Internet Security Policies

Published on: Aug 02, 2026

.

4 min read

The Internet Security Policies feature in Zenconsole enables administrators to centrally create, configure, and manage internet security policies across all connected Zenarmor deployments, including both gateways and endpoints. By managing policies from a single location, administrators can enforce consistent security settings, reduce administrative overhead, and eliminate the need to configure each deployment individually.

Figure 1. Internet Security Policies

The Internet Security Policies feature provides the following benefits:

• Centralized Management: Create and manage internet security policies for all connected gateways and endpoints from a single location in Zenconsole, eliminating the need to configure each deployment individually.
• Flexible Policy Assignment: Create multiple policies and assign them to specific gateways, endpoints, users, or user groups to meet different security requirements across your organization.
• Identity-Based Policy Enforcement: Apply policies based on user identities or groups synchronized from supported identity providers or local Zenconsole directories, enabling more granular access control.
• Consistent Security Across Deployments: Standardize security settings throughout your organization while allowing customized policies for different departments, locations, or deployment scenarios.
• Simplified Policy Synchronization: Update policies centrally and synchronize changes to managed deployments, ensuring they remain aligned with your organization's security configuration.

Every organization comes with a Default Policy. Although the Default Policy cannot be renamed or deleted, you can modify its Security Rules, Content Inspection Rules, Application Controls, Web Controls, TLS Controls, Cloud Access rules, and Exclusions to meet your organization's requirements.

You can also create additional policies to address different security requirements across your organization. For each custom policy, you can define matching criteria to determine which gateways, endpoints, users, or user groups the policy applies to and configure the appropriate security settings.

Accessing the Internet Security Policies Page

To access Internet Security Policies, follow the steps below:

1. Sign in to Zenconsole

2. Select the organization you want to manage.

3. Navigate to Policies > Internet Security Policies from the left navigation panel.

   Figure 2. Internet Security Policies Page

The Internet Security Policies page displays all policies configured within your organization. You can switch between the Gateways and Endpoints views to review the policies associated with each deployment type, check their status, and access their configuration.

Create New Policy

To create a new Internet Security Policy, follow the steps below:

1. Login to Zenconsole and then select the organization you want to manage.

2. Click Policies menu on the left sidebar.

3. On the Internet Security Policies page, click Create New Policy in the upper-right corner. The Create New Organization Policy dialog will appear.

   Figure 3. Create New Policy

   Figure 4. Create New Organization Policy Dialog

4. Type a descriptive name into the Name field.

5. Fill in the Description field.

6. Under Users, you may select one of the following options:

   • All users: Applies the policy to all users in the organization. This option is selected by default.
   • Select specific users: Applies the policy only to selected users. Select this option, click Add User, and choose the required users from the drop-down list.

7. Under Groups, you may select one of the following options:

   • All groups: Applies the policy to all groups in the organization. This option is selected by default.
   • Select specific groups: Applies the policy only to selected groups. Select this option, click Add Group, and choose the required groups from the drop-down list.

8. Enable Endpoint Control if the policy should apply to Zenarmor endpoints. When enabled, select one of the following options:

• All endpoints: Applies the policy to all endpoints in the organization.

• Select specific endpoints: Applies the policy only to selected endpoints. Select this option, click Add Endpoint, and choose the required endpoints.

  tip

  You may use the search toolbox to find a specific endpoint easily.

9. Enable Gateway Control if the policy should apply to Zenarmor gateways. When enabled, select one of the following options:

   • All gateways: Applies the policy to all gateways in the organization.
   • Select specific gateways: Applies the policy only to selected gateways. Select this option, click Add Gateway, and choose the required gateways.
   tip

   You may use the search toolbox to find a specific gateway easily.

   warning

   You must enable either a gateway control or an endpoint control in order to apply a policy on your organization's network. Otherwise, the policy does not match any traffic and filters nothing, even though it seems enabled and active.

10. Click Create to add a new policy.

The newly created policy appears at the top of the Internet Security Policies list in a disabled state.

Figure 5. Organization Policy List View

Configuring an Internet Security Policy

After creating a new policy, select its name from the Internet Security Policies list to open the policy configuration panel on the right side of the page.

