Exclusions on Zenconsole

Published on: Aug 07, 2026

.

2 min read

Zenconsole allows you to define destination-based exclusions for Internet Security Policies. Exclusions can be used to allow or block connections to specified IP addresses, network ranges, hostnames, and domains.

An exclusion can be added to either of the following lists:

• White list: Allows users and traffic that match the policy to access the specified destination.
• Black list: Prevents users and traffic that match the policy from accessing the specified destination.

Exclusions are useful for reducing false positives, allowing business-critical destinations, and blocking specific destinations that require more restrictive handling.

IMPORTANT

Exclusions take precedence over the Security, App Controls, and Web Controls rules configured in the policy. Add whitelist and blacklist entries carefully to avoid unintentionally allowing or blocking traffic.

Exclusions are useful for reducing false positives, allowing business-critical destinations, and blocking specific destinations that require more restrictive handling.

To access the Exclusions configured for an Internet Security Policy:

1. Sign in to Zenconsole.
2. Select the organization that you want to manage.
3. Navigate to Policies > Internet Security Policies.
4. Select the policy that you want to configure.
5. Navigate to the Exclusions tab.

The Exclusions page contains the Add New Exclusions and All Exclusions sections.

Figure 1. Managing Policy Exclusions

Adding an Exclusion

You can add an IP address, network range, hostname, or domain to the policy's whitelist or blacklist.

To add an exclusion, follow the steps below:

1. Enter the destination in the Address or domain field.

   Supported values include:

   • IPv4 or IPv6 addresses, such as 172.16.1.1
   • Network ranges in CIDR notation, such as 10.10.0.0/16
   • Domains, such as example.com
   • Hostnames, such as host.example.com

2. Under List, select one of the following options:

   • White list to allow access to the destination.
   • Black list to block access to the destination.

   White list is selected by default.

3. Optionally, enter information about the exclusion in the Description field.

4. Enable Global if you want to apply the exclusion globally instead of limiting it to the current policy.

5. Leave Share this with the Zenarmor team to improve web categorization selected if you want to share the exclusion with Zenarmor for web categorization feedback. Clear the checkbox if you do not want to share it.

6. Click Add exclusion.

The new entry appears under All Exclusions. Whitelist entries are identified by a green shield icon, while blacklist entries are identified by a red shield icon. Globally applied entries also display a Global label.

Figure 2. Added Whitelist and Blacklist Exclusions

tip

When adding a domain, consider whether any of its subdomains are assigned to different application or web categories. If a subdomain is categorized differently from its root domain, add the subdomain as a separate exclusion.

Importing Exclusions from a CSV File

You can add multiple exclusions at once by importing a CSV file.

To import exclusions, follow the steps below:

1. Navigate to Policies > Internet Security Policies.
2. Select the policy that you want to configure.
3. Navigate to the Exclusions tab.Click Upload CSV file in the Add New Exclusions section.
4. In the Import Exclusions dialog, click Download CSV Schema to download the required template.
5. Complete the CSV file without modifying its column headers.
6. Drag and drop the completed file into the upload area, or click Upload File and select it.
7. Review the uploaded file.
8. Click Import.

You can click Reset to remove the selected file and upload another one.

Figure 3. Importing Exclusions from a CSV File

The CSV template contains the following columns:

Column	Description
Hostname/IP	IP address, CIDR range, hostname, or domain to add.
List	List assignment, such as Whitelisted or Blacklisted.
Scope	Exclusion scope, such as Local or Global.
Description	Optional information describing the entry.
Send Feedback	Determines whether the entry is shared with Zenarmor for categorization feedback. Use TRUE or FALSE.

note

Save the completed template as a CSV file before uploading it. Do not rename, remove, or reorder the required column headers.

Viewing and Filtering Exclusions

All configured entries are displayed under All Exclusions.

Use the available tabs to filter the list:

• All: Displays whitelist and blacklist entries.
• White list: Displays only whitelist entries.
• Black list: Displays only blacklist entries.

The list provides the following information:

• Address or domain: The IP address, CIDR range, hostname, or domain included in the exclusion.
• Description: The description entered when the exclusion was created.
• Action: Provides the option to remove the exclusion.

A Global label appears next to entries configured with global scope.

You can click the arrow next to Address or domain to change the sorting direction.

Searching for an Exclusion

Use the Search field in the All Exclusions section to locate a specific entry.

Enter all or part of an IP address, hostname, domain, or description. The list is filtered as you type. You can combine the search with the All, White list, or Black list tabs to narrow the results further.

Exporting Exclusions

You can export the existing exclusions for backup or reuse.

To export exclusions:

1. Navigate to the Exclusions tab of the policy.
2. Scroll to the bottom of the All Exclusions section.
3. Click Export exclusions.

Zenconsole downloads the configured exclusions as a file that can be retained as a backup or used when preparing another import.

Figure 4. Exporting Exclusions

Deleting an Exclusion

To delete an exclusion:

1. Locate the exclusion under All Exclusions. You can use the tabs or the Search field to find it.
2. Click the trash icon in the Action column.
3. Review the confirmation message.
4. Click Remove.

Click Cancel if you do not want to delete the exclusion.

Figure 5. Exclusion Delete Warning

Applying Exclusion Changes

Changes to exclusions are automatically synchronized with associated gateways and endpoints within a maximum of 15 minutes.

To apply the changes immediately, return to the Internet Security Policies page, click Sync Now, and confirm the synchronization request.