Security Policy Guide 23.2

You have the option to create basic or scoped rulesets. You can choose whether you want to include scopes when creating new rulesets. The Scope field appears in the Add Ruleset dialog box only when the PCE is configured to display scopes in rulesets. When the PCE is configured to create scopeless rulesets, you create simple rules that do not apply to specific environments, locations, applications, or other categories you may have defined using flexible label types. These rules are scopeless rules because they do not belong to a ruleset that uses scopes.

You might want to create these basic rules when you are new to using Illumio Core and you are creating your first security policy rules. For example, you might want to create a simple rule to control SSH traffic for all your workloads. As you become more familiar with Illumio Core or you need to create more complicated rules, you can choose to create scoped rules; namely intra-scope, extra-scope, and custom iptables rules. Creating scoped rules allows you to create rulesets and rules that are defined for specific environments, locations, applications (typically larger environments), or other categories you define in flexible label types.

When the PCE is configured to create scopeless rulesets, you can still add a scope to a ruleset after saving the ruleset. From the Ruleset Actions menu at the top right corner of the Ruleset page, select Add Scope.

For more information about rulesets, see also Rule Writing in this guide.

The scope of a ruleset determines which workloads receive the ruleset's rules and enables the rules in a ruleset to apply to workloads in a group (one scope).

When workloads share the same set of labels defined in a ruleset's scope, those workloads receive all the rules from the ruleset. When you add a second scope, all the workloads within both scopes receive the rules from the ruleset.

A single scope is defined by using labels that identify the workload:

For example, a scope (or collection of workloads that the rules are applied to) is defined as ERP | Prod | US, which means that the rules apply to any workload that meets the following three requirements:

That example is relatively simple, but combining rules and scopes can be used to create complex security policies.

Using multiple scopes in a ruleset applies the rules to each scope in isolation and does not allow workload cross-communication.

When the same type of label is used multiple times in a rule, they are expanded as multiple rules with one label for each rule.

The following examples further demonstrate how scopes work with rules.

In Illumio Core 22.2.0 and later releases, you can control whether rulesets use a scope.

The Scope field appears in the Add Ruleset dialog box only when the PCE is configured to display scopes in rulesets.

To globally enable or disable scopes in the PCE:

You can view the ruleset status on the Ruleset page. The current status of each ruleset (enabled or disabled) is displayed in the Status column. When you change a ruleset but have not yet provisioned the change, the type of change (addition, deletion, or modification) appears in the Provision Status column with the word “Pending” to indicate that these changes must be provisioned to be applied.

You can filter the rulesets list using the label and property filter at the top of the list. You can filter the list by entering a label type to show only those rulesets that use the selected labels. You can further filter the list by selecting specific properties of the rulesets. For example, you can filter the list by provision status, such as rulesets that are in draft state and have not yet been provisioned.

You can create a ruleset to write rules that define the allowed communication between workloads in a single group or multiple groups. See "Groups in Illumination" in Visualization Guide.

When you write a rule for a Windows workload, you can add a Windows service name without specifying a port or protocol and the rule will allow communication for that service over any port and protocol.

The following task creates a single scope, which means the rules in the ruleset apply to a single group. To apply the rules to another group, add a second scope, which is indicated by the group's labels.

To create a ruleset:

Now that the ruleset is created, you can add rules to define your security policy. See Rules for information about the types of rules you can add.

When the PCE is configured to create scopeless rulesets, you can still add a scope to an existing ruleset.

You can create rulesets with multiple scopes to define the allowed communication between workloads in one or more groups. See "Groups in Illumination" in the Visualization Guide for information.

How you define the scope in a ruleset enables you to write rules for workloads in multiple groups (two or more scopes). Each scope corresponds to one group. The scope defines the boundaries of the rules in the ruleset.

To create a multi-scope ruleset:

The green Addition Pending icon shows that this addition is pending, so you need to provision the new ruleset in order for the rule to take effect. See Provisioning for more information.

When you have a ruleset that you want to use to create other new rulesets, you can duplicate an existing ruleset.

After saving the new duplicate ruleset, make any needed scope or rule changes and then provision to apply them. See Provisioning for more information.