The Configuration tab is displayed by default. From this tab, you can update the general policy settings and define the criteria that determine when and where the policy is applied.

Figure 6. Internet Security Policy Configuration

To configure an Internet Security Policy, follow the steps below:

1. Sign in to Zenconsole

2. Select the organization you want to manage.

3. Navigate to Policies > Internet Security Policies from the left navigation panel.

4. Select the policy you want to configure from the Internet Security Policies list.

5. From the Configuration tab, review or update the following settings:

   • Status: Enable or disable the policy.
   • Name: Rename the policy.
   • Description: Update the policy description.
   • Blanket Block Actions: Block all internet access or prevent untrusted devices from accessing the network. These settings override other configured policy rules and should be used carefully.
   • User and Group Matching Criteria: Define the users and groups to which the policy applies.
   • Endpoint Matching Criteria: Enable Endpoint Control and define the endpoints that should match the policy.
   • Gateway Matching Criteria: Enable Gateway Control and define the gateways that should match the policy.
   • Time-Based Matching Criteria: Define the days and time periods during which the policy should be active.

6. Use the policy configuration tabs at the top of the panel to configure the required security controls:

   • Navigate the Security tab to define security rules.
   • Navigate the Content Inspection to define content inspection rules
   • Navigate the App Controls tab to define application control rules.
   • Navigate the Web Controls tab to define web control rules.
   • Navigate the TLS Controls tab to enable full TLS inspection.
   • Navigate the Cloud Access tab to define Cloud Access Security Broker (CASB) rules.
   • Navigate the Exclusions tab to add blacklis and whitelist exclusions.

   Figure 7. Internet Security Policy Configuration Tabs

7. Review the configuration and enable the policy using the Status toggle.

8. Click Sync Now to apply the policy changes to the associated gateways and endpoints immediately.

   IMPORTANT NOTE

   Please note that all of the criteria listed below are matched with the AND logical operator. In order for a flow to match your configured policy, all of these criteria need to match the flow information. For instance, if you have a policy configuration specifying the 10.0.0.0/24 network, the em0 interface, and the 'Admins' group, all of these conditions should be met for a policy to be applied. If a packet is identified as belonging to the 'Admins' group but is on the ixl0 interface, the packet will not match this particular policy.

Enabling or Disabling a Policy

A newly created policy is disabled by default. Complete the policy configuration and review its matching criteria and security controls before enabling it.

You can enable or disable a policy using either of the following methods:

• Use the Status toggle next to the policy name in the Internet Security Policies list.

  Figure 8. Enabling or Disabling a Policy

• Open the policy and use the Status toggle at the top of the Configuration tab.

  Figure 9. Enabling or Disabling a Policy - 2

After changing the policy status, click Sync Now to apply the update immediately. Otherwise, the change will be applied during the next automatic synchronization cycle.

Changing the Policy Name

You can rename a custom Internet Security Policy from the Configuration tab.

note

The predefined Default policy cannot be renamed.

To change a policy name, follow the steps below:

1. Select the custom policy you want to rename from the Internet Security Policies list.

2. Make sure that the Configuration tab is selected.

3. Enter the new policy name in the Name field.

4. Click Sync Now to apply the change to the associated deployments immediately.

   Figure 10. Changing an Internet Security Policy Name

Restricting Internet Access

The Blanket Block Actions pane allows you to block all internet access for traffic matching the policy or prevent devices classified as Untrusted from accessing the internet.

To configure Blanket Block Actions, follow the steps below:

1. Select the policy you want to configure from the Internet Security Policies list.

2. Open the Configuration tab.

3. Expand the Blanket Block Actions pane.

4. Under No Internet, enable one of the following options based on your requirements:

   • Block all Internet access (overrides all configured policy rules): Blocks all internet connections for users and devices that match the policy, regardless of the Security, Content Inspection, App Control, Web Control, TLS Control, Cloud Access, or Exclusion rules configured in the policy.
   • Block Untrusted Devices: Prevents devices classified as Untrusted from accessing the internet. Newly detected devices are classified as Untrusted by default. Review and mark authorized devices as trusted when necessary to allow them to connect.

