Security zone commands -- display security-zone

Use display security-zone to display security zone information.

Syntax

display security-zone [ name zone-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

name zone-name: Specifies the security zone name, a case-insensitive string of 1 to 31 characters. If you do not specify this option, the command displays all security zones, including system-defined and user-defined security zones.

Usage guidelines

When displaying all security zones, the command uses the following order:

1. System-defined security zones.

2. User-defined security zones in alphabetical order of security zone names.

Examples

# Display information about security zone myZone.

<Sysname> display security-zone name myZone

Name: myZone

Members:

Service path 2

Service path 2 reversed

GigabitEthernet1/0/3

GigabitEthernet1/0/4

GigabitEthernet1/1/1 in VLAN 3

GigabitEthernet1/1/5 in VLAN 7

# Display information about security zone myZone.

<Sysname> display security-zone name myZone

Name: myZone

Members:

GigabitEthernet1/1/1

GigabitEthernet1/1/2

VLAN 150-200

# Display information about security zone IPZone.

<Sysname> display security-zone name IPZone

Name: IPZone

Members:

192.168.1.0 255.255.255.0

192.168.0.0 255.255.0.0 vpn-instance abc

1001:1002::0 32

Table 1 Command output

Field | Description
Name | Security zone name.
Members | Members in the security zone: · Type and number of a Layer 3 interface. · Type and number of a Layer 2 Ethernet interface, and IDs of the VLANs to which the interface belongs. · VLAN IDs. · Address and mask (or mask length) of an IPv4 subnet on the public network. · Address and prefix length of an IPv6 subnet on the public network. · Address, mask (or mask length), and VPN instance name of an IPv4 subnet on a VPN. · Address, prefix length, and VPN instance name of an IPv6 subnet on a VPN. · Service chain ID. · Service chain ID with the reversed flag. · None. If a security zone does not have any members, this field displays None.

Security zone commands -- display zone-pair security

Use display zone-pair security to display all zone pairs.

Syntax

display zone-pair security

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Examples

# Display all zone pairs.

<Sysname> display zone-pair security

Source zone Destination zone

DMZ Local

Trust Local

Security zone commands -- import interface

Use import interface to add Layer 3 interfaces to a security zone, including Layer 3 Ethernet interfaces, Layer 3 Ethernet subinterfaces, and other types of Layer 3 logical interfaces.

Use undo import interface to remove Layer 3 interfaces from a security zone.

Syntax

import interface layer3-interface-type layer3-interface-number

undo import interface layer3-interface-type layer3-interface-number

Default

A security zone does not have any Layer 3 interface members.

Views

Security zone view

Predefined user roles

network-admin

mdc-admin

Parameters

interface layer3-interface-type layer3-interface-number: Specifies a Layer 3 interface by its type and number.

Usage guidelines

You cannot add any members to the system-defined security zone Local. You can add members to the other system-defined security zones.

To add multiple Layer 3 interfaces to a security zone, execute this command multiple times.

A Layer 3 interface can belong to only one security zone. To move a Layer 3 interface from one security zone to another security zone, perform the following tasks:

· Use the undo import interface command to remove the interface from the current security zone.

· Use the import interface command to add the interface to the new security zone.

Examples

# Add Layer 3 Ethernet interface GigabitEthernet 1/0/1 to security zone Trust.

<Sysname> system-view

[Sysname] security-zone name trust

[Sysname-security-zone-trust] import interface gigabitethernet 1/0/1

Security zone commands -- import interface vlan

| NOTE: Support for this command depends on the device model.

Use import interface vlan to add Layer 2 interface-VLAN combinations to a security zone.

Use undo import interface vlan to remove Layer 2 interface-VLAN combinations from a security zone .

Syntax

import interface layer2-interface-type layer2-interface-number vlan vlan-list

undo import interface layer2-interface-type layer2-interface-number vlan vlan-list

Default

A security zone does not have any Layer 2 interface-VLAN combination members.

