Service Policy

• From the Console homepage, select Multi-Cloud App Connect.

Figure: Console Homepage

• Select an existing namespace from the top-left Namespace drop-down menu.

Figure: Application Namespace Selection

• To create a new namespace:

  • From the Console homepage, select All Services > Administration > My Namespaces.

  • Select Add namespace.

Figure: Create a Namespace

• In the form that appears, enter a name for your namespace.

• Optionally, add a description.

• Select Save changes.

• Select the Load Balancer service and select the service you just created.

Note: You can create a service policy in the following namespaces:

• System
• Shared
• Configured namespace

• Select Security > Service Policies > Service Policies.

• Select Add Service Policy.

Figure: Service Policy

• In the form that appears, perform the following:

  • In the Name field, enter a name for the new service policy. This name must be unique within the namespace and entered in RFC 1035 format (like a domain name, for example, acmecorp-web).

  • Optionally, select one or more labels. For each label, select a key and corresponding value.

  • Optionally, enter a description for the new policy.

Figure: Add Name and Metadata

• From the Server Selection field under the Servers section, choose one of the following:

  • Any Server: Applies the policy to any server.

  • Server Name: Name of the server to which a request is made. Enter the name of the server in the Server Name field.

  • Group of Servers by Name: List of server names for which requests are made. You can specify them using Exact Values and/or Regex Values. Select Add item and enter exact values or regular expressions for server names. Continue to select Add item in either section to build your list.

  • Group of Servers by Label Selector: Specifies the labels associated with the servers to which the requests are made. To add labels, select Add Label in the Selector Expression field, and then for each label you want to add:

    • Select a key from the drop-down list.

    • Select a displayed operator.

    • Select a displayed value or enter a custom value.

    • Select Apply. If this is the last label, select outside the Selector Expression field or press the tab or esc key.

Figure: Server Selection Menu

Note: Custom labels are currently not supported for this field. In the case of a client request coming from the public Internet, implicit labels like Geo-IP Country, Geo-IP City, and Geo-IP Region can be used. The Geo-IP data is sourced from the Digital Elements database. Geo-IP label can be used with the keys geoip.ves.io/country, geoip.ves.io/city, or geoip.ves.io/region as well as the value as selected from the choices. Geo-IP labels can also be set using a custom rule list and in the Advanced Match section.

In the Rules section, you will set rules that apply to requests sent to the servers selected in the Servers section (Step 3).

Figure: Request Rules

• To create rules, choose one of the following options from the Select Policy Rules menu:

  • Allow All Requests or Deny All Requests. Simply allows or denies all requests.

  • Allowed Sources or Denied Sources: Defines a list of sources whose requests will all be allowed or denied. Select Configure for a category to start building your list. You may include multiple categories in your list. For example, you can use Allowed Sources and have both the IPv4 Prefix List and a Country List. The result allows any request from any of the IPv4 addresses or any of the countries listed.

    • IPv4 Prefix List and BGP ASN List: These options let you enter a list of respective server identifiers. Select Configure to enter the list, using Add item to enter additional servers, and select Apply to keep the list and return to the policy rules. If you need to make changes, use Edit Configuration for the category you want to change.

    • IP Prefix Set and BGP ASN Set: These options let you select an existing set of IPv4 prefixes or BGP ASNs or create a new set. Select Add item and then use the drop-down menu to either select an existing set or select Add Item to create a new set. Repeat the process to add more sets.

    • Country List: This option allows you to create a list of countries. Use this drop-down menu to select a country. You may use select multiple countries from the drop-down menu to create a list. You can delete a country from your list by hovering over the country name in your list and then selecting the x next to the country name.

    • Order TLS Fingerprint Values: This option allows you to compare a request's TLS JA3 fingerprint to a list of fingerprints you create. Select Add item and enter a fingerprint value (use the See Common Values to select from a list of common TLS values).

    • Use the Default Action menu to specify what to do for a source request that does not match any of the rules configured above:

      • Next Policy: allows your load balancer to evaluate the source request using the next service policy.

      • Allow or Deny: allows or denies the source request.

Figure: Allowed Sources

• Custom Rule List: This option allows you to create a list of custom rules.

4.1 Build a custom rule list.

• Select Custom Rule List.

Figure: Custom Rule List

• Select Configure.

• Select Add Item.

• Enter a rule name and optionally a description.

Figure: Custom Rule Creation

• In the Action section, select an action to be enforced (Allow, Deny, or Next Policy) if the input request matches the rule. Next Policy will take no action, but it will allow the service to match the input against the next policy.

• In the Clients section, choose how you want to specify one or more clients to match against this rule, and then enter the client(s):

  • Any Client: This will match all clients.

  • Client Name: Enter the client name for this rule.

  • Group of Clients by Name: Select Add Item and enter exact values or regular expressions for client names. Select Add item to continue to build your list.

  • List of IP Threat Categories: Select one or more categories from the menu provided.