5. Click Sync Now to apply the change immediately.

   Figure 11. Blanket Block Actions

   warning

   Blanket Block Actions take precedence over other rules configured in the policy. Enable these options carefully to avoid unintentionally blocking internet access for matching users and devices.

Defining a User or Group-Based Policy

Zenconsole supports identity-based policy filtering using the users and groups configured in your organization. These matching criteria apply to supported Zenarmor endpoint deployments running on Windows, macOS, and Linux, as well as gateway deployments.

By default, a newly created policy applies to all users and groups.

To define user- or group-based matching criteria:

1. Select the policy you want to configure.

2. Navigate to the Configuration tab.

3. Expand User and Group Matching Criteria.

4. Under Users, select one of the following options:

   • All users to apply the policy to every user.
   • Select specific users to limit the policy to selected users. Click Add User, and then select one or more users.

5. Under Groups, select one of the following options:

   • All groups to apply the policy to every group.

   • Select specific groups to limit the policy to selected groups. Click Add Group, and then select one or more groups.

   Figure 12. Defining User and Group Matching Criteria

Defining an Endpoint-Based Policy

Endpoint matching criteria determine which Zenarmor endpoint deployments are associated with a policy. When endpoint control is enabled, the policy applies to all endpoints by default.

To define endpoint-based matching criteria:

1. Select the policy you want to configure.

2. Navigate to the Configuration tab.

3. Expand Endpoint Matching Criteria.

4. Enable Endpoint Control.

5. Under Endpoints, select one of the following options:

   • All endpoints to apply the policy to every endpoint in the organization.
   • Select specific endpoints to limit the policy to selected endpoints.

6. If you selected Select specific endpoints, click Add Endpoint, and then select one or more endpoints.

   Figure 13. Defining Endpoint Matching Criteria

Defining a Gateway-Based Policy

Gateway matching criteria determine which gateway deployments and network traffic are associated with a policy. These criteria are available for Zenarmor deployments running on OPNsense and other supported platforms in Layer 3 Routed Mode.

To define gateway-based matching criteria:

1. Select the policy you want to configure.

2. Navigate to the Configuration tab.

3. Expand Gateway Matching Criteria.

4. Enable Gateway Control.

   tip

   You may use Enable Gateway Control options to match gateway-specific criteria in conjunction with Zenarmor deployments running on OPNsense and other supported platforms in a Layer 3 Routed Mode.

5. Under Gateways, select one of the following options:

   • All gateways to apply the policy to every gateway in the organization.
   • Select specific gateways to limit the policy to selected gateways.

6. If you selected Select specific gateways, click Add Gateway, and then select one or more gateways.

   Figure 14. Defining Gateway-Based Policy

7. To limit the policy to interfaces associated with specific tags, click Add interface tag and select the applicable tags.

8. Under Connection Direction, specify whether the policy applies to:

   • Inbound traffic
   • Outbound traffic

9. Both directions are enabled by default.

10. To limit the policy to specific VLANs, click Add VLAN ID and add the applicable VLAN IDs.

You can further refine gateway matching by configuring the following criteria:

• Devices: Click Device to select individual devices or Device Category to select device categories.
• IP / Networks: Click Add IP / Network to add an IP address or network range.
• MAC Addresses: Click Add MAC Address to add a MAC address.

If you do not add specific values, the policy applies to all interface tags, VLAN IDs, devices, network addresses, and MAC addresses that satisfy the other configured matching criteria.

Figure 15. Configuring Additional Gateway Matching Criteria

Interface Tag-Based Filtering

Interface tags allow you to apply a policy only to traffic passing through interfaces associated with specific tags. If you do not select an interface tag, the policy applies to all interface tags that satisfy the other configured matching criteria.

To add an interface tag:

1. Locate the Interface Tags section under Gateway Matching Criteria.

2. Click Add interface tag.

3. Select one of the available predefined tags.

4. Alternatively, select Custom to use a custom interface tag.

5. Repeat these steps if you want to add more than one interface tag.

   Figure 16. Selecting an Interface Tag

Selected tags appear in the Interface Tags section. To remove a tag from the policy, click the X icon next to its name.

note

If you do not select any of the interfaces, the policy will be checked for network packets on all interfaces.

