Yes, another Zones question

[bmduncan34]

I have 52 interface pairs in my IPv4 policies and it's unwieldy.  I'm drafting a plan to build zones to make it more manageable.  I've seen where some admins recommend three zones; Inside, Outside and DMZ; and I've seen just two zones - Inside and Outside, where the DMZ interface was included in the Inside zone.  Following this logic couldn't I just build a single zone and put all interfaces in there?  Then all policies would roll up into the one Zone to Zone pair.  One answer I may guess would be "yes, you can do that but a little more structure will make it more intuitive".  Any comments, or best-practice recommendations or considerations?

BTW, I do know I'll have to delete all policies that reference any interface before I can move that interface into a zone.  So this isn't a trivial amount of work...

Thanks in advance.

[emnoc]

A zone is a just a zone , and I'm like 99.99% sure you can't set a named "zone"  in a SD_WAN member, so this question is moot. Also for bandwidth you can control that within SDWAN with traffic policies

You need to decide if you want SD_WAN? If not and you later decide you want SD_WAN you will have a lot of re-work in order to get to SD_WAN.

Ken Felix

[MikePruett]

SD-WAN works. Zones are incredibly useful. If you wanted to use Zones instead of SD-WAN for your outside interfaces you can. It is not as robust though as the SD-WAN capability and you are going to be doing a lot of policy routes and custom link monitors whereas you could just configure SD WAN Rules and Health Checks and have a lot more visibility from the GUI etc.

Simple environments are great for zones. Especially if you have multiple inside interfaces and multiple outsides. I'm a big fan of INSIDE, OUTSIDE, and IPSEC for relatively simple setups. It keeps it simple from an engineering standpoint. Now, I have a state agency that manages all other state agencies. They have hundreds of interfaces. We use zones for this as well but they are created based on sub-agency,interface classifications, services, etc. It helps us streamline things and keep policy counts lower and easier to manage but it can get just as cumbersome if not thought out properly.