# Network zones

## Network zones

Besides the internal and external zones, you can define your own **network zones**, for example a branch office, a partner's network or a list of countries, and give each one its own authentication level.

### Defining zones

Zones are defined on **Security settings** / **General** / **Network zones** (up to 64 zones). Each zone has:

- **Name**: shown in the access rules
- **Matches on**:
  - **IP addresses**: one address, range or CIDR block per line
  - **Country**: one or more countries, found from the user's IP address
- **Default authentication level for users**: the level the zone applies when an access rule uses **Default** for it. **Same as external zone** uses the external zone's default level.
- **Authentication level for Trustelem admin console**: the level administrators need to sign in to the admin console from this zone

**Which zone applies:**

1. The **internal network** always wins: an address in the internal network is in the internal zone, even if a network zone also matches it
2. Otherwise the network zones are checked from top to bottom and **the first matching zone wins**: use the arrows to change their priority
3. If no zone matches, or the origin of the connection can't be determined, the **external** zone applies

You can't save a zone setting that would forbid your own access to the admin console from where you are connected.

### Zone levels in access rules

Once a zone is defined, every access rule shows a line for it. **Possible values:**

- **Same as external zone**: the rule applies its **external** level to users coming from this zone. This is the value of every rule until you change it, so defining a zone changes nothing for existing rules.
- **Default**: applies the zone's **Default authentication level for users**
- **1 factor**: only one authentication factor needed
- **2 factors**: two authentication factors needed
- **Forbidden**: the user can't access the application from this zone

### Example

Company offices are in the internal network. A "Partners" zone lists the salesforce access rule for the group "Sales" is: internal -> 1 factor | external -> 2 factors | Partners -> Forbidden.

- A salesperson at the office signs in with 1 factor
- The same salesperson on a partner's network can't access salesforce
- From anywhere else, 2 factors are needed

### Renaming and deleting zones

- Renaming a zone or changing its addresses keeps the levels the access rules set for it
- Deleting a zone removes it from every access rule: users from its adds set for the zone they then fall into (usually external). Before saving, a warning tells you how many access rules set a level for the zone you are deleting.
- A new zone never takes over the levels set for a deleted zone, even w

LDAP and Radius applications do not provide the user's IP, so zones do not apply to them.