Policy Manager - Revision history

Græmer at 18:25, 3 May 2022

2022-05-03T18:25:01Z

← Older revision		Revision as of 18:25, 3 May 2022
Line 31:		Line 31:
	== About Policy Manager ==		== About Policy Manager ==

	Policy Manager is one of ~~Untangle~~'s most powerful features. It works by allowing you to create multiple policies, which are different sets of applications configured differently for different use cases. Often you will configure all of ~~Untangle~~ apps to service the whole network, however often it is necessary to handle traffic for some users or network devices differently. For example, you may want Web Filter to be different for students vs teacher and you may want no Web Filtering at all for your servers. You may wish to run Captive Portal but only on the ~~wifi~~ network or for unidentified devices. You may wish block certain applications with Application Control, but only at certain times of days.		Policy Manager is one of NG Firewall's most powerful features. It works by allowing you to create multiple policies, which are different sets of applications configured differently for different use cases. Often you will configure all of NG Firewall apps to service the whole network, however often it is necessary to handle traffic for some users or network devices differently. For example, you may want Web Filter to be different for students vs teacher and you may want no Web Filtering at all for your servers. You may wish to run Captive Portal but only on the WiFi network or for unidentified devices. You may wish block certain applications with Application Control, but only at certain times of days.

	In these cases, Policy Manager can simplify configuration a great deal by allowing for multiple sets of applications to be configured differently.		In these cases, Policy Manager can simplify configuration a great deal by allowing for multiple sets of applications to be configured differently.
Line 41:		Line 41:
	:This allows you to "copy" the configuration of ''some'' applications from another policy, but not others - this makes doing things such as having different [[Web Filter]] settings across policies, but keeping the configuration of all other applications identical across policies. There is not usually a need to modify settings for applications like [[Virus Blocker]] or [[Spam Blocker]] between different user groups, however if it is necessary it only takes a few clicks.		:This allows you to "copy" the configuration of ''some'' applications from another policy, but not others - this makes doing things such as having different [[Web Filter]] settings across policies, but keeping the configuration of all other applications identical across policies. There is not usually a need to modify settings for applications like [[Virus Blocker]] or [[Spam Blocker]] between different user groups, however if it is necessary it only takes a few clicks.

	Please note that we will be using the example of a school a lot in this section as it is quite apt in showing how Policy Manager can help you with different user classes. This can be applied to any organization; just look for groups you can fit users into - Administrative Assistants, Marketing, or HR, you're free to choose. It can also apply to different sets of servers (ie a ''DMZ policy'' for handling public servers, and an ''Internal policy'' for handling internal user machines and a ''Wireless policy'' for handling wireless users) and it can also apply to different times of day (ie a ''Lunchtime and After Hours policy'' and a ''Work Hours policy''). For simplicity the examples below will mostly use the school groups as an example.		Please note that we will be using the example of a school a lot in this section as it is quite apt in showing how Policy Manager can help you with different user classes. This can be applied to any organization; just look for groups you can fit users into - Administrative Assistants, Marketing, or HR, you're free to choose. It can also apply to different sets of servers (''i.e.'', a ''DMZ policy'' for handling public servers, and an ''Internal policy'' for handling internal user machines and a ''Wireless policy'' for handling wireless users) and it can also apply to different times of day (''i.e.'', a ''Lunchtime and After Hours policy'' and a ''Work Hours policy''). For simplicity the examples below will mostly use the school groups as an example.


Line 47:		Line 47:
	=== Getting Started with Policy Manager ===		=== Getting Started with Policy Manager ===

	Policies provide a way to handle different settings for different sessions. Using our example, an ~~Untangle~~ protecting a school might have three different policies - Students, Teachers, and Administrators. These policies provide completely separate configurations for traffic processing, for example you could allow teachers to access Facebook but not students.		Policies provide a way to handle different settings for different sessions. Using our example, an NG Firewall protecting a school might have three different policies - Students, Teachers, and Administrators. These policies provide completely separate configurations for traffic processing, for example you could allow teachers to access Facebook but not students.