Views

Security zone view

Predefined user roles

network-admin

mdc-admin

Parameters

interface layer2-interface-type layer2-interface-number: Specifies a Layer2 interface by its type and number.

vlan vlan-list: Specifies a list of VLANs. The vlan-list argument must be a space-separated list of up to 10 VLAN items that meet the following requirements:

· Each item specifies a VLAN by its ID or a range of VLANs in the form of start-VLAN-ID to end-VLAN-ID. The end-VLAN-ID is greater than the start-VLAN-ID.

· The VLAN IDs are in the range of 1 to 4094.

· The VLANs already exist.

Usage guidelines

You cannot add any members to the system-defined security zone Local. You can add members to the other system-defined security zones.

To add multiple Layer 2 Ethernet interface-VLAN combinations to a security zone, execute this command multiple times.

A Layer 2 interface-VLAN combination can belong to only one security zone. To move a Layer 2 interface-VLAN combination from one security zone to another security zone, perform the following tasks:

· Use the undo import interface vlan command to remove the combination from the current security zone.

· Use the import interface vlan command to add the combination to the new security zone.

Examples

# Add the combination of Layer 2 Ethernet interface GigabitEthernet 1/0/1 and VLAN 10 to security zone Untrust.

<Sysname> system-view

[Sysname] security-zone name untrust

[Sysname-security-zone-untrust] import interface gigabitethernet1/0/1 vlan 10

Security zone commands -- import ip

| NOTE: Support for this command depends on the device model.

Use import ip to add an IPv4 subnet to a security zone.

Use undo import ip to remove an IPv4 subnet from a security zone.

Syntax

import ip ip-address { mask-length | mask } [ vpn-instance vpn-instance-name ]

undo import ip ip-address { mask-length | mask } [ vpn-instance vpn-instance-name ]

Default

A security zone does not have any IPv4 subnet members.

Views

Security zone view

Predefined user roles

network-admin

mdc-admin

Parameters

ip-address: Specifies an IPv4 subnet by its subnet address or a host address on the subnet.

mask-length: Specifies the mask length in the range of 0 to 32.

mask: Specifies the subnet mask in dotted decimal notation.

vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the subnet belongs. The vpn-instance-name argument represents the VPN instance name, a case-sensitive string of 1 to 31 characters. If the subnet resides on the public network, do not specify this option.

Usage guidelines

You cannot add any members to the system-defined security zone Local. You can add members to the other system-defined security zones.

To add multiple IPv4 subnets to a security zone, execute this command multiple times.

A subnet can be added to only one security zone.

If one subnet includes another subnet, the system identifies them as different subnets. You can add them to the same security zone or different security zones. If you add them to different security zones, packets that match both subnets are identified as packets of the security zone to which the smaller subnet belongs. For example, you can assign 1.1.1.1/24 and 1.1.2.2/16 to different security zones. A packet with the IP address 1.1.1.3 is identified as a packet of the security zone to which 1.1.1.1/24 belongs.

For a dynamic routing protocol to operate correctly, add the multicast and broadcast addresses used by the protocol to security zones as needed.

Examples

# Add the 192.168.1.0/24 subnet to security zone a.

<Sysname> system-view

[Sysname] security-zone name a

[Sysname-security-zone-a] import ip 192.168.1.0 24

# Add the subnet that is identified by the address 192.168.2.1 and mask 255.255.255.0 to security zone a.

<Sysname> system-view

[Sysname] security-zone name a

[Sysname-security-zone-a] import ip 192.168.2.1 255.255.255.0

# Add the subnet that is identified by the address 192.168.2.1 and mask 255.255.255.0 on VPN abc to the security zone a.

<Sysname> system-view

[Sysname] security-zone name a

[Sysname-security-zone-a] import ip 192.168.2.1 255.255.255.0 vpn-instance abc

Security zone commands -- import ipv6

| NOTE: Support for this command depends on the device model.

Use import ipv6 to add an IPv6 subnet to a security zone.

