Security, Segmentation, and Policy Enforcement
Security architecture
EdgeConnect provides stateful firewall, zone-based segmentation, IPsec encryption for overlay traffic, and often next-generation firewall features such as IPS and application control on supported platforms. A zone groups interfaces and defines allowed flows; the default posture should be deny between zones unless explicitly permitted. Encryption can be enabled per overlay/tunnel, and traffic can be selectively sent unencrypted for trusted MPLS paths, which is a common exam trap: unencrypted does not mean unmonitored.
Segmentation
Segmentation (zones/VPNs/VRFs) isolates traffic such as guest, corporate, and IoT across the same physical underlay and overlay. Segmentation must be consistent end-to-end; a segment defined at the hub but missing at the spoke breaks reachability. Policy can be enforced centrally (configured in Orchestrator) but is executed at the appliance.
Policy enforcement
Policies match on source/destination zone, application, user/group, and address, then apply allow/deny/inspect and QoS. Order matters: first match wins, so broad permit rules placed above specific deny rules silently allow traffic. Direct internet breakout at branches improves SaaS performance but requires security policy at the edge, not only at the data center.
Traps and example
- Assuming all overlay traffic is encrypted by default; verify per-tunnel settings.
- Forgetting that segmentation must exist on every participating appliance.
- Placing a catch-all permit above a security rule.
Worked example: guest traffic in its own zone, denied to corporate zone, allowed to internet with IPS inspection; corporate SaaS breaks out locally with application control; voice stays on the encrypted overlay with QoS.