Enterprise Zero Trust Secure Landing Zone Reference Architecture

Overview

This reference architecture demonstrates a practical enterprise implementation approach for secure AWS and Azure landing zones using Zero Trust security principles, network segmentation, SIEM and SOAR integration, and centralised security operations.

The design showcases how organisations can modernize legacy perimeter-based security models by implementing identity-aware access controls, cloud-native security services, next-generation firewalls, and automated incident response workflows across hybrid environments.

// Zero Trust Landing Zone — Multi-Cloud Reference Architecture: AWS + Azure + On-Premises with identity control plane and policy enforcement

Palo Alto NGFW & Panorama Fortinet FortiGate & FortiManager Zscaler SSE (ZIA/ZPA) AWS Secure Landing Zone Azure Secure Landing Zone SIEM & XSOAR Integration Infrastructure as Code Zero Trust Architecture

Key Capabilities Delivered

Cloud Security & Landing Zones

AWS and Azure secure landing zone architecture
Multi-cloud network segmentation
Secure ingress and egress design
Transit Gateway and Virtual WAN integration
Private endpoint architecture
Cloud-native security telemetry integration

Zero Trust Network Architecture

Identity-aware access controls
Least privilege firewall policy design
East-west traffic segmentation
Application-level access enforcement
Continuous trust validation
Device posture-aware access

Firewall Engineering

Palo Alto NGFW perimeter and VPN zoning
FortiGate internal segmentation and edge security
Panorama and FortiManager centralised governance
Threat prevention, SSL inspection, and IPS policies
NAT and VPN policy management

SIEM & SOAR Integration

Centralised log aggregation
Firewall, cloud, and identity telemetry
SOC alert correlation workflows
XSOAR automation and playbooks
Incident response orchestration
Threat intelligence enrichment

// Enterprise secure landing zone architecture overview

Technical Design Objectives

The secure landing zone architecture was designed to support enterprise-scale cloud transformation, Zero Trust security enforcement, and operational SOC modernization across hybrid AWS, Azure, and on-premise environments. The primary objective was to establish a repeatable, security-governed architecture capable of supporting secure workload migration, centralised visibility, and automated incident response while reducing attack surface and operational risk.

Core Objectives

Remove implicit trust between all network zones

Eliminate broad flat-network VPN access

Standardize firewall governance across hybrid environments

Improve SOC visibility across hybrid infrastructure

Enable centralised SIEM and XSOAR operations

Reduce lateral movement risk through micro-segmentation

Enforce least privilege access across all identities

Implement repeatable IaC-driven cloud security patterns

Automate security operations and incident response

Support scalable enterprise cloud migration programmes

// Zero Trust design principles applied across the security domains

Zero Trust Network Segmentation

The architecture applies Zero Trust segmentation to remove implicit trust between users, workloads, cloud services, and network zones across AWS, Azure, and on-premise environments. Traffic between zones is denied by default unless explicitly authorized through policy-based controls.

Edge Security

Internet ingress and egress inspection, DDoS protection, SSL/TLS inspection, threat prevention, DNS security, and geo-blocking via Palo Alto, FortiGate, and Zscaler ZIA.

Perimeter Zones

Isolated publicly accessible services from internal tiers. Reverse proxies, WAFs, public APIs, DMZ workloads. Restricted inbound services with TLS termination and API inspection.

Application Tiers

Segmented by business criticality and environment. Micro-segmentation, security groups, App-ID-based firewall rules, Layer 7 policy enforcement.

Data Tiers

Highly restricted zones with strict least-privilege firewall rules. No direct internet or user access. Private endpoint access only. Database access monitoring and DLP integration.

Management Zones

Isolated administrative services, bastion hosts, PAM platforms, SIEM and XSOAR infrastructure. MFA, certificate auth, PAM, device posture, and time-bound admin access.

VPN Zones

Segmented by user type: corporate, privileged admin, third-party, partners, SOC analysts. Identity-aware, application-level access only. No broad network trust.

// Zero Trust network segmentation and trust zone architecture

Firewall Engineering & Connectivity

The connectivity model enforces a deny-by-default posture across all network zones and routes all trusted and untrusted traffic through designated inspection and policy enforcement points. All traffic crossing security boundaries is logged and forwarded into SIEM and XSOAR workflows.

Palo Alto Networks

Deployed as the primary perimeter inspection and VPN segmentation layer. Application-aware controls enforced using App-ID, User-ID, Device-ID, URL Filtering, DNS Security, Threat Prevention, and WildFire. Panorama provides centralised firewall governance, policy lifecycle management, and log forwarding configuration.

