External Dependencies
External dependencies are relevant only when you use the process that is described in (Advanced) Create Cross-Scope Policies.
External Dependencies settings apply to automatically discovered policies involving communications to and from workloads that are members of a scope other than the scope in which policies are discovered. (That is, communications involving "external workloads.")
A workload that is not a member of the scope in which the policy exists is an external workload. Such workloads are the other end of a conversation with a target workload (which is a member of the scope in which the policy exists).
The External Dependencies list is an ordered list of all scopes in your hierarchy. Each scope in the list is set to one of the following:
-
Generate specific or refined policies (more secure), OR
-
Generate coarse policies in higher scopes, which may generalize better (that is, be more likely to allow legitimate flows that were not seen in the time range that is specified when discovering policies).
During policy discovery, the first scope (or cluster, or inventory filter – see below) that matches the workload will be used to generate the “allow” policy, where the matching order (and consequent granularity level) is determined by the top-down ranking that is displayed in the External Dependencies section.
A default scope order is configured for you, with all scopes set to "Coarse" by default.
|
To |
Do This |
|---|---|
|
View or fine-tune external dependencies for a workspace: |
Navigate to the workspace and click Automatically Discover Policies, then click External Dependencies. To reorder the scopes and choose granular options for each, see Fine-Tune External Dependencies for a Workspace. |
|
Configure default external dependencies for an entire root scope: |
External Dependencies: Granular Policies Involving Subsets of Scopes
You can optionally discover policies at a more granular level than scope-to-scope, to control traffic to a specified subset of the workloads in a scope.
For example, you may want to create policies specific to a certain type of host within an application, such as API servers; you can group those workloads into a subset within the application scope.
To generate policies specific to a subset of workloads within a scope, see Fine-Tune External Dependencies for a Workspace.