1. A method comprising: at at least one virtual network device comprising a plurality of virtual machines (VMs), storing a plurality of sets of zone rules that respectively define a plurality of security zones having respective zone names, the plurality of the security zones being applicable to each of the VMs that satisfy sets of conditions, including VM attributes, specified by the plurality of the sets of the zone rules; generating a zone-based virtual firewall policy that applies to the VMs in the plurality of the security zones, the zone-based virtual firewall policy having a set of one or more matching criteria that when met allow an action to be performed with respect to inter-zone traffic, the set of the one or more matching criteria including the zone names such that the plurality of the security zones is part of the zone-based virtual firewall policy; associating the inter-zone traffic with the plurality of the security zones based on the inter-zone traffic satisfying the plurality of the sets of the zone rules of the plurality of the security zones; and allowing the action to be performed with respect to the inter-zone traffic associated with the plurality of the security zones in response to determining that the inter-zone traffic meets the set of the one or more matching criteria of the zone-based virtual firewall policy.