// Zero Trust Network Segmentation — Five security zones with deny-by-default policy between all zones and explicit allow rules

FortiGate

Deployed for enterprise edge security, internal segmentation, datacentre connectivity, SD-WAN routing, and IPSec site-to-site VPNs. FortiManager standardises policy governance and change control. FortiAnalyzer provides traffic analytics and SIEM forwarding. FortiAuthenticator handles MFA and certificate-based authentication.

AWS Connectivity

Segmented VPC architectures connected through AWS Transit Gateway for centralised routing and inspection. Public-facing workloads routed through AWS ALB, WAF inspection layers, and Palo Alto perimeter inspection. PrivateLink and VPC Endpoints remove unnecessary internet exposure. Cloud security telemetry from VPC Flow Logs, CloudTrail, GuardDuty, Security Hub, and WAF logs forwarded into centralised SIEM.

Azure Connectivity

Hub-and-spoke VNet connectivity with Azure Virtual WAN. Azure Application Gateway provides Layer 7 load balancing and WAF protection. Azure API Management secures API ingress. Private Endpoints implemented for all PaaS services, removing the need for internet-exposed management or data services.

// Firewall engineering and hybrid cloud connectivity model

Secure Remote Access & SSE

Traditional perimeter-based remote access was replaced with identity-aware, application-specific access controls. The architecture eliminates broad network-level trust and enforces continuous verification of users, devices, applications, and access context before access is granted.

Zscaler Internet Access (ZIA)

All outbound internet traffic routed through ZIA inspection nodes. Controls include secure web gateway filtering, URL categorisation, threat intelligence validation, SSL/TLS inspection, DNS security, malware sandboxing, CASB inspection, and DLP enforcement. Threat telemetry forwarded into SIEM alongside firewall, endpoint, identity, and cloud telemetry.

Zscaler Private Access (ZPA)

Zero Trust application access for internal applications across AWS, Azure, and on-premise. Applications remain non-internet routable. ZPA App Connectors deployed within AWS VPCs, Azure VNets, and datacentres broker secure outbound-only application connectivity. Third-party suppliers isolated into dedicated access groups with no lateral network access.

Device Posture and MFA

Endpoint health checks, OS validation, EDR verification, certificate validation, patch compliance, and disk encryption validation are enforced before access is granted. Non-compliant devices are blocked or redirected to remediation. Conditional access policies evaluate user identity, device trust state, geolocation, authentication risk, and threat intelligence indicators dynamically.

// Secure remote access and Secure Service Edge (SSE) architecture

SIEM & SOAR Integration

The SIEM and SOAR architecture consolidates telemetry from firewalls, VPN platforms, cloud-native security services, identity providers, endpoints, SaaS platforms, and DNS services into a centralised operational security platform supporting real-time threat detection, automated incident response, and SOC operations.

Log Aggregation

Centralised log aggregation covers network and firewall telemetry (Palo Alto, FortiGate, WildFire, VPN), cloud security telemetry (AWS CloudTrail, VPC Flow Logs, GuardDuty, Azure Defender, NSG Flow Logs), identity and access telemetry (MFA events, PAM sessions, conditional access decisions), and remote access telemetry (Zscaler ZIA and ZPA logs, DNS security events).

// SIEM and SOAR Integration Architecture — Centralised telemetry ingestion, automated playbooks, and threat intelligence enrichment

XSOAR Playbooks

Automated playbooks handle phishing response (URL extraction, threat intelligence lookups, domain blocking), malware callback detection (endpoint isolation, firewall blocking), VPN abuse detection (account suspension, MFA verification), and cloud compromise investigation (CloudTrail and Azure telemetry correlation, workload isolation). Automation reduces MTTD and MTTR while improving response consistency and SOC scalability.

The value is not "we ran a simulation." The value is "we proved this control failed, fixed it, and can now show it works."

// Centralised SIEM and SOAR integration model with XSOAR orchestration

Infrastructure as Code & Policy Enforcement

The IaC strategy ensures repeatable, version-controlled deployments with embedded security controls. All infrastructure provisioning is automated through approved templates and governed through centralised policy enforcement, creating a secure-by-default deployment model.

Terraform

Primary multi-cloud IaC platform covering AWS VPC architectures, Azure VNets, segmented subnets, route controls, NAT gateways, load balancers, VPN infrastructure, security groups, NSGs, logging integrations, and cloud-native security services. Reusable modules created for network segmentation, firewall integration, and SIEM onboarding. Terraform state stored in encrypted remote storage with RBAC-controlled access.

Azure Policy and AWS SCPs

Azure Policy enforces governance guardrails including denying public IP creation, restricting internet-exposed storage, enforcing diagnostic logging, and requiring resource tagging. AWS Service Control Policies prevent unrestricted security group rules, restrict public S3 exposure, enforce CloudTrail usage, and prevent IAM privilege escalation across AWS Organizations and landing zone accounts.