Selecting the Connection Direction

The Connection Direction setting determines whether the policy applies to inbound traffic, outbound traffic, or both.

By default, both directions are enabled:

• Inbound: Applies the policy to traffic entering through the matched gateway interfaces.
• Outbound: Applies the policy to traffic leaving through the matched gateway interfaces.

Use the toggle next to each direction to enable or disable it according to your policy requirements.

VLAN-Based Filtering

VLAN-based filtering allows you to apply a policy to network traffic associated with specific VLAN IDs. If you do not add a VLAN ID, the policy applies to all VLAN IDs that satisfy the other configured matching criteria.

To add a VLAN ID:

1. Locate the VLAN IDs section under Gateway Matching Criteria.
2. Click Add VLAN ID. The Add VLAN Id dialog appears.
3. Enter the VLAN ID in the VLAN Id field. (Warning: The VLAN ID must be a number between 1 and 4096.)
4. Click Add.

To exit without adding the VLAN ID, click Cancel.

Figure 17. Adding a VLAN ID

The added VLAN ID appears in the VLAN IDs section. Repeat these steps to add additional VLAN IDs.

Figure 18. Added VLAN ID

To remove a VLAN ID:

1. Click the X icon next to the VLAN ID you want to remove.
2. Review the VLAN ID in the warning dialog.
3. Click Remove to confirm.

To keep the VLAN ID and close the dialog, click Cancel.

Device-Based Filtering

Device-based filtering allows you to apply the policy to individual devices discovered on your network. You can select discovered devices or manually add a custom device.

If you do not add a device or device category, the policy applies to all devices that satisfy the other configured matching criteria.

To add discovered devices to the policy:

1. Under Gateway Matching Criteria, locate the Devices section.
2. Click Device. The Add Device dialog displays the devices discovered on your network.
3. Use the Search devices field to find a specific device, if necessary.
4. Select one or more devices.
5. Click Add.

The number displayed on the Add button indicates how many devices are currently selected.

Figure 19. Adding Devices

To manually add a device that is not displayed in the discovered device list:

1. Open the Add Device dialog.
2. Click Add Custom Device.
3. Enter the device identifier in the Device ID field.
4. Optionally, enter information about the device in the Description field.
5. Click Add.

To return to the discovered device list without adding a custom device, click Select from List.

Figure 20. Adding a Custom Device

Device Category-Based Filtering

Device category-based filtering allows you to apply the policy to groups of devices that share the same category, such as cameras, desktops, IoT devices, laptops, mobile devices, network equipment, printers, or servers.

To add device categories to the policy:

1. Under Gateway Matching Criteria, locate the Devices section.
2. Click Device Category.
3. In the Add Device Category dialog, open Select from List.
4. Use the Search field to find a specific category, if necessary.
5. Select one or more device categories.
6. Click Add.

Selected categories appear below the list, and the number displayed on the Add button indicates how many categories are selected.

Figure 20. Selecting Device Categories

After you add the categories, they appear under Categories in the Devices section. To remove a category from the policy, click the X icon next to its name.

Managing Device-Based Filtering

Devices added to the policy are listed under Devices. The list displays the device identifier, description, status, and available actions.

Figure 21. Devices Added to the Policy

Click the three-dot menu under the Actions column to perform the following operations:

• Edit: Update the description of the device.
• Enable/Disable: Temporarily include or exclude the device from policy matching without removing it from the list.
• Remove: Permanently remove the device from the policy configuration.
• Device Details: View additional information about the device.

Updating a Device Description

To update the description of a device:

1. Locate the device you want to update under Devices.

2. Click the three-dot menu under the Actions column.

3. Select Edit.

4. Update the Description field.

5. Click Save.

   

   Figure 21. Updating a Device Description

Removing a Device from the Policy

To remove a device from the policy:

1. Locate the device you want to remove under Devices.
2. Click the three-dot menu under the Actions column.
3. Select Remove. A confirmation dialog appears.
4. Click Remove to confirm the operation. To keep the device in the policy, click Cancel.

