Policy Platform
Workload in Selective Enforcement is fully protected by protection coverage 0% (E-103808)
A user could choose Selective Enforcement, with ports fully protected (blocked by the boundary) for a workload, but the protection coverage score was 0%. This issue is resolved.
Constant policy churn due to "All Workloads" with "Use Workload Subnets" (E-102250)
When either the provider or consumer of a rule is set to "all workloads" and the "use workload subnets" option was enabled for that side of the rule, the PCE did get into a state where VENs are almost always in "Active (Syncing)". This issue is resolved.
IP address filter for IP Lists doesn't consider exclusions (E-97009)
Filtering did not work correctly for IP lists with exclusions. This issue is resolved.
Rule coverage for endpoints is timing dependent (E-96488)
Workload > workload rule coverage queries checked to verify that workloads were on the same network before returning any rules between them. This was very confusing with endpoints, because endpoint network membership changes frequently, which broke the explorer/illumination-driven policy-checking workflow. This issue is resolved.