The Zscaler service provides integrated cloud-based next-generation firewall capabilities that allow granular control over your organization’s outbound TCP, UDP, and ICMP traffic.

You can configure the following firewall policies:

• Firewall Filtering Policy: Add rules to allow or block specified types of traffic from your network to the internet. You can also specify how the sessions are logged.
• NAT Control Policy: Add rules to perform destination NAT. You can redirect traffic to specific IP addresses or ports.
• DNS Control Policy: Add rules to allow or block DNS requests, redirect requests to a different DNS server, or redirect DNS responses by substituting the IP address in a DNS response with a preconfigured IP address.
• IPS Control Policy: Add rules to control and protect your traffic from intrusion over all ports and protocols using signature-based detection.

Configuring Firewall Policies requires configuring the four policies above as applicable and enabling the firewall for your locations. You might also need to create source and destination IP groups, modify network services, create network application groups, and configure custom ports.

Configuring a firewall policy also requires the following:

• An organization must forward its IP traffic from a known location.
• If your organization wants to apply firewall policies at the user level, user authentication and surrogate IP must be enabled. Otherwise, the Zscaler firewall service applies organization and location policies.

Standard and Advanced Cloud Firewall

The following table lists the features and functionalities offered by Standard and Advanced Cloud Firewall subscriptions: