-WAN, access-control, and TLS-decryption rules.
- A single tenant can configure up to 1024 zones for its policies.
- An optional zone protection profile guards against floods and scans.
- Inter-zone traffic is denied by default; intra-zone traffic is allowed.
On this page: Why it mattersHow it worksTypesZones & VersaFAQ
Why are zones important?
Without zones, every policy rule would need to enumerate individual interfaces, and every new site or Wi-Fi hotspot would mean rewriting rules across the board. Grouping interfaces that share a security posture into a zone means the policy stays put – a floor of access points or a set of WAN links can grow or shrink without touching a single rule that references the zone by name.
Zones are also the boundary Versa’s next-generation firewall reasons about by default. When NGFW rules are enabled without explicit configuration, traffic between two different zones is denied and traffic within the same zone is allowed – an implicit-deny posture that forces administrators to consciously open inter-zone paths rather than leaving them exposed. That default, paired with per-zone protection profiles, is what lets a design separate trusted internal segments from untrusted ones with a manageable number of rules instead of one rule per interface pair.
What is a zone?
A zone is a named grouping of one or more interfaces, networks, routing instances, or organizations that share identical security requirements. Zones are configured per tenant, and a tenant can define up to 1024 of them; because tenants are isolated from each other, two different tenants can reuse the same zone name without conflict. Each zone can optionally reference a single zone protection profile and a logging profile for exporting alarms.
A zone is distinct from a network, the VOS object that groups similar interfaces on similar routing instances so they can be managed together – a zone is the security-policy grouping built on top of networks and interfaces, not a routing construct. Zones are configured in Director under Configuration > Networking > Zones; the Configure Zones and Zone Protection Profiles guide covers the field-by-field workflow.
Types of zones
Every VOS device ships with several system-generated zones – host, ptvi, remote-client, versa-fileexport, and versa-speedtest – which should never be edited directly, since they back internal system functions rather than administrator-defined segments.
Beyond those, administrators create user-defined zones for any grouping their policy needs: a zone for LAN interfaces, one for internet-facing WAN interfaces, or one per building floor. A common pattern layers a trusted/untrusted role onto these zones – placing a zone protection profile between an untrusted zone (internet-facing) and a trusted zone (internal), then adding a firewall rule with the untrusted zone as source and the trusted zone as destination. This split is a design convention built from ordinary zones and profiles, not a separate zone type.
Zones & Versa
Zones are match criteria across three policy surfaces: SD-WAN policy rules can match on source zone and destination zone (alongside addresses, sites, and Layer 4/7 criteria), NGFW access-control rules use inter-zone and intra-zone matching to decide what’s implicitly denied, and TLS-decryption policy can key on zone as well.
A zone protection profile, configured under Networking > Zone Protection Profiles, applies only to the first packet of a new flow and covers four areas: Flood (per-protocol pps thresholds for TCP, UDP, ICMP, and others, with alarm, active, and maximum rate tiers), Scan (host-sweep, TCP, and UDP reconnaissance detection), Packet-Based Attack Protection (discard options like IP spoofing and fragment handling), and ICMP-specific checks. A zone accepts one profile at a time; the Configure Zones and Zone Protection Profiles (NGFW) guide walks through every tab. Matching events surface in Versa Analytics under Logs > Threat Detection > DoS Threat Logs.
Frequently asked questions
What is the difference between a zone and a network in Versa?
A network groups similar interfaces on similar routing instances for management; an interface belongs to exactly one network. A zone is a security-policy grouping – interfaces, networks, routing instances, or organizations – used as match criteria in policy rules.
How many zones can be configured per tenant?
Up to 1024 zones per tenant. Because tenants are isolated from each other on a shared VOS device, zone names only need to be unique within a tenant, not across the whole system.
What happens to traffic between zones by default?
When NGFW is enabled without explicit rules, inter-zone traffic is blocked by an implicit deny rule, while intra-zone traffic (within the same zone) is allowed. Blocking intra-zone traffic requires an explicit rule matching that zone as both source and destination.
What is a zone protection profile?
An optional profile attached to a zone that inspects the first packet of each new flow for traffic floods, port scans and host sweeps, and malformed or spoofed packets, applying configurable thresholds and drop actions before the traffic reaches the network.
Can the system-generated zones be edited?
No. Zones such as host, ptvi, remote-client, versa-fileexport, and versa-speedtest back internal system functions and should not be selected for editing; administrator-defined zones are created separately for policy use.
More on zones and network segmentation
If you want to learn more, these are sources we trust.
| NIST SP 800-41: Guidelines on Firewalls and Firewall Policy | Cloud Security Alliance research |
|---|---|
| Federal guidance on firewall placement and zone-based policy design, including trusted/untrusted segmentation. | Vendor-neutral guidance on segmentation and traffic isolation in cloud and hybrid environments. |
Related terms
If you’re reading about zones, these are worth looking at next.
| Network | SD-WAN | Random Early Drop |
|---|---|---|
| The VOS object that groups interfaces on shared routing instances; zones are built from networks and interfaces. | The policy layer where source and destination zones are common match criteria for traffic steering rules. | The probabilistic-drop action used in zone-protection flood settings once a configured packet rate is exceeded. |