Policies

The Policies page provides a unified space for administrators to define and manage the rules that govern how traffic flows through a site. A single policy can apply to more than one network, client, or application at the same time. Tasks such as firewall configuration, controlling application access, port forwarding, and scheduling network availability are all managed as policies.

A policy is defined by the rule it contains. Each rule combines an Action (such as Allow, Block, Restrict, Enable, Disable, or Forward) with a Source (for example a network, a client, or an IP address) and, when the action requires it, a Destination (for example the Internet, a domain, an IP address, another network, or an application category). Optional conditions — selected protocols, bandwidth limits, and traffic priority — and an optional schedule further refine the rule. The behavior of a policy is therefore determined entirely by the rule inside it.

An Instant On site supports a maximum of 64 policies. Policies are evaluated in priority order, from highest to lowest. When more than one policy applies to the same element, the policy with the higher priority takes effect and lower-priority policies that conflict with it are ignored.

Instant On supports policy creation using the following methods:

• Manual policy creation—Build the rule manually by selecting the action, source, destination, and optional conditions. For more information, see Manual Policy Creation.
• AI-Assisted policy creation—Describe the intended behavior in plain language, and the Assistant translates it into a concrete policy. For more information, see Creating a Policy.

Policy Deployment

In HPE Networking Instant On network, policies are applied dynamically based on the site’s topology, so that rules are enforced where they are most effective. Wherever possible, the system enforces policies on the Instant On edge devices — the devices at the periphery of the topology — which minimizes latency and reduces reliance on centralized devices. The system balances enforcement between edge and centralized devices using techniques such as tiered enforcement and lightweight processing, so that each site operates optimally within its environment.

The HPE Networking Instant On network applies the configured rules for a site in the following order:

1. Configured Policies—The rules defined by administrators on the Policies page. They are applied first, in the priority order shown in the policy list.
2. Network Access Controls—Access restrictions configured per network on the Access Control tab (Networks > Access Control), based on destination. When configured, these take precedence over the site’s default rules. For detailed instructions, refer to the Networks documentation.

3. Default rules—Applied only on sites with a deployed secure gateway. These rules are not shown in the user interface and include the following:

   • All LAN ports are granted access to the internet by default.
   • Communication between LAN networks are blocked by default.
   • All application categories are permitted on all networks by default.

Overview

The Policies > Overview section displays the list of policies created for the site, in order of their highest to lowest priority. The policy details are categorized under the following fields:

Table 1: Policy List

Field	Description
Priority	The order in which policies are evaluated. The list is shown in decreasing order of priority, with 1 being the highest.
Policy	The name of the policy.
Action	The action performed by the policy’s rule: Enable, Disable, Allow, Block, Restrict, or Forward. Denotes the action to be performed by the policy: Enable—Makes an entity type available. Disable—Makes an entity type unavailable. Allow—Allows an entity type. Block—Blocks an entity type. Restrict—Restricts an entity type. Available on gateway and switch-only sites; on switch-only sites the destination is limited to a specific IP address or subnet. Forward—Forward an entity type. This action is available only for gateway sites.
Rule	A summary of the rule, showing the source and, where applicable, the destination the action applies to (for example, a network, a client, an IP address, an application category, or a forwarded port).
State	The current state of the policy (see the state descriptions below).
Schedule	The schedule during which the policy is active. Displays None when the policy is always active.

A policy can be in one of the following states:

• Active—The policy is enabled and being enforced.
• Inactive—The policy is disabled and is not enforced.
• Incomplete—The policy is missing required configuration and cannot be enforced until it is corrected. When a site contains one or more incomplete policies, a banner is displayed at the top of the page Some policies are incomplete and require adjustments.
• No Target Devices—No device currently in the site can enforce the policy — for example, the networks or devices that the rule targets are not present.

The Policies page provides the following actions:

• Create Policy—Build a policy manually. See Manual Policy Creation.
• Assistant—Create a policy from a natural-language description of the intended behavior. See AI-Assisted Policy Creation.
• Reorder—Change the priority order of the policies.

To manage an existing policy, hover the cursor over the policy, click the button, and select View Details to open the policy, or Delete to remove it.

Reordering Priority

The policies are listed from highest to lowest priority. To change the order:

1. Under Policies > Overview, click Reorder.
2. Use the and icons to move each policy to the required priority.
3. Click Update.

Deleting a Policy

1. Click the Policies tile on the Instant On web application home page, or click Policies from the navigation pane on the left.
2. Under Policies > Overview, hover the cursor over the network you want to delete, click the button, and select Delete from the drop-down list.
3. Click Delete Policy from the pop-up window.

Policy Capabilities by Topology

Policies can be created on any site, but the available rules depend on the devices deployed in the site. As the topology gains capabilities — for example when a switch or an Instant On secure gateway is added — additional actions, sources, and destinations become available.

A gateway topology is any site that includes an Instant On secure gateway (for example, gateway only, switch and gateway, access point and gateway, or access point, switch, and gateway). Gateway topologies support the complete set of policy capabilities, including client sources, network and application destinations, port forwarding, bandwidth limits, and traffic priority.

The following table summarizes the source-to-destination combinations supported for each action, and the topologies in which they are available.

Table 2: Policy List

Action	Source	Destination	Available In
Enable / Disable	Wireless, wired, or VPN network	Not applicable (controls network availability)	Not applicable (controls network availability)
Allow / Block	Wireless network	Application category	Topologies with an access point.
Allow / Block / Restrict	Wired network	Application category	Gateway topologies
Allow / Block / Restrict	IP subnet or IP address	IP subnet or IP address	All topologies
Allow / Block / Restrict	Wired network	IP subnet or IP address	Switch only, access point + switch, and gateway topologies
Allow / Block / Restrict	Wired or VPN network	Internet, domain, same network, IP subnet or address, or a Wired / VPN network	Gateway topologies
Allow / Block / Restrict	Client	Internet, domain, or a Wired / VPN network	Gateway topologies
Allow / Block / Restrict	IP subnet or IP address	Internet, domain, or a wired/VPN network	Gateway topologies
Forward(Port Forwarding)	WAN: Internet, IP subnet, or IP address	LAN IP address and port	Gateway topologies

Enabling or disabling a VPN network requires an Instant On secure gateway.