CCNA Security online course

Filtering and zones

How classic ACLs and zone-based policy both enforce a boundary.

An interface ACL is a blunt instrument: packets match a list or they do not. Zone-based policy groups interfaces into zones (inside, outside, dmz) and applies a policy-map to the zone pair. The idea is the same — default deny, explicit allow — with better structure once you have more than two interfaces.

Start by writing the intent in English: “users may reach HTTPS on the web VLAN; the web VLAN may not start sessions into users.” Then translate. Test with a host that should work and a host that should fail.