// Infrastructure as Code and policy enforcement model

GitHub Reference Implementation

Terraform deployment examples, Azure Bicep templates, Palo Alto configuration standards, FortiGate policy examples, Zscaler SSE configuration patterns, VPN zoning examples, and SIEM/XSOAR integration examples are available in the accompanying repository.

github.com/saleem-yousaf/saleem-yousaf-zero-trust-architecture

Firewall Rule Standards

All firewall policies follow a deny-by-default security model with centralised governance enforced through Panorama, FortiManager, cloud-native policy controls, and Infrastructure as Code. All traffic traversing trust boundaries is explicitly authorized, application-aware, logged, inspected, and subject to threat prevention policies.

Core Firewall Rule Requirements

Rule Category	Direction	Protocol	Action	Logging	Threat Prevention	Requirement
Default Deny All	Inbound + Outbound	Any	DENY	Required	N/A	All rules must be explicit allow — implicit deny at bottom of all rulesets
Internet Ingress	Inbound	HTTPS 443	ALLOW	Required	Required	WAF + IPS + SSL inspection required on all public-facing ingress
Management Access	Inbound	SSH/RDP 22/3389	ALLOW — PAM only	Required	Required	Via bastion/PAM only — no direct admin access from internet
Internal East-West	Lateral	App-specific	ALLOW — explicit	Required	Required	Application-aware rules only — no broad subnet-to-subnet allow
DNS Resolution	Outbound	UDP/TCP 53	ALLOW — controlled	Required	Required	DNS to authorised resolvers only — DNS security filtering enabled
VPN / Remote Access	Inbound	IPSec / SSL-VPN	ALLOW — identity	Required	Required	Identity-verified, MFA enforced, split tunnelling disabled
Egress Internet	Outbound	HTTP/HTTPS	ALLOW — proxied	Required	Required	All outbound via SWG/proxy — direct internet egress denied
Time Restrictions	Any	Any	Schedule-based	Required	Optional	Business-hours restrictions on non-critical admin access paths
Log Forwarding	N/A	Syslog/HTTPS	ALLOW — SIEM	Required	N/A	All firewall logs forwarded to SIEM within 60 seconds of generation

// Core firewall rule requirements matrix

Palo Alto NGFW Rule Matrix

Rule Name	Source Zone	Destination Zone	Application	Service	Action	Security Profile
Allow-Web-Ingress	untrust	dmz	ssl, web-browsing	application-default	allow	IPS + AV + URL
Allow-API-Gateway	untrust	dmz	ssl	tcp/443	allow	IPS + AV + DNS
Allow-App-to-DB	app-zone	data-zone	mssql, mysql, oracle	application-default	allow	IPS + Data Filter
Allow-App-to-Identity	app-zone	identity-zone	kerberos, ldap, msrpc	application-default	allow	IPS
Allow-PAM-Admin	mgmt-zone	any	ssh, rdp	application-default	allow	IPS + Wildfire
Allow-SOC-Readonly	mgmt-zone	any	syslog, snmp	application-default	allow	IPS
Allow-Internal-DNS	any	dns-zone	dns	application-default	allow	DNS Security
Allow-NTP	any	ntp-zone	ntp	udp/123	allow	None
Deny-East-West-Default	any internal	any internal	any	any	deny	N/A — log all
Deny-All-Default	any	any	any	any	deny	N/A — log all

// Palo Alto NGFW example rule matrix

FortiGate NGFW Rule Matrix

Policy Name	Incoming IF	Outgoing IF	Source	Destination	Service	Action	UTM Profile
WAN-to-DMZ-HTTPS	wan1	dmz	all	dmz-servers	HTTPS	ACCEPT	IPS + AV + WAF
WAN-to-DMZ-HTTP-Redirect	wan1	dmz	all	dmz-servers	HTTP	REDIRECT	WAF
DMZ-to-AppZone	dmz	internal	dmz-servers	app-servers	CUSTOM-APP	ACCEPT	IPS + AppCtrl
AppZone-to-DataZone	internal-app	internal-data	app-servers	db-servers	DB-PORTS	ACCEPT	IPS + DLP
MGMT-Admin-Access	mgmt	any	admin-hosts	any	SSH, HTTPS	ACCEPT	IPS + Logging
Internal-to-DNS	internal	dns-if	all	dns-servers	DNS	ACCEPT	DNS Filter
Internal-to-Internet-Proxied	internal	wan1	all	all	HTTPS	ACCEPT (proxied)	AV + Web Filter
Implicit-Deny	any	any	all	all	ANY	DENY	Log all denied

