...
- External Networks: Select this to add external networks to the network scope. For more information, see Configuring External Networks.
- DNS Forwarding Proxy: Select this to add DNS forwarding proxies to your network scope. For more information about DNS forwarding proxy, see DNS Forwarding Proxy.
- Endpoint Groups: Select this to add BloxOne Endpoint groups to your network scope. For information about BloxOne Endpoint groups, see BloxOne Endpoint Group Assignment.
- User Groups: Select this to add user groups to the network scope. The available user groups are those that have been synchronized through the third-party IdP (identify provider) that your admin has configured for access authentication. For more information, see Synchronizing User Groups.
- Tags: Select this to add user-defined tags to your network scope. When the network scope includes an object included in multiple policies, then the policy precedence order will determine which policy is enforced. Changes in policy tagging are updated by the system and may take up to 5 minutes to complete. When multiple tagging changes occur to a security policy, the policy will reflect the most recent change to the policy. For more information on tags, see applying tags.
- IPAM: Select this to add external networks to the network scope. When adding tags to IPAM scopes, any tag-based changes in an IPAM scope based on tags can take up to 5 minutes to take effect. To associate a security policy with DDI IPAM objects in the DNS query, do the following:
1. Select an IP Space to add to your security policy (Manage > IPAM/DHCP).
2. Click the horizontal menu item to display the IP Address block(s) associated with the IP Space. From among the listed address blocks, choose an address block to add to your security policy. Make a note of your selected IP space and address block you want associated with your security policy. For information on adding an overlapping subnet to a security policy scope, see
Allowing Overlapping
...
Internal and External
...
Subnets When Defining Security Policy Scope
...
When defining a security policy scope for an internal network residing behind a DNS firewall, or for an external network, then overlapping subnets containing IP addresses, hosts, or subnets included in other security policies within an organization are allowed. In this case, security policy precedence is used to select the security policy possessing the highest precedence to which the IP addresses, hosts, or subnets should be added. Subnets not already added as part of another security policy within the organization can be added to a different security policy within the same account.
If a public IP address or subnet is mistakenly added to an organization's security policy that has previously been registered by another registered organization, then the public IP address or subnet will not be allowed. In this case, the organization attempting to add the IP address or subnet will be notified regarding the issue since no overlapping of public IP addresses or subnets between organizations is allowed.
2. For each source you have added, click Add. The source appears in the table. You can click the Add Source menu again to choose another source for your network scope.
3. After you define your network scope, you can proceed to add policy rules, set precedence order and bypass codes.
4. Click Next in the wizard to define policy rules. For more information, see Adding Policy Rules and Setting Policy Precedence.
...