Product documentation
Citrix SecurSpaces™
View PDF

Network policies

Network policies control the outbound network traffic that workspaces are allowed to generate. With a network policy you can monitor where a workspace connects, restrict it to an approved set of domains and IP addresses, or inspect its traffic — and see every one of those events in the Audit dashboard.

This page explains the model. For the tasks, see:

Policy behaviors

Every policy applies one of three behaviors to outgoing traffic.

Behavior What it does
Monitor TCP traffic is allowed and logged without restriction. Use this to see where a workspace connects without limiting it to an allow list.
Restrict Traffic is blocked by default. Only attached resources and the domains and IP addresses on the allow list can be reached. Blocked requests are logged.
Inspect TCP traffic content is inspected and reported. Use this when you need the deepest visibility into what a workspace sends.

Note:

You configure monitor and restrict behavior when you create or edit a policy. Inspect is provided only through the built-in Inspect Traffic (default, expert) policy. You can apply it to workspaces, but you cannot author a new inspect policy in the policy editor.

What happens when a policy is attached

Attaching any policy changes how the workspace reaches the network, regardless of which behavior the policy applies.

A workspace with a policy attached is labeled as hardened, and a Kubernetes NetworkPolicy then permits it to send traffic only to SecurSpaces service pods. All outbound traffic therefore goes through the SecurSpaces proxy service. DNS continues to work because it is served by a SecurSpaces service.

Important:

The moment any network policy is attached to a workspace — even a monitor policy — the workspace’s outbound traffic is routed through the SecurSpaces proxy service, and non-DNS UDP traffic is dropped. A workspace with no policy attached is not affected. Keep this in mind if your workloads rely on UDP, for example some VPN, QUIC, or custom UDP-based protocols. Those connections stop working once a policy is attached, whatever the policy’s behavior.

Before you use restrict or inspect

Note:

Restrict and inspect policies can cause some applications to stop working, because they change what the workspace can reach. They are recommended for experienced administrators.

Under an inspect policy, an application that reads certificates from a custom location inside the container is likely to fail. Check with your platform administrator before applying Inspect Traffic (default, expert) to a workspace that depends on one.

Scopes

Network policies are defined at three scope levels. A policy defined at a higher scope can be applied — and optionally enforced — on every scope nested beneath it.

Scope Who manages it Typical use
Platform Platform administrators, security officers Baseline policy for the whole deployment
Organization Organization owners, security officers Policy for all projects in an organization
Project Project owners, security officers Policy for all workspaces in a project

You cannot define a policy at the workspace level. A workspace can only have an existing policy applied to it, selected from the policies defined at the platform, organization, or project scope.

Applied and enforced

Two concepts govern how a policy reaches a workspace.

Term Meaning
Applied The policy is selected as the active policy for a scope or workspace.
Enforced The policy is locked in for the current scope and every scope nested beneath it. Lower scopes and their workspaces inherit it and cannot replace it.

Who can manage network policies

Creating, editing, selecting, and enforcing network policies requires the Security permission set to Manage. The Security permission has three levels: No Access, Access, and Manage.

Manage belongs to:

  • Security officers
  • Organization owners
  • Project owners, and any custom role granted the Manage level

Developers and other project members cannot create, change, or assign network policies, even for their own workspaces. With the Access level they can see which policies apply, for example through View summary, but the selection is read-only for them.

When a developer creates a personal workspace, its network policies are applied automatically from the project and platform settings. Policies marked as required are enforced and locked, and other configured policies are applied as the workspace’s selected policies. The developer does not choose them.

The default policies

When a project is created, Citrix SecurSpaces™ adds three ready-to-use policies at project scope.

Policy Behavior Use it when
Monitor Traffic (default) Monitor You want to log outgoing TCP traffic and generate audit events without restricting it to an allow list.
Restrict Traffic (default, expert) Restrict You want to block all outbound traffic except attached resources and an approved allow list.
Inspect Traffic (default, expert) Inspect You want to inspect TCP content and report it to the audit log. This behavior is available only as this built-in policy.

Restrict Traffic (default, expert) ships with a starter allow list covering common developer package sources, so standard tooling keeps working:

  • *.ubuntu.com
  • *.nodesource.com, *.yarnpkg.com
  • *.npmjs.org, *.npm.im, *.npm.me, *.npm.red
  • python.org, *.pypi.org, *.pythonhosted.org
  • open-vsx.org
  • opensuse.org, sourceforge.net, virtualbox.org
  • *.windows.net

Use these defaults as they are, duplicate them as a starting point, or create your own policies.

Where policies are configured

Location What you do there
Platform settings > Security settings > Network policy overview Review which policy is applied at each scope and whether it is enforced, and download a report. Read-only.
Workspace settings > Network policy, at platform, organization, or project level Create, edit, select, enforce, and test the policy for that scope.
A workspace’s Security settings > Network security Select the policy for an individual workspace. Read-only without the Manage level.
Network policies

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.