{{ $t('productDocDetail.updateTime') }}: 2025-12-26

Policy Generator Configuration

Constraints and Restrictions

• The maximum time range is 90 days. Historical traffic beyond 90 days cannot be used for policy generation.

• If the access count threshold is set to 0, policies will be generated for all access records, which may result in an excessive number of policies.

Precautions

• For easy management, the policy name must reflect the business scenario (Example: E-commerce System - Micro-segmentation Policy V1).

• Select only business-related VMs as protected objects. To reduce redundant policies, do not select unrelated VMs as protected objects.

• To ensure the accuracy of generated policies, it is recommended to review historical traffic before policy generation.

Steps

Step 1.Log in to SCP and go to Networking > Network Insight > Recommended Policy Set.

Step 2.Click Policy Generator to configure the policy name (Example: Financial System - Micro-segmentation Policy).

Step 3.Select the protected objects (VMs or VM groups).

Step 4.Select the time range (Example: Last 30 days).

Step 5.Set the access count threshold (greater than 0).

Step 6.Select the traffic direction (inbound, outbound, or both).

Step 7.Select the rule generation method (based on VMs or services with access traffic).

Step 8.Click Generate Now. The system starts generating the micro-segmentation policy.

Field Description and Operation Suggestion

Policy Pre-release and Check

Constraints and Restrictions

• To prevent business impacts caused by incorrect policies, policies must be pre-released for manual confirmation before being formally released to the distributed firewall.

• The policies for access across groups and access within a group must not overlap. Otherwise, policy conflicts will occur.

Precautions

• When you check policies, pay close attention to denied objects and rules to allow access to ensure that the policies meet business requirements.

• Before pre-releasing a policy, confirm its rationality with the business team to prevent legitimate traffic from being blocked.

• If a policy does not meet expectations, you can adjust the parameters to regenerate a policy without manually deleting the original one.

Steps

Step 1.After a policy is generated, go to the results page and select Access Across Groups or Access Within Group to check the policy scope.

Step 2.Select Display historical traffic to view the historical access traffic corresponding to the policy.

Step 3.Confirm the settings and click Pre-Release to pre-release the policy to the distributed firewall for activation.

Field Description and Operation Suggestion