Use undo import ipv6 to remove an IPv6 subnet from a security zone.

Syntax

import ipv6 ipv6-address prefix-length [ vpn-instance vpn-instance-name ]

undo import ipv6 ipv6-address prefix-length [ vpn-instance vpn-instance-name ]

Default

A security zone does not have any IPv6 subnet members.

Views

Security zone view

Predefined user roles

network-admin

mdc-admin

Parameters

ip-address: Specifies an IPv6 subnet by its subnet address or a host address on the subnet.

prefix-length: Specifies the prefix length in the range of 1 to 128.

vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the subnet belongs. The vpn-instance-name argument represents the VPN instance name, a case-sensitive string of 1 to 31 characters. If the subnet resides on the public network, do not specify this option.

Usage guidelines

You cannot add any members to the system-defined security zone Local. You can add members to the other system-defined security zones.

To add multiple IPv6 subnets to a security zone, execute this command multiple times.

A subnet can be added to only one security zone.

If one subnet includes another subnet, the system identifies them as different subnets. You can add them to the same security zone or different security zones. If you add them to different security zones, packets that match both subnets are identified as packets of the security zone to which the smaller subnet belongs. For example, you can assign 1:1:1::0/48 and 1:1:1::0/32 to different security zones. A packet with the address 1:1:1::2 is identified as a packet of the security zone to which 1:1:1::0/48 belongs.

Examples

# Add IPv6 subnet 1001:1002::0/32 (on the public network) to security zone a.

<Sysname> system-view

[Sysname] security-zone name a

[Sysname-security-zone-a] import ipv6 1001:1002::1 32

# Add IPv6 subnet 1001:1002::0/32 (on VPN abc) to security zone a.

<Sysname> system-view

[Sysname] security-zone name a

[Sysname-security-zone-a] import ipv6 1001:1002::1 32 vpn-instance abc

Security zone commands -- import service-chain path

| NOTE: Support for this command depends on the device model.

Use import service-chain path to add a service chain to a security zone.

Use undo import service-chain path to remove a service chain from a security zone.

Syntax

import service-chain path path-id [ reversed ]

undo Import service-chain path path-id [ reversed ]

Default

A security zone does not have any service chain members.

Views

Security zone view

Predefined user roles

network-admin

mdc-admin

Parameters

path-id: Specifies a service chain by its ID. The value range is 1 to 8388606.

reversed: Matches the backward traffic. If you do not specify this keyword, the service chain matches the forward traffic.

Usage guidelines

You cannot add any members to the system-defined security zone Local. You can add members to the other system-defined security zones.

To add multiple service chains to a security zone, execute this command multiple times.

A service chain can be added to only one security zone.

For more information about service chains, see Service Chain Configuration Guide.

Examples

# Add service chain 100 to security zone zonetest.

<Sysname> system

[Sysname] security-zone name zonetest

[Sysname-security-zone-zonetest] import service-chain path 100

Related commands

display service-chain path (Service Chain Command Reference)

service-chain path (Service Chain Command Reference)

Security zone commands -- import vlan

| NOTE: Support for this command depends on the device model.

Use import vlan to add VLANs to a security zone.

Use undo import vlan to remove VLANs from a security zone.

Syntax

import vlan vlan-list

undo import vlan vlan-list

Default

A security zone does not have any VLAN members.

Views

Security zone view

Predefined user roles

network-admin

mdc-admin

Parameters

vlan vlan-list: Specifies a list of VLANs. The vlan-list argument must be a space-separated list of up to 10 VLAN items that meet the following requirements:

· Each item specifies a VLAN by its ID or a range of VLANs in the form of start-VLAN-ID to end-VLAN-ID. The end-VLAN-ID is greater than the start-VLAN-ID.

· The VLAN IDs are in the range of 1 to 4094.

· The VLANs already exist.

Usage guidelines

You cannot add any members to system-defined security zone Local. You can add members to the other system-defined security zones.

To add multiple VLANs to a security zone, specify multiple VLANs for this command or execute this command multiple times.

