What an Access Policy is

In SonicWall Cloud Secure Edge (CSE), an Access Policy enforces which users have access to protected services.

Why access policies exist

Protected services should not be reachable by everyone on the network. Access policies replace broad, network-level access with identity- and trust-based rules, so that a service is only reachable by the users who meet the conditions an admin defines.

How access policies work

An access policy is defined by the following:

• who (what role) can access a service,
• the required Trust Level, and
• additional configurations (that pertain to the type of policy an admin is creating).

Once an access policy is saved, it can be applied to the corresponding service type (e.g., a web policy can be applied to a web service). One policy can apply to multiple services.

At a high level, the flow is:

1. An admin creates a policy from a template that matches the service type.
2. The admin defines who (roles) can access the service and the Trust Level they must meet.
3. The admin assigns the policy to one or more services of the matching type.
4. When a user requests the service, CSE allows or denies the request based on the policy.

When to use each policy type

Choose the policy template that matches the service you are protecting:

• Use a Web Policy for hosted websites and SaaS applications.
• Use an Infrastructure Policy for infrastructure services such as SSH, RDP, Kubernetes, Database, and TCP services.
• Use a Tunnel Policy for access delivered through a Service Tunnel.
• Use a Custom Policy (JSON) for advanced scenarios that the other templates do not cover.

Details

The subsequent sections provide an overview of each policy type, and lay out the steps required to create each type of policy.

---

Sections

• Roles
• Policy Examples
• Notes on Policy Enforcement
• Content Policies