After you confirm the operation, the device is removed from the policy configuration.

Enabling or Disabling a Device

Disabling a device temporarily excludes it from the policy matching criteria without removing its entry. You can enable the device again when you want the policy to apply to it.

To enable or disable a device:

1. Locate the device under Devices.
2. Click the three-dot menu under the Actions column.
3. Select Enable or Disable, depending on the current device status.

A green status indicator represents an enabled device, while a gray status indicator represents a disabled device.

Viewing Device Details

To view additional information about a device:

1. Locate the device under Devices.
2. Click the three-dot menu under the Actions column.
3. Select Device Details.

Removing a Device Category

Device categories added to the policy are displayed under Categories in the Devices section.

To remove a device category, click the X icon next to the category name. The category is then removed from the policy matching criteria.

IP/Network Address-Based Filtering

IP/network address-based filtering allows you to apply a policy to specific IPv4 or IPv6 addresses and network ranges.

You can enter a single IPv4/IPv6 address or define a network by using CIDR notation, such as 172.10.10.0/24. You can also provide a description to help identify the purpose of each entry.

If you do not add an IP address or network, the policy applies to all network addresses that satisfy the other configured matching criteria.

To add an IP address or network:

1. Under Gateway Matching Criteria, locate the IP / Networks section.

2. Click Add IP / Network. The Add Network dialog appears.

3. Enter an IPv4/IPv6 address or network range in the IP / Network address field.

4. Optionally, enter information about the entry in the Description field.

5. Click Submit.

   

   Figure 22. Adding an IP Address or Network to the Policy

Added entries are listed under IP / Networks. The list displays the IP address or network, description, status, and available actions.

Figure 23. Added IP/Network Address List on Policy

Click the three-dot menu under the Actions column to perform the following operations:

• Edit: Update the IP/network entry or its description.

• Enable/Disable: Temporarily include or exclude the entry from policy matching.

• Remove: Permanently remove the entry from the policy configuration.

  

  Figure 24. Actions menu for IP/Network Address List on Policy

Updating an IP/Network Entry

To update an IP/network entry:

1. Locate the entry you want to update under IP / Networks.
2. Click the three-dot menu under the Actions column.
3. Select Edit.
4. Update the applicable fields.
5. Click Save.

Enabling or Disabling an IP/Network Entry

Disabling an IP/network entry temporarily excludes it from the policy matching criteria without removing it from the list.

To enable or disable an entry:

1. Locate the entry under IP / Networks.
2. Click the three-dot menu under the Actions column.
3. Select Enable or Disable, depending on the current status.

A green status indicator represents an enabled entry, while a gray status indicator represents a disabled entry.

Removing an IP/Network Entry

To remove an IP/network entry from the policy:

1. Locate the entry you want to remove under IP / Networks.
2. Click the three-dot menu under the Actions column.
3. Select Remove. A confirmation dialog appears.
4. Click Remove to confirm the operation. To keep the entry in the policy, click Cancel.

After you confirm the operation, the IP/network entry is removed from the policy configuration.

MAC Address-Based Filtering

MAC address-based filtering allows you to apply a policy to specific MAC addresses. You can also provide a description for each entry to help identify the associated device.

Supported MAC address formats include:

• aa:aa:aa:aa:aa:aa
• aa-aa-aa-aa-aa-aa
• aaa.aaa.aaa.aaa

If you do not add a MAC address, the policy applies to all MAC addresses that satisfy the other configured matching criteria.

To add a MAC address, follow these steps below:

1. Under Gateway Matching Criteria, locate the MAC Addresses section.

2. Click Add MAC Address. The Add MAC Address dialog appears.

3. Enter the MAC address.

4. Optionally, enter information about the entry in the Description field.

5. Click Submit.

   

   Figure 25. Adding a MAC Address to the Policy

Added MAC addresses are listed under MAC Addresses. The list displays the MAC address, description, status, and available actions.

Figure 26. MAC Addresses Added to the Policy

Click the three-dot menu under the Actions column to perform the following operations:

• Edit: Update the description associated with the MAC address.

