What is a firewall zone, and why can multiple subnets live in the same zone?

A zone is a logical grouping of interfaces or networks that share similar security requirements and trust levels. Multiple subnets can share a zone when they need the same security policy — the zone is the policy-attachment point, not a network identifier.

The official definition:

"Zonen in einer Firewall-Konfiguration sind logische Gruppierungen von Schnittstellen oder Netzen, die ähnliche Sicherheitsanforderungen und Vertrauensniveaus haben."

Why zones beat per-subnet rules:

Without zones (per-subnet rules):
  192.168.10.0/24 → 10.0.0.0/24:  allow http
  192.168.20.0/24 → 10.0.0.0/24:  allow http
  192.168.30.0/24 → 10.0.0.0/24:  allow http
  ... 50 more lines as company grows

With zones:
  Inside → DMZ:  allow http
  (any subnet you add to "Inside" inherits the rule automatically)

The Fileserver + Mitarbeiter-PCs case (a worked example):

Here the file server (192.168.100.0/24) and the employee PCs (192.168.110.0/24) are placed in the same Inside zone, even though they're different subnets. This exact case illustrates the principle — two networks with similar protection needs share a zone, so you don't write separate rule sets for each:

Zone-based vs interface-based (older model):

Older firewalls (and Cisco IOS ACLs) tied rules to interfaces. Modern zone-based firewalls (Palo Alto, Fortinet, Cisco ZBF) decouple the rule from the physical interface — you can re-cable, add interfaces, virtualize, without touching rules.

Tip: The mental shortcut: a zone is "who you are from a security standpoint." Two subnets are the same zone if they're treated as the same kind of citizen by your security policy.

Go deeper:

• Configure Interfaces and Zones (Palo Alto PAN-OS) — the canonical docs: an NGFW won't process traffic on any interface until it's bound to a security zone, and policy attaches to zones, not interfaces.