	~~Untangle~~ will always have at least one policy, the '''Default Policy'''. You can rename but you cannot remove this policy. As mentioned before, you create [[Rules]] to send traffic to '''policies''' where it is processed by the '''applications'''. Policies are created from within Policy Manager, however you will use ~~Untangle~~'s web GUI itself to switch to and configure each policy. At the top of the web GUI, you will see '''Default Policy''' with an arrow next to it - clicking this arrow allows you to change the policy you're looking at, as well as access the [[Session Viewer]] and [[Host Viewer]] and open the Policy Manager Settings directly.		NG Firewall will always have at least one policy, the '''Default Policy'''. You can rename but you cannot remove this policy. As mentioned before, you create [[Rules]] to send traffic to '''policies''' where it is processed by the '''applications'''. Policies are created from within Policy Manager, however you will use NG Firewall's web GUI itself to switch to and configure each policy. At the top of the web GUI, you will see '''Default Policy''' with an arrow next to it - clicking this arrow allows you to change the policy you're looking at, as well as access the [[Session Viewer]] and [[Host Viewer]] and open the Policy Manager Settings directly.


Line 99:		Line 99:
	These rules operate as described in the [[Rules]] documentation.		These rules operate as described in the [[Rules]] documentation.

	Like many areas of ~~Untangle~~, the rules work from the top down. Let's go back to our school example and say we have three policies: Default (for students), Teacher and Administrative Staff. To get traffic to these policies, we would need to create two policies: one for the Teacher policy and one for the Administrative Staff policy - any traffic that did not match those two policies would be sent to the Default Policy. You can also explicitly add a rule sending traffic to the Default Policy, although it's not required.		Like many areas of NG Firewall, the rules work from the top down. Let's go back to our school example and say we have three policies: Default (for students), Teacher and Administrative Staff. To get traffic to these policies, we would need to create two policies: one for the Teacher policy and one for the Administrative Staff policy - any traffic that did not match those two policies would be sent to the Default Policy. You can also explicitly add a rule sending traffic to the Default Policy, although it's not required.

	If the policy rule for the Teacher policy is incorrect, it may end up matching ''all'' network traffic and sending it to the Teacher policy. Because it matches, the rule under it (for the Administrative Policy) will never be evaluated. On the flip side, if a rule is too narrow, it may not match the traffic you're trying to match at all, dumping it on the Default Policy. Because of this, we recommend starting out policy rules as very general (e.g. match a few IPs or an entire subnet) and then tightening them down from there - let's look at some common example policies:		If the policy rule for the Teacher policy is incorrect, it may end up matching ''all'' network traffic and sending it to the Teacher policy. Because it matches, the rule under it (for the Administrative Policy) will never be evaluated. On the flip side, if a rule is too narrow, it may not match the traffic you're trying to match at all, dumping it on the Default Policy. Because of this, we recommend starting out policy rules as very general (''e.g.'', match a few IPs or an entire subnet) and then tightening them down from there - let's look at some common example policies:

	[[Image:policy_rules.png\|center\|frame\|Quick look at the rules table]]		[[Image:policy_rules.png\|center\|frame\|Quick look at the rules table]]

	So this is the 'Rules' tab of the Policy Manager settings. On this page you will be able to see all of the rules that will be evaluated when determining which policy to direct a specific user or IP address. Pay attention to the 'Target Policy' column. Any users defined in the corresponding rule will be directed to that policy. Click on the page icon under the 'edit' column to define the rule.		So this is the '''Rules''' tab of the Policy Manager settings. On this page you will be able to see all of the rules that will be evaluated when determining which policy to direct a specific user or IP address. Pay attention to the 'Target Policy' column. Any users defined in the corresponding rule will be directed to that policy. Click on the page icon under the 'edit' column to define the rule.

	[[Image:policy_rules2.png\|center\|frame\|Click 'edit' and define the rule]]		[[Image:policy_rules2.png\|center\|frame\|Click 'edit' and define the rule]]
Line 121:		Line 121:
	== Related Topics ==		== Related Topics ==

	* [[~~Untangle~~ Rule Syntax]]		* [[NG Firewall Rule Syntax]]
	* [[Directory Connector]]		* [[Directory Connector]]

Hpaunet: /* About Policy Manager */

2020-06-18T17:23:30Z

About Policy Manager

← Older revision		Revision as of 17:23, 18 June 2020
Line 31:		Line 31:
	== About Policy Manager ==		== About Policy Manager ==

	Policy Manager is one of Untangle's most powerful features. It works by allowing you to create multiple policies, which are different sets of applications configured differently for different use cases. Often you ~~can configured~~ all of Untangle apps to service the whole network, however often it is necessary to handle traffic for some users or network devices differently. For example, you may want Web Filter to be different for students vs teacher and you may want no Web Filtering at all for your servers. You may wish to run Captive Portal but only on the wifi network or for unidentified devices. You may wish block certain applications with Application Control, but only at certain times of days.		Policy Manager is one of Untangle's most powerful features. It works by allowing you to create multiple policies, which are different sets of applications configured differently for different use cases. Often you will configure all of Untangle apps to service the whole network, however often it is necessary to handle traffic for some users or network devices differently. For example, you may want Web Filter to be different for students vs teacher and you may want no Web Filtering at all for your servers. You may wish to run Captive Portal but only on the wifi network or for unidentified devices. You may wish block certain applications with Application Control, but only at certain times of days.

	In these cases, Policy Manager can simplify configuration a great deal by allowing for multiple sets of applications to be configured differently.		In these cases, Policy Manager can simplify configuration a great deal by allowing for multiple sets of applications to be configured differently.
Line 65:		Line 65:

	To recap using our school example, we would send students to the Default Policy, then create a new Teacher Policy which uses the Default Policy as its Parent Policy. If you go to the Teacher Policy, all the apps will be greyed out and you will not be able to modify any settings because they are copied from the Default Policy. By adding in a new copy of Web Filter, you can modify the settings so the teachers can access websites the students cannot, however settings for all other applications will still be copied from the Default Policy.		To recap using our school example, we would send students to the Default Policy, then create a new Teacher Policy which uses the Default Policy as its Parent Policy. If you go to the Teacher Policy, all the apps will be greyed out and you will not be able to modify any settings because they are copied from the Default Policy. By adding in a new copy of Web Filter, you can modify the settings so the teachers can access websites the students cannot, however settings for all other applications will still be copied from the Default Policy.


	== Settings ==		== Settings ==

Dmorris at 18:14, 20 June 2018

2018-06-20T18:14:53Z

← Older revision		Revision as of 18:14, 20 June 2018
Line 8:		Line 8:
	{\| width='100%'		{\| width='100%'
	\|-		\|-
	\| align="center" \| [[Image:~~PolicyManager_128x128~~.png]]     '''Policy Manager'''		\| align="center" \| [[Image:PolicyManager.png\|128px]]     '''Policy Manager'''
	\| align="center" \|		\| align="center" \|
	{\|		{\|

Dmorris at 01:35, 19 July 2017

2017-07-19T01:35:50Z

← Older revision		Revision as of 01:35, 19 July 2017
Line 1:		Line 1:
	[[Category: Applications]]		[[Category: Applications]]
	<span style="display:none" class="helpSource policy_manager">Policy_Manager</span>		<span style="display:none" class="helpSource policy_manager">Policy_Manager</span>
			<span style="display:none" class="helpSource policy_manager_status">Policy_Manager#Status</span>
	<span style="display:none" class="helpSource policy_manager_policies">Policy_Manager#Policies</span>		<span style="display:none" class="helpSource policy_manager_policies">Policy_Manager#Policies</span>
	<span style="display:none" class="helpSource policy_manager_rules">Policy_Manager#Rules</span>		<span style="display:none" class="helpSource policy_manager_rules">Policy_Manager#Rules</span>

Dmorris at 21:41, 14 June 2017

2017-06-14T21:41:05Z

← Older revision		Revision as of 21:41, 14 June 2017
Line 15:		Line 15:
	\|[http://www.untangle.com/store/policy-manager-conf.html Policy Manager Description Page]		\|[http://www.untangle.com/store/policy-manager-conf.html Policy Manager Description Page]
	\|-		\|-
	\|[http://~~www~~.untangle.com/~~store~~/policy-manager~~-conf.html~~ Policy Manager ~~Screenshots~~]		\|[http://demo.untangle.com/admin/index.do#service/policy-manager Policy Manager Demo]
	\|-		\|-
	\|[http://forums.untangle.com/policy-manager/ Policy Manager Forums]		\|[http://forums.untangle.com/policy-manager/ Policy Manager Forums]

Dmorris at 21:21, 14 June 2017

2017-06-14T21:21:49Z

Show changes

Dmorris at 17:13, 12 June 2017

2017-06-12T17:13:12Z

New page

[[Category: Applications]]
Policy_Manager
Policy_Manager#Policies
Policy_Manager#Rules
Policy_Manager#Event_Log

{| width='100%'
|-
| align="center" | [[Image:PolicyManager_128x128.png]]     '''Policy Manager'''
| align="center" |
{|
|-
| Other Links:
|-
|[http://www.untangle.com/store/policy-manager-conf.html Policy Manager Description Page]
|-
|[http://www.untangle.com/store/policy-manager-conf.html Policy Manager Screenshots]
|-
|[http://forums.untangle.com/policy-manager/ Policy Manager Forums]
|-
|[[Policy Manager Reports]]
|-
|[[Policy Manager FAQs]]
|}
|}
 
----

== About Policy Manager ==

Policy Manager is one of Untangle's most powerful features. It works by allowing you to create virtual '''Racks''', much like a traditional [http://en.wikipedia.org/wiki/19-inch_rack server rack]. Like server racks, Untangle's virtual racks can contain multiple devices (''applications'') that perform different functions on network traffic, such as filtering web content or filtering spam. Policy Manager allows you to create policy rules that send traffic to different racks, which can contain multiple, independently configured applications. These features enable you to:

* Set up multiple racks for different user groups, such as Teachers, Administrative Staff and Students.
* Choose what applications are running in each rack (students may not need spam filtering, for example).
* Configure applications in separate racks independently (e.g. Student web traffic being more restricted than Teacher web traffic).
* Configure multiple applications in separate racks simultaneously using the '''Parent Rack''' system.
:This allows you to "copy" the configuration of ''some'' applications from another rack, but not others - this makes doing things such as having different [[Web Filter]] settings across racks, but keeping the configuration of all other applications identical across racks. There is not usually a need to modify settings for applications like [[Virus Blocker]] or [[Spam Blocker]] between different user groups, however if it is necessary it only takes a few clicks.

Please note that we will be using the example of a school a lot in this section as it is quite apt in showing how Policy Manager can help you with different user classes. This can be applied to any organization; just look for groups you can fit users into - Administrative Assistants, Marketing, or HR, you're free to choose. It can also apply to different sets of servers (ie a ''DMZ rack'' for handling public servers, and an ''Internal rack'' for handling internal user machines and a ''Wireless rack'' for handling wireless users) and it can also apply to different times of day (ie a ''Lunchtime and After Hours rack'' and a ''Work Hours rack''). For simplicity the examples below will mostly use the school groups as an example.

=== Getting Started with Policy Manager ===

Virtual Racks (hereafter referred to simply as racks) provide a way to handle different settings for different sessions. Using our example, an Untangle protecting a school might have three different racks - Students, Teachers, and Administrators. These racks provide completely separate configurations for traffic processing, for example you could allow teachers to access Facebook but not students.

Untangle will always have at least one rack, the '''Default Rack'''. You can rename but you cannot remove this rack. As mentioned before, you create [[Rules]] to send traffic to '''racks''' where it is processed by the '''applications'''. Racks and policies are created from within Policy Manager, however you will use Untangle's web GUI itself to switch to and configure each rack. At the top of the web GUI, you will see '''Default Rack''' with an arrow next to it - clicking this arrow allows you to change the rack you're looking at, as well as access the [[Session Viewer]] and [[Host Viewer]] and open the Policy Manager Settings directly.

==== Parent Racks ====

When you first create a new rack it will not contain any applications. You can add in any applications you want and configure them to your liking, or you can use the '''Parent Rack''' system. When creating a new rack using Policy Manager, you have the option to select a Parent Rack. If you use this option your new rack will be pre-populated with all applications and settings from the Parent Rack you selected, however it will look a ''bit'' different.

When you view the new '''child''' rack, the application faceplates will be greyed out and you will be unable to click Settings. This is because the settings for these applications are being ''inherited'' from the parent rack, which is useful because it saves you from having to reconfigure applications you want operating the same way in multiple racks, such as the virus scanners. To change the settings or view the [[User_Guide#Event_Logs | Event Logs]], you'll need to open the application on the parent rack and use the drop-down to select the rack to view traffic for.

If you want to modify the settings of an application in a child rack, you'll need to install the application you want to modify in the child rack - I know, it's already there, but you can't click Settings to modify the configuration. On the '''Apps''' tab on the left side of the web GUI, just click '''Install''' again. After a few seconds the app will re-appear and you will be able to click settings. Once this has happened, the new child application ''overrides'' the application inherited from the parent. The settings of the parent rack for this application '''have no effect for the application you have added to the child rack'''. If you're following along, your child rack will contain all applications that your parent rack does, however only one will have the Settings button enabled.

To recap using our school example, we would send students to the Default Rack, then create a new Teacher Rack which uses the Default Rack as its Parent Rack. If you go to the Teacher Rack, all the apps will be greyed out and you will not be able to modify any settings because they are copied from the Default Rack. By adding in a new copy of Web Filter, you can modify the settings so the teachers can access websites the students cannot, however settings for all other applications will still be copied from the Default Rack.

== Settings ==

This section reviews the different settings and configuration options available for Policy Manager.

=== Status ===

This displays the current status and some statistics.

{{ServiceAppScreenshot|policy-manager|status}}

=== Policies ===

From this tab you can create new racks and policies, however please note you'll first need to create and save a rack before you can create a rule to apply traffic to that rack.

To create a new rack, simply click Add in the '''Racks''' section.

*'''Name''': The name of this rack as displayed in the web GUI.
*'''Description''': A description for this rack.
*'''Parent Rack''': Which rack (if any) this one should use as a [[#Parent Racks | Parent Rack]].

{{ServiceAppScreenshot|policy-manager|policies}}

=== Rules ===

If you've been reading up until this point, you may have guessed that this new rack will do nothing until you send traffic to it. To accomplish this, you'll need to create a rule - click Add in the '''Rules''' tab.

When each new session is processed, the rules are evaluated in order. If all of a sessions attributes match all of the criteria of a rule it is considered a match. The rack for the first matching rule will be used to process the session. If no rules match, the ''Default Rack'' will be used to process the session.

These rules operate as described in the [[Rules]] documentation.

Like many areas of Untangle, the rules work from the top down. Let's go back to our school example and say we have three racks: Default (for students), Teacher and Administrative Staff. To get traffic to these racks, we would need to create two policies: one for the Teacher rack and one for the Administrative Staff rack - any traffic that did not match those two policies would be sent to the Default Rack. You can also explicitly add a rule sending traffic to the Default Rack, although it's not required.

If the policy rule for the Teacher rack is incorrect, it may end up matching ''all'' network traffic and sending it to the Teacher rack. Because it matches, the rule under it (for the Administrative Rack) will never be evaluated. On the flip side, if a rule is too narrow, it may not match the traffic you're trying to match at all, dumping it on the Default Rack. Because of this, we recommend starting out policy rules as very general (e.g. match a few IPs or an entire subnet) and then tightening them down from there - let's look at some common example policies:

[[Image:policy_rules.png|center|frame|Quick look at the rules table]]

So this is the 'Rules' tab of the Policy Manager settings. On this page you will be able to see all of the rules that will be evaluated when determining which rack to direct a specific user or IP address. Pay attention to the 'Target Rack' column. Any users defined in the corresponding rule will be directed to that rack. Click on the page icon under the 'edit' column to define the rule.

[[Image:policy_rules2.png|center|frame|Click 'edit' and define the rule]]

Once you've clicked the edit button, this is where you'll end up. This is where you will define which users will be assigned to which rack. You can specify a user using any one or combination of the identifiers in the drop down box. Any users that match the specified identifiers will be directed to the rack specified in the 'Target Rack' field.

{{ServiceAppScreenshot|policy-manager|rules}}

== Reports ==

{{:Policy Manager Reports}}

== Related Topics ==

* [[Untangle Rule Syntax]]
* [[Directory Connector]]

== Policy Manager FAQs ==

{{:Policy Manager FAQs}}