• Enable/Disable: Temporarily include or exclude the MAC address from policy matching.

• Remove: Permanently remove the MAC address from the policy configuration.

  

  Figure 27. Managing MAC Address Entries

Updating a MAC Address Entry

To update the description associated with a MAC address:

1. Locate the entry you want to update under MAC Addresses.

2. Click the three-dot menu under the Actions column.

3. Select Edit.

4. Update the Description field.

5. Click Save.

   

   Figure 28. Updating a MAC Address Entry

Enabling or Disabling a MAC Address Entry

Disabling a MAC address temporarily excludes it from the policy matching criteria without removing it from the list.

To enable or disable a MAC address:

1. Locate the entry under MAC Addresses.
2. Click the three-dot menu under the Actions column.
3. Select Enable or Disable, depending on the current status.

A green status indicator represents an enabled MAC address, while a gray status indicator represents a disabled MAC address.

Removing a MAC Address Entry

To remove a MAC address from the policy:

1. Locate the entry you want to remove under MAC Addresses.
2. Click the three-dot menu under the Actions column.
3. Select Remove. A confirmation dialog appears.
4. Click Remove to confirm the operation. To keep the entry in the policy, click Cancel.

After you confirm the operation, the MAC address is removed from the policy configuration.

Defining a Time Schedule

Time-based matching criteria allow you to limit when a policy applies. If no time schedule is specified, the policy is not restricted by day or time.

To add a time schedule:

1. Select the policy you want to configure.

2. Navigate to the Configuration tab.

3. Expand Time-Based Matching Criteria.

4. Click Add New Schedule.

   Figure 29. Time-Based Matching Criteria

5. Enter a descriptive name in the Time schedule name field.

6. Click Add.

   Figure 30. Adding a New Time Schedule

7. Select the days on which the policy should apply.

8. Set the start and end times for the schedule. A newly added schedule initially covers the period from 00:00 to 23:59.

Modifying or Removing a Time Schedule

You can modify an existing schedule directly under Time-Based Matching Criteria:

• Select or clear days to change the days on which the policy applies.
• Update the start or end time to change the active period.
• Click the trash icon next to the schedule to remove it.

After completing the policy configuration, enable the policy and click Sync Now to synchronize the changes with the associated deployments.

Synchronizing Policies

Zenconsole automatically synchronizes policies with all associated gateways and endpoints every 15 minutes. If a gateway or endpoint is offline, it is automatically synchronized when it comes back online.

If you have made policy changes and want to apply them immediately without waiting for the next automatic synchronization cycle, you can manually initiate the synchronization process.

To synchronize policies manually:

1. Sign in to Zenconsole.

2. Select the organization you want to manage.

3. Navigate to Policies > Internet Security Policies from the left navigation panel.

4. Click Sync Now in the upper-right corner of the page.

   Figure 31. Sync Now Button on the Internet Security Policies Page

The Sync All Instances Now dialog appears. This dialog explains the automatic synchronization schedule and allows you to initiate synchronization immediately.

5. Click Sync Now in the dialog to synchronize the latest policy configuration with all gateways and endpoints in the organization.
   To close the dialog without initiating synchronization, click Cancel.

   Figure 32. Synchronizing All Gateway and Endpoint Instances

note

Manual synchronization applies to all gateways and endpoints in the organization, regardless of the deployment currently selected under View As.

Checking Policy Synchronization Status

You can check whether policies have been successfully synchronized with a specific gateway or endpoint from the Internet Security Policies page.

To check the synchronization status:

1. Navigate to Policies > Internet Security Policies.
2. Under View As, select the gateway or endpoint whose policies you want to review.
3. Locate the synchronization status icon on the right side of each policy, next to the policy status toggle.
4. Hover over the synchronization status icon.

A blue check mark with the Synced tooltip indicates that the policy has been successfully synchronized with the selected gateway or endpoint.

If the Synced status is not displayed, click Sync Now to initiate synchronization. If the selected gateway or endpoint is offline, it will be synchronized automatically when it comes back online.

Figure 33. Checking Policy Synchronization Status