A VLAN can belong to only one security zone. To move a VLAN from one security zone to another security zone, perform the following tasks:

· Use the undo import vlan command to remove the VLAN from the current security zone.

· Use the import vlan command to add the VLAN to the new security zone.

This command requires the cooperation of inter-VLAN bridge forwarding. After adding VLANs to a security zone, you must create an inter-VLAN bridge instance and add the VLANs to the bridge instance. For more information, see Layer 2 forwarding configuration in Layer 2—LAN Switching Configuration Guide.

Examples

# Add VLAN 3, and VLAN 5 through VLAN 7 to security zone trust.

<Sysname> system-view

[Sysname] security-zone name trust

[Sysname-security-zone-trust] import vlan 3 5 to 7

Security zone commands -- security-zone

Use security-zone to create a security zone and enter its view, or enter the view of an existing security zone.

Use undo security-zone to delete a security zone.

Syntax

security-zone name zone-name

undo security-zone name zone-name

Default

The default varies by device model.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

name zone-name: Specifies the security zone name, a case-insensitive string of 1 to 31 characters. It cannot be any or contain hyphens (-) or percentage signs (%).

Usage guidelines

The device provides the following system-defined security zones: Any, Local, Trust, DMZ, Management, and Untrust. These security zones are created automatically by the system when one of following events occurs:

· The first command for creating a security zone is executed.

· The first command for creating an object policy is executed.

System-defined security zones cannot be deleted.

You can use this command multiple times to create multiple security zones.

A security zone must have a unique name on the MDC to which it belongs. Two security zones that belong to different MDCs can use the same name.

Deleting a security zone also deletes the following items:

· All zone pairs that use the security zone as the source or destination security zone.

· All object policy applications on the zone pairs.

Examples

# Create a security zone named zonetest and enter security zone view.

<Sysname> system-view

[Sysname] security-zone name zonetest

[Sysname-security-zone-zonetest]

Related commands

display security-zone

import

Security zone commands -- security-zone intra-zone default permit

| NOTE: Support for this command depends on the device model.

Use security-zone intra-zone default permit to set the default action to permit for packets exchanged between interfaces in the same security zone.

Use undo security-zone intra-zone default permit to restore the default.

Syntax

security-zone intra-zone default permit

undo security-zone intra-zone default permit

Default

The default action is deny for packets exchanged between interfaces in the same security zone.

Views

System view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

The default action is used when no zone pair is configured from the security zone to the security zone itself.

Examples

# Set the default action to permit for packets exchanged between interfaces in the same security zone.

<Sysname> system-view

[Sysname] security-zone intra-zone default permit

Security zone commands -- zone-pair security

Use zone-pair security to create a zone pair and enter its view, or enter the view of an existing zone pair.

Use undo zone-pair security to delete a zone pair.

Syntax

zone-pair security source { source-zone-name | any } destination { destination-zone-name | any }

undo zone-pair security source { source-zone-name | any } destination { destination-zone-name | any }

Default

The default varies by device model.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

source source-zone-name: Specifies the name of the source security zone, a case-insensitive string of 1 to 31 characters. This security zone must already exist.

destination destination-zone-name: Specifies the name of the destination security zone, a case-insensitive string of 1 to 31 characters. This security zone must already exist.

any: Specifies any security zone.

Usage guidelines

A zone pair defines a source security zone and a destination security zone. After you apply security policies to zone pairs, the device performs the following operations:

· Examines received first data packets.

· Identifies and processes data flows based on security policies.

Security policies include ACLs, ASPF policies, and object policies. For more information about ASPF and object policies, see Security Configuration Guide.

Deleting a zone pair deletes all object policy applications on the zone pair.

Examples

# Create a zone pair with the source security zone Trust and destination zone Untrust.

<Sysname> system-view

[Sysname] zone-pair security source trust destination untrust

[Sysname-zone-pair-security-Trust-Untrust]

Related commands

display zone-pair security