Not to derail the thread, so just to answer this. I will share it. I'm switching to zone based security away from so many policies. When zoning, the perspective of the actual components, users, and threats dictates a given device’s zoning requirements and what zone those devices are placed in. Theoretically perspective actually defines the security posture.
Network zoning is a traditional method, used for decades which went by the wayside in favor of policy based and VLAN networking. I'm bringing Zoning back because it has many advantages and has decades of proven track record. VLAN tagging means that data is still over the same wire (and yes, they can be intruded upon under some conditions), just that the tag is ignored or recognized if it is needed. Zoning means it's isolated at the physical hardware level and bundled up behind security necessary for each zone. This is a 'trust barrier' ensuring I can move devices in and out of various zones as needed depending on their threat surface. An attacker coming in on an untrusted (DMZ) zone would have no facilities to attack. An attacker coming in on a semi-untrusted zone such as WAN1 might have slightly more attack vectors, but largely be limited to non-user space firewall/UTM, and specific ports/protocols permitted in that zone. Someone in the green zone may have unfettered access to the network, but that will likely be a hardened system running something like Secured Debian.
You get the idea.
