Centralized firewall management
Publish location rules, resolve ordering, preserve management access, and inspect gateway adoption.
Guard firewall policies define permitted network flows on enrolled gateways and supported endpoints. They authorize paths; they do not create routes or establish VPN transport.
Define and preview rules
Open Access → Firewalls → Create policy, choose the site or target group, and add ordered rules with direction, source, destination, protocol, ports, action, and logging. Rules use first match; the final default is deny for new inbound access. Existing system management allowances are listed explicitly in the preview and cannot be removed without the recovery workflow.
TCP and UDP ports are integers 1 through 65535; use explicit inclusive ranges. ICMP uses its own type/code fields rather than a fake port. CIDRs must be valid for the selected address family. Contradictory selectors or unknown protocols reject publication; a missing field does not imply every protocol.
Use Policy → Preview → Test flow for representative allowed and denied paths. Preview evaluates the rule set against the supplied flow; it does not prove upstream routing, DNS, or the destination application is healthy.
Publish across locations
Publish a revision and inspect Policy → Adoption for each gateway. A single location reporting success cannot establish fleet-wide enforcement. Offline gateways keep their previous revision. Stateful connections can outlive a rule update unless the policy explicitly requests supported session re-evaluation; termination of active sessions is a separately reviewed disruptive action.
Log only needed flows at Rule → Logging. Logging volume and sensitive addresses affect retention and evidence access. Review Access → Firewall events by rule and gateway to diagnose a denied connection.
Recover and remove
Keep an independent local administration path before changing a remote site's management rules. If adoption disconnects management, use the site's approved recovery access, restore the last working revision, and reconcile the console assignment. A request accepted by the control plane is not proof the isolated gateway received its rollback.
Detach a policy only after assigning and verifying a replacement. Review VPN, ZTNA, and policies when a flow remains blocked: network reachability and authorization have separate failure conditions.