1.0

CHAPTER 14 Understanding Policies
237
using a comma-separated list with no spaces. A network adapter matches this
condition if it is using at least one of these servers.
zoneDescription.<zone_number>.gateways = "<IP_address>"
This parameter specifies one or more IP addresses for default gateways on the
network, using a comma-separated list with no spaces. A network adapter matches
this condition if it is using at least one of these gateways.
zoneDescription.<zone_number>.dnsServers = "<IP_address>"
This parameter specifies one or more IP addresses for DNS servers on the network,
using a comma-separated list with no spaces. A network adapter matches this
condition if it is using at least one of these servers.
zoneDescription.<zone_number>.minDnsServersToMatch = "<number>"
This parameter modifies the dnsServers parameter (above). A network may have
multiple DNS servers, and a host may be configured to use more than one DNS server.
If the value of this option is greater than 1, the host must be using the specified
number of DNS servers on the list before a network adapter is considered to be on the
defined network.
zoneDescription.<zone_number>.winsServers = "<IP_address>"
This parameter specifies one or more IP addresses for WINS servers on the network,
using a comma-separated list with no spaces. A network adapter matches this
condition if it is using at least one of these servers.
zoneDescription.<zone_number>.minWinsServersToMatch = "<number>"
This parameter modifies the winsServers parameter (above). A network may have
multiple WINS servers, and a host may be configured to use more than one WINS
server. If the value of this option is greater than 1, the host must be using the specified
number of WINS servers on the list before a network adapter is considered to be on
the defined network.
Defining Host Policies
The host policies you can define for each zone may establish either whitelists —
networks and machines to which connections are allowed — or blacklists —
networks and machines to which connections are prohibited.
Note: Even when the host is otherwise blocked from all access to the network, it is
allowed to communicate with DNS and DHCP servers so the zone detection
mechanism can function properly.
Note: Any restrictions on the host’s network access also restrict network access for a
virtual machine using NAT networking, because the NAT connection is affected by all
the policies you apply to the host. If you impose host quarantine rules, you may prefer