A firewall is basically used to enforce an access policy between different security domains. With the ZBPFW feature, these different security domains are called security zones. With the earlier Context-Based Access Control (CBAC) feature, these security domains were simply router interfaces. So, one of the main differences between a firewall using CBAC and ZBPFW is the use of security zones. These zones separate the specific security areas within a network. A typical example would be a firewall that divides its universe into three main security zones: