SC//AcuVigil™ applies firewall rules through policies. The site's edge security device (ESD) blocks any traffic that isn't explicitly allowed, and each registered device is assigned one policy that allows only the traffic that device needs. Because policies are applied per device, two devices on the same network segment can have different access.
How policies work
- Deny by default. A device with no policy that allows a connection can't make it. Unregistered devices can't reach other networks at all.
- One policy per device. You choose the policy when you register a device, and you can change it later. See Changing a registered device.
- Default and custom policies. Every site has five default policies: Local, VPN, InternetAccess, Monitor, and Unrestricted. Many companies also have custom policies for specific devices, vendors, or payment and POS workflows. For the default policies, see Default policies. For help choosing one, see Registering new devices.
- Company-wide and site versions. A policy can have a company-wide (corporate) version and a version for one site. A globe icon marks the company-wide version, and a local icon marks a site version.
What a policy can allow
A policy can include:
| Part | What it does |
|---|---|
| VPN Access | Whether the device can reach devices at the other end of the site's VPN tunnels. Bidirectional: devices at both ends can contact each other. Client Out: the device can contact devices at the other end, but not the other way around. Remote In: devices at the other end can contact the device, but not the other way around. None: no VPN access. |
| Use SC//Connect | Sends the device's internet traffic through SC//Connect. |
| Whitelist hosts and services | The internet hosts and services the device may connect to. |
| Port Forwarding | Inbound connections from the internet that are forwarded to the device. |
| Redirect | Connections that are redirected to another address. |
View a site's policies
- Open the site's Status page and choose the Devices tab.
-
Select Policies.
The Manage Policies list shows each policy with its description and when it was last updated.
-
To see what a custom policy allows, select View in its row.
The Policies menu is available to the Admin, Support Manager, Customer Help Desk, and Staff roles. Viewing a policy's contents requires the Admin, Support Manager, or Customer Help Desk role.
Icons next to a policy tell you more:
- A lock icon means the policy is being updated at the site and can't be edited until the update finishes.
- An exclamation-mark icon means the policy has rules for interfaces or segments that this site doesn't have. Hover over it to see which.
Request a new policy or a change
Scale Computing creates and changes firewall policies as part of the managed service, and records a PCI security verification for each change. To request a new policy or a change to one, contact Scale Computing Support. Open a ticket in the SC//AcuVigil dashboard, email team@scalecomputing.com, or call (512) 687-7401.
Include in your request:
- The site, or whether the change applies to every site.
- The devices that need the access.
- What they need to reach: host names or IP addresses, ports, and whether the connection is outbound, inbound, or across the VPN.
- The business reason for the change.
Note: To give one device different access, ask for the device to be moved to a different policy rather than for a broad policy to be widened. Widening a policy changes access for every device that uses it. |