Abstract: A network information security zone joint defense system is provided, which monitors a network connection status through a network defense appliance. Once the network defense appliance detects a user computer in a network system triggering the conditions of a network zone joint defense, the network defense appliance immediately and automatically connects to a specified network switch, such that the network switch interrupts the network access service provided for the user computer, so as to effectively prevent virus or hacker from continuing spreading virus to the same or other subnet of the network, and further prevent the virus from starting a DDoS attack or paralyzing the network server, and thus greatly reducing the damages and losses to the network system.