Supporting zone-based policy enforcement for a firewall connected to a one-arm load balancer

One or more non-transitory machine-readable media having instructions stored thereon, the instructions comprising program code to:

• detect a packet corresponding to a first session on a first interface of a firewall comprising the first interface and a second interface, wherein the first and second interfaces are assigned to different zones;
• determine a destination zone of the packet based on a destination address identified in an inner header of the packet exposed from decapsulation of the packet;
• determine whether the packet is traveling within a same zone or between different zones based on the destination zone of the packet;
• based on a determination that the packet is traveling within the same zone, egress the packet on the first interface and communicate subsequent packets of the first session according to a first mode of firewall deployment;
• and
• based on a determination that the packet is traveling between different zones, egress the packet on the second interface and communicate subsequent packets of the first session according to a second mode of firewall deployment, wherein the second mode of firewall deployment differs from the first mode of firewall deployment.

An apparatus comprising:

• a processor;
• and
• a computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
• detect a packet corresponding to a first session on a first interface of a firewall comprising the first interface and a second interface, wherein the first and second interfaces are assigned to different zones;
• determine a destination zone of the packet based on a destination address identified in an inner header of the packet exposed based on decapsulation of the packet;
• determine if the destination zone is the same as a source zone of the packet;
• based on a determination that the source and destination zones are the same, egress the packet on the first interface and associate an indication of a first mode of firewall deployment with the first session;
• based on a determination that the source and destination zones are different, egress the packet on the second interface and associate an indication of a second mode of firewall deployment with the first session;
• and
• communicate subsequent packets of the first session according to a mode of firewall deployment associated with the first session, wherein the mode of firewall deployment comprises the first or second mode of firewall deployment.