Clarifications on VSX Gateways Policies

[CyberBreaker]

Hi Guys, I just want to clarify about pushing policies in the VS and VSX gateways. I have 3 VS inside the 2x VSX gateways configured in cluster. Technically, we will be having VS0, VS1, VS2, and VS3, what I did is that I created 3 policy packages and I one VS in each policy packages in using the policy target.

In addition, we all know that there is also a policy package for the VSX gateway itself that was created automatically when we register the VSX gateways to the Smart Console.

My question now is, is my setup correct or do I need to include the VSX gateways to each policy package in addition to each VS (i.e. The target for Policy_Pack1 are VS1 and VS0).

Thank you so much.

[HeikoAnkenbrand]

It is correct.

You can use a separate policy pack for each vs. For vs0 only basic communication is allowed to reach the gw.

[CyberBreaker]

@HeikoAnkenbrand , thanks for the feedback.

What do you mean it is correct? Correct meaning I need to include the VSX gateways to the policy package of each VS? Thanks

[Wolfgang]

@CyberBreaker , There is no need to add the VSX-gateways itself to the other policy packages.

As @HeikoAnkenbrand  mentioned, you should have a small policy only to manage the VSX gateways. And your other policies are for your virtual systems.

Wolfgang

[HeikoAnkenbrand · Accepted solution]

Both are possible:
A small policy for VS0 and different policies for all other VS systems.
Or one policy for all VS gateways. In this case you can control the rules via "install on" in the ruleset.