  • Group of Clients by Label Selector: Select a label key, an operator, and a value if required, and then select Apply. You will have something like ves.io/country In (ves-io-can) AND (which will match if for any client in Canada, and whatever criteria you add after this). You can add additional match criteria by selecting another label key and repeating the process. When your expression is complete, press the tab key or click outside the area to complete the expression (and the trailing AND will be removed).

• In the Servers section, select Add Item and enter exact values or regular expressions for the server names. Continue to select Add Item to build your list.

• In the Request Match section, enter the types of requests that you want to match with this policy rule. You can specify the request type in a number of different ways:

  • HTTP Method: Select the HTTP methods from the Method List drop-down. Using the drop-down menu multiple times will allow you to select multiple methods.

  • HTTP Path: Select Configure and enter prefix values, exact values, regular expressions, or suffix values for an HTTP path. Continue to select Add item to build your list. Use the Transformers field to modify the path for easier matching (e.g. convert the string to lower case). Select Apply after you finish.

This image provides a regex example:

Figure: Custom Rule for HTTP Path - Regex

This image provides a suffix example:

Figure: Custom Rule for HTTP Path - Suffix

• HTTP Query Parameters: Select Add Item and then enter a parameter name in the Query Parameter Name field. Use the Match Options drop-down menu to select a match value. Present/Not Present matches if that parameter name is/is not in the request. Match Values allows you to enter exact values and/or regular expression for values to match against.

• HTTP Headers: Select Add Item and then enter a header name in the Header Name field. Use the Match Options drop-down menu to select a match value. Present/Not Present matches if that parameter name is/is not in the request. Match Values allows you to enter exact values and/or regular expression for values to match against.

• JWT Claims: Select Add Item and then enter a parameter name in the JWT Claim Name field. From the Match Options menu, select an option to match the claim with. You can choose to match on values present in the claim, simply check if the claim is present, or match if the claim is not present. After you finish, click Apply.

• To optionally configure limits on client requests, perform the following:

  • In the Request Constraints section, click Configure.

  • In the Cookie Constraints, Header Constraints, Parameter Constraints, and Other Constraints sections: To enable any option, from any desired drop-down menu, first select Match If Exceeds to have the recommended value populated by Console. You can also change the value by entering your own value.

Note: For Cookie Constraints, internal cookies are included in the count and processed per the configuration options. For Header Constraints, internal headers are included in the count and processed per the configuration options. The body of each POST request is parsed for parameters when the Content-Type is application/x-www-form-urlencoded. For the Max Request Size option, the match is on the size of the request (as in Request Line plus HTTP Request Headers). This does not include the request body.

Figure: Client Request Cookie Configuration

• In the Advanced Match section, optionally perform the following:

  • Select Add Item to configure label keys that need to be the same for the clients and servers.

  • Select Configure to set up the API group matching for requests.

  • Select Segments for Source Segments to specify source segments that must match for requests.

  • In the Destination Segments drop-down menu, select Intra Segment to match traffic against source and destination on the same segment or select Segments and specify the segment(s) to match against.

  • In the User Identity Matcher section, select the Add Item buttons to specify user identities either by exact values or regex values.

• After you complete the custom rule specification, select Apply.

• Select Apply to add the rule to the rules list.

• Select Apply to save the custom rule.

Select Save and Exit to create the service policy.

To apply all active namespace service policies to a load balancer, select the Multi-Cloud App Connect service and your namespace, and then perform the following:

• Select Security > Service Policies > Active Service Policies.

Figure: Active Service Policies

• Select Select Active Service Policies. This will show a list of active service policies available for the given namespace, which may be empty.

• Select Add Item to add a new service policy to the active list.

• Select your service policy from the drop-down menu.

Figure: Select Active Service Policy

• Select Save and Exit.

You have the option to set the order of evaluation for the active service policies configured in a given namespace.

• Select your namespace that contains the active service policies.

• Select Security > Service Policies > Active Service Policies.

• Select Select Active Service Policies.

• Change the order of these rules by using the drag handle to drag and drop the rules in the order you see fit. You can also select ... > Move to another spot, and then use the arrows to move the rule up or down the list.

• Select Save and Exit.

Figure: Order of Evaluation

You can apply a specific service policy to your load balancer using the Apply Specified Service Policies option. You can apply as many specific service policies as needed.

To apply specific service policies, perform the following:

• Open your load balancer for editing:

  • Select Manage > Load Balancers > HTTP Load Balancers.

  • For your load balancer, select ... > Manage Configuration.

  • Select Edit Configuration in the upper right corner.

• Navigate to the Common Security Controls section in load balancer configuration.

• From the Service Policies menu, select the Apply Specified Service Policies option.

Figure: Apply Specified Service Policy

• Select Configure.

• Select Configure again.

• From the List of Policies menu, select a service policy.

Figure: Menu Options

• Select Add Item to add more service policies.

• Use the drag handles to the left of the service policy to re-arrange the order of the service policies.

• Select Apply.

• If you are finished with load balancer configuration, select Save and Exit.