Netwise/docs/examples/policy.example.json at main · ARSH871-bot/Netwise · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
{
  "device": "rtr-us5",

  "policy_compliance": [
    {
      "number": 1,
      "description": "The LAN may reach only the two approved servers",
      "kind": "prohibition",
      "filter": "acl_in",
      "violation_severity": "high",
      "violation_summary": "The internal network can reach servers it should not",
      "queries": [
        {
          "srcIps": "10.10.10.0/24",
          "dstIps": "0.0.0.0/0 \\ (218.8.104.58, 10.20.0.5)"
        }
      ]
    },
    {
      "number": 2,
      "description": "The internal server is reachable only over HTTPS",
      "kind": "prohibition",
      "filter": "acl_in",
      "violation_severity": "high",
      "violation_summary": "The internal server accepts traffic other than HTTPS",
      "queries": [
        {
          "srcIps": "10.10.10.0/24",
          "dstIps": "10.20.0.5",
          "ipProtocols": ["!tcp"]
        },
        {
          "srcIps": "10.10.10.0/24",
          "dstIps": "10.20.0.5",
          "ipProtocols": ["tcp"],
          "dstPorts": "0-442,444-65535"
        }
      ]
    },
    {
      "number": 4,
      "description": "DNS to the approved resolver must work",
      "kind": "requirement",
      "filter": "acl_in",
      "violation_severity": "medium",
      "violation_summary": "DNS to the approved resolver is blocked, so name lