Manage network policy sets

CloudFlow's network policy sets enable you to manage network security rules deployed in virtual private clouds, regions, or accounts, across multiple security controls including AWS SG, Azure NSG, Azure Firewall, and Google Cloud Project Firewall.

Each security control detected from your cloud accounts, subscriptions, and projects is automatically added to a policy set. Add, delete, or edit rules in the policy sets as required, and commit the changes to implement them on the associated controls.

Policy sets with similar rules can be merged into a single policy set from which all rules and rule collections defined on the related controls can be viewed and managed.

Network Policies page

To open the Network Policies page, click the Network Policies icon on the left. By default, the page opens with All Entities selected and displays an overview of all your vendors and policy types.

Network policies tree

The network policies tree lets you drill down into individual virtual network types.

The network policies tree contains the following entities:

Security Control	Account Type		Virtual Network Type
	Icon	Type	Icon	Type
AWS SG		Account		VPC
Azure Azure NSG Azure Firewall		Subscription		VNet
				Virtual Hub
Azure Firewall (classic)		Subscription		VNet
Google Cloud Firewall		Project		VPC

Network tree search bar

Use the network tree search bar to filter the tree and find entries quicker.

Search using partial or whole names of any of the following:

• Vendors / Policy Types

• Accounts / Subscriptions / Projects

• Regions

• VPCs / VNets / Virtual Hubs

Network policy sets

View network policy sets:

Click on an entity in the Network policies tree to see a list of matching policy sets on the right.

Search policy sets

In the Search Policy box above the list of policy sets, you can filter the displayed policy sets based on search entries.

For each security control, you can search using partial or whole names and descriptions within any of the following:

AWS SG	Azure	Google Cloud
Account	Subscription	Project
Region	Resource group	Google Cloud Firewall name
VPC	Region
SG name	NSG / Firewall policy name

Filter displayed policy sets

You can filter displayed policy sets to see a more targeted display of the policy sets that interest you.

View risks details at the policy level

For AWS, Azure, and Google Cloud

See an aggregated view of the relevant risks associated with each policy.

Do the following:

Click on the risk severity level circles of the desired policy set.

A policy set risk popup appears with information about the policy set and a detailed list of all the risks associated with the policy.

The policy risk details include the following information:

Column name	Description
Severity	The severity of the risk (critical, high, medium, low).
Risk triggers	The number of times the risk was triggered by rules in the policy.
Risk ID	The ID number assigned to the detected risk.
Risk title	The name of the risk as it appears in the risks list panel.
Description	Click the icon to view a full explanation of the nature of the risk.
Remediation	Click the icon to view a suggested course of action to resolve the risk.

View rule risks & affected assets

For any rule, you can conveniently view the risk description, the risk remediation suggestion, and all its affected assets.

Do this:

1. Expand the required policy set and click on the risk severity level circle of the required rule.
   
   The Risks tab of the Rule Risks & Affected Assets popup window is displayed, showing the relevant risks (Outbound or Inbound):

   

2. Click on the Affected Assets tab.
   The affected assets are displayed.
   

   

   Tip:
   Hover over the:

   • Description icon to view the risk description.

   • Remediation icon to view the remediation suggestion.

   

Merge policy sets

For Azure NSG, Azure Firewall (classic), and AWS SG

Since each detected network policy is assigned its own, individual policy set by default, you'll want to merge similar policy sets together to view and manage them together.

Do the following:

1. View the policy sets you want to merge, using the search box to search for similar items. For details, see Manage network policy sets.

2. Expand each policy set to inspect its details and confirm that you want to merge them.

   

3. Select the check boxes next to each policy set you want to merge, and then click Merge.

   

   Tip: If you have many policy sets to select, use the Select all or Unselect all links above the grid as needed.

4. In the Merge Policy dialog box that appears, enter a name for your new policy set, and an optional description.

   Click Merge to merge the selected policies into a single set.

   The policy set grid is updated with your new set. For example:

   

Edit policy set properties

For Azure NSG, Azure Firewall (classic), and AWS SG

Edit the properties for each policy set to change the name, description, or member security controls.

Do the following:

1. View the policy set whose properties you want to edit.

   Tip: You may want to use the search box to find the one you're looking for. For details, see Manage network policy sets.

2. Click the properties button next to the policy set name.

3. In the Network Policy Set Properties dialog that appears, do any of the following:

   Name	Edit the name listed for the policy set in the grid.
   Description	Enter a description for the policy set. This description is shown in the grid when you hover over the Description icon.
   Security Controls	This area lists the security controls included in the policy set. Click an X to remove a single security control from the set. To completely dissolve the set and return each policy to its own individual set, click Clear all controls. In the message that appears, click Yes to confirm. Tip: To add a new security to control to a policy set, merge the relevant sets together. For details, see Merge policy sets.