// FortiGate NGFW example rule matrix

NAT Rule Matrix

NAT Rule Name	Original Src	Original Dst	Original Svc	Translated Src	Translated Dst	Type	Notes
DNAT-Web-443	any	203.0.113.10	tcp/443	—	10.10.1.10:443	DNAT	WAF IP to internal web tier — SSL pass-through to app
DNAT-API-443	any	203.0.113.11	tcp/443	—	10.10.1.20:443	DNAT	API Gateway public IP to internal API cluster
SNAT-App-Egress	10.10.2.0/24	any	any	203.0.113.50	—	SNAT	App zone outbound — shared egress IP for audit trail
SNAT-Mgmt-Egress	10.10.5.0/24	any	any	203.0.113.51	—	SNAT	Management zone — separate egress for admin traffic tracking
DNAT-VPN-Gateway	any	203.0.113.100	udp/500, udp/4500	—	10.10.5.50	DNAT	IPSec VPN termination — identity-verified users only
No-NAT-Internal	10.0.0.0/8	10.0.0.0/8	any	—	—	No NAT	Internal routing — NAT bypass for trusted zones
Block-Hairpin	any	internal RFC1918	any	—	—	DENY	No hairpin NAT permitted — prevents loopback attacks

// NAT rule standards matrix

VPN Rule Matrix

VPN Profile	User Group	Auth Method	Split Tunnel	Permitted Resources	Session Limit	Logging
Corporate-Full	Corp-Staff	Entra SSO + FIDO2	Disabled	All internal + internet via proxy	8 hours	Full session log
Admin-Privileged	IT-Admins	PAM + Hardware MFA	Disabled	Management zone only — PAM brokered	4 hours	Full + recording
Third-Party-Scoped	Vendors	Entra B2B + MFA	Disabled	Specific app/server only — ZTNA	4 hours	Full session log
SOC-Analyst	SOC-Team	Entra SSO + MFA	Disabled	SIEM + SOC tools only — read-only prod	12 hours	Full session log
Partner-API	Partners	OAuth 2.0 / API Key	N/A	API endpoints only — no network access	Token TTL	API gateway log
Emergency-Break-Glass	CISO approved	PAM + Dual approval	Disabled	Specific system — time-bound only	2 hours	Full + alert SOC

// VPN access rule matrix

Zscaler SSE Policy Matrix

Policy Name	Component	User Group	Condition	Action	Logging
Allow-SaaS-Apps	ZIA	All Corp Users	Compliant device + MFA	Allow + CASB inspect	Full
Block-Shadow-IT	ZIA	All Users	Unapproved cloud app	Block + notify user	Full
Block-Malware-Categories	ZIA	All Users	Malware / phishing category	Block + alert SOC	Full
DLP-Data-Exfil	ZIA	All Users	PII / sensitive data upload	Block + quarantine	Full + DLP log
ZPA-Internal-Apps	ZPA	Corp Users	Compliant device + identity	Allow app-specific	Full
ZPA-Admin-Apps	ZPA	IT Admins	PAM session + hardware key	Allow scoped only	Full + recording
ZPA-Vendor-Scoped	ZPA	Vendors	B2B identity + MFA	Allow app only	Full
Block-Non-Compliant	ZPA + ZIA	All Users	Non-compliant device	Block + remediate page	Full + alert
DNS-Security	ZIA	All Users	Malicious / C2 domain	Block + SIEM alert	Full

// Zscaler SSE (ZIA/ZPA) policy standards matrix

Operational Outcomes & Security Benefits

The secure landing zone architecture and Zero Trust operating model delivered measurable improvements across security operations, cloud governance, incident response, network segmentation, and hybrid cloud visibility.

Measurable Security Outcomes

// Measurable security outcomes summary

Improved SOC operational visibility and faster threat detection

Reduced phishing and malware exposure

Scalable Zero Trust segmentation across hybrid environments

Standardised firewall governance via Panorama and FortiManager

Stronger cloud security posture across AWS and Azure

Improved incident response times through XSOAR automation

Reduced excessive VPN and lateral access

Automated SOC workflows reducing analyst workload

Conclusion

This reference architecture demonstrates a scalable and repeatable enterprise security model designed to support modern hybrid cloud transformation across AWS, Azure, remote access, and on-premise environments.

By combining Zero Trust network segmentation, centralised SIEM and XSOAR operations, Palo Alto and Fortinet security platforms, Zscaler SSE secure access controls, and Infrastructure as Code governance, the architecture establishes a cloud-ready and operationally mature security framework capable of supporting enterprise-scale modernization programmes.

// Final architecture and strategic security outcomes

Reference Design Disclaimer. This reference architecture is provided for technical demonstration and capability showcase purposes only. All examples, network ranges, configurations, policies, and design patterns are illustrative and sanitised to avoid disclosure of any client-sensitive or production-specific information.