Cisco
Login
Search
Software Secure Workload
Activity Configure

Manage Policy Lifecycle in Secure Workload Enforce Policies Enable Policy Enforcement

Last updated: Jun 09, 2025

Enable Policy Enforcement


 

Enforcing policies delete existing firewall rules and write new firewall rules on every workload in the scope that is affected by this workspace.

If you have not properly verified that your policies are working correctly, enforcing policies can change the way that your applications work and disrupt business operations.

Before you begin

  • Initially, when you enforce policies, consider setting the catch-all to Allow. Then, monitor traffic to see what matches the catch-all rule. When no necessary traffic is matching the catch-all rule, you can set the catch-all to Deny.

  • If you enforce workspaces in multiple scopes at once, you can enforce only analyzed workspaces. If you enforce a single workspace using the second method that is described in the procedure below, analyzing the policies in the workspace before you enforce them is recommended but not required.

    See Live Policy Analysis and subtopics.

  • The wizard for enforcing a single scope is more detailed than the wizard that offers the option to enforce multiple scopes simultaneously. If you require the features in Policy Enforcement Wizard, use the second method that is described in the procedure below.

  • IMPORTANT! Verify that the policies are correct.

    Policy results in any workspace may be affected by enforced policies in other scopes. Before policy enforcement is enabled on a workspace, the Policy Enforcement page shows how flows are affected by enforced policies in the workspaces associated with other scopes. For example, a broad “Production hosts should not talk with Non-Production hosts” policy in the enforced workspace of a parent scope may impact traffic on workloads belonging to an application in a child scope.

    If no new information is being shown in the Enforcement charts, make sure that the correct time range is selected.

    For information about the information you see on the Enforcement page, see Live Analysis Live Policy Analysis and subtopics. (The same information for Live Analysis also applies to the Policy Enforcement page.)

    If live analysis results differ from results on the Enforcement page, make sure the scopes, policy versions, and time range being analyzed are the same as the scopes, policy versions, and time range being used to generate results on the Enforcement page.

  • Understand how agents enforce policies on each platform. See:

  • You must have the required permissions to enforce policies. Ensure you have the ability to enforce or higher access for the scopes. Users with other abilities on the scope can still view this page, but will not be able to enforce (or disable) new policies.

  • Verify that all relevant installed agents and other enforcement endpoints such as cloud connectors are ready to enforce policy. For a list of agent health and readiness checks, see Check Agent Health and Readiness to Enforce.


 

Some of these checks must wait until after enforcement; for example, you should enable enforcement on cloud connectors only after you have enabled enforcement in the workspace. For installed agents, you will typically enable enforcement in the agent configuration before you enforce the workspace.

Procedure

1

From the navigation pane, choose Defend > Segmentation.
2

You can enforce policies for one scope or for multiple scopes at the same time:

To enforce policy for multiple scopes at the same time:

(Only workspaces that have been analyzed can be enforced using this process.)

  1. Click the caret on the right side of the page to display the Tools pane:

  2. Click Enable Enforcement.

  3. Click Next to start the wizard.

  4. Select one workspace to enforce.

    (The option to enforce workspaces for additional scopes is on the last page of the wizard.)

  5. Click Next.

  6. Choose the version of that workspace to enforce, then click Next.

  7. To simultaneously enforce policies for another scope, click + Add Another Workspace and complete the steps.

    Repeat as needed for additional scopes.

  8. Click Accept and Enforce.

To enforce policies for a single scope:

  1. Navigate to the primary workspace for the scope for which you want to enforce policy.

  2. Click Manage Policies.

  3. Click Enforcement.

  4. Click Enforce Policies.

  5. Step through the wizard.

    For wizard details, see Policy Enforcement Wizard.
3

Click Accept and Enforce on the final page of the wizard to push new firewall rules to the assets that are affected by policies in this workspace. A label flag is created at the time of enforcement:

Policy Enforcement page showing Label flag after enforcement
Figure 1: Policy Enforcement Page with Enforcement Enabled

You may need to refresh the page to see the flag.

What to do next

Previous topic Check Agent Health and Readiness to Enforce Next topic Policy Enforcement Wizard