Edit network policy rules

For Azure NSG, Azure Firewall (classic), and AWS SG

Edit each of your network policies by adding, deleting, and modifying rules and rule collections in the network policy set.

• Any changes made in a specific rule affect all security controls where the rule is installed.

• Only one user can edit each policy set at a given time. Policy sets are locked while editing and are opened in read-only mode by default.

  When you're done, click Commit or Discard changes to unlock the policy set for others.

Do the following:

1. Browse to and expand a specific network policy set. For details, see Manage network policy sets.

   Rules are displayed in a boxed grid that lists the source, destination, and protocol details for each rule, as well as the security controls each rule is installed on.

   If you are in read-only mode, a large Edit button is shown at the top right of the policy set box. Click the Edit button to make changes to the expanded policy.

   Note: For Azure Firewall (classic), the rules are grouped by rule collection. Expand the collection to drill down to rule details.

2. Do any of the following:
Add a new collection (For Azure Firewall (classic) only)

Azure Firewall (classic) organizes its rules by rule collections. For more details, see Field reference per rule type.

Do the following:

1. At the top of the boxed grid, click + Add Collection.

2. Enter a unique name and numeric priority, and then define an action for the new collection: either Allow or Deny.

   For example:

   

3. Click Done to add your new collection.

Within your new collection, click + AddRule to create a new rule with the selected collection already defined. For more details, see Add a new rule.

Add a new rule

Note: In Azure Firewall (classic), when rules are defined within a rule collection, each rule inherits the priority and actions defined for the parent collection.

Do the following:

1. At the top of the boxed grid, click + Add Rule.

2. In the New ... Rule dialog that appears, populate the fields as needed.

   Example: Adding Azure Firewall (classic) rule:

   

   Example: Adding Azure NSG rule:

   

   Example: Adding AWS SG rule:

   

3. Click Done to save your rule.

   The new rule appears within the dropdown list for the selected collection.

Edit and delete rules

To edit or delete an existing rule, do the following:

1. For Azure Firewall (classic) only, find your collection in the policy set and click the dropdown arrow at the right side of the row.

2. Click on one of the Edit or Delete icons to the right of the target rule.

   Edit	An Edit ... Rule dialog opens for the rule you selected to edit. Make your changes as needed, and click Done
   . Delete.	The rule is removed from your policy set.

   Tip: For Azure NSG and AWS SG with flow logs enabled, CloudFlow displays the date each rule was last used, if at all.

   You may want to delete unused rules to keep your policy clean. For details, see Clean up policies.

   The page is refreshed with your changes.

3. Do one of the following:

   • Click Discard changes to revert back to the last saved version of the policy set and unlock it for others.

   • Click Commit at the top of the screen to save your changes.

     CloudFlow displays a list of the changes you made. Accept the changes to complete the commit.

     The commit provisions your changes on the security controls and unlocks the policy for others.

Check connectivity for the hybrid network

For Azure NSG Policies

The connectivity check runs a traffic simulation query on ASMS with the subject rule fields (source, destination and service). Cloud-specific elements (e.g. service tags, Virtual Network, ASG, etc.) are translated to the IP-equivalent content based on the target NSG configuration.

The connectivity check in CloudFlow allows you to observe how traffic is routed and whether it’s allowed across your entire hybrid network (that is, across NSGs, firewalls routers etc. deployed on cloud and/or on-prem).

To run a connectivity check

Here are some points to remember when running Connectivity checks:

• A connectivity check result link is available for 12 hours and visible to all users viewing the subject policy set.

• If theConnectivity icon is disabled (grey), hovering over it will display the reason this connectivity check cannot currently be performed.

• If the connectivity icon animation is active, the connectivity check is in progress, wait for results.

• The connectivity check may take up to an hour, depending on how wide or narrow the rule fields are.

• When a rule can be expanded using the downward arrow on the right side of the screen, you must expand it and run connectivity on each NSG separately.

Reviewing connectivity check results

On the CloudFlow Azure network policy page from where the connectivity check is initiated, results are color-coded according to this legend:

	Partially Allowed - Some traffic is allowed and some is blocked by the devices in the query path.
	Allowed - All traffic is allowed by all the devices in the query path.
	Blocked - All traffic is blocked by all the devices in the query path.

Hover over the information icon next to any Results link for further details.

You should be able to login to the connected ASMS instance from your browser.

When you click on the connectivity check result, if you are not yet logged-in to ASMS, you will be directed to do so.

Connectivity checks display the matching ASMS traffic simulation query results in a separate browser tab where all standard ASMS traffic simulation query functionality is available.

Change detection from outside CloudFlow

When changes are detected in a security control managed by CloudFlow, CloudFlow merges the changes into any relevant policy set.

CloudFlow attempts to merge the changes even if the relevant policy set is currently in draft mode or being edited by another user. These changes are reflected in the network policies page when it is freshly accessed. If the network policies page is already open in a browser tab, you may need to refresh it.