Patent ID: 9021547
Filing Date: 2015-04-28
Classification: H04L

Abstract:
1. A method comprising: receiving packets on a plurality of interfaces of a security device, wherein the interfaces include one or more layer two (L2) interfaces and one or more layer three (L3) interfaces; configuring L2 security zones associated with one or more of the L2 interfaces of the security device, wherein the L2 interfaces comprise one or more L2 bridge domains within the security device; configuring L3 security zones associated with one or more of the L3 interfaces of the security device, wherein the L3 interfaces are associated with at least one L3 routing instance within the security device; and based on the security zones associated with an incoming interface and an outgoing interface for each of the packets, providing zone-based security within the security device when forwarding the packets directly between two of the L2 interfaces of a same one of the L2 bridge domains, when forwarding the packets between two of the L2 interfaces of different ones of the L2 bridge domains, when forwarding the packets between one of the L2 interfaces of one of the L2 bridge domains and one of the L3 interfaces of the L3 routing instance, and when forwarding the packets between two of the L3 interfaces of the L3 routing instance.