1. A method comprising: at a virtual network device, storing a set of zone rules that define a first security zone for a zone-based virtual firewall policy that applies to a plurality of virtual machines (VMs), the zone rules specifying conditions used to associate incoming traffic with the first security zone, wherein the zone rules define the first security zone with both VM and network attributes, including a zone identity; storing information representing first firewall rules of the zone-based virtual firewall policy for the first security zone, the first firewall rules comprising first conditions for matching attributes of applications associated with the first security zone and an action to be performed on application traffic, wherein the attributes employed in the first firewall rules include the zone identity; receiving attribute values of attributes of applications associated with incoming application traffic; determining whether the attribute values satisfy the first conditions of the first firewall rules by matching the attribute values to values in a lookup database associated with the zone-based firewall policy; and in response to determining that the first conditions are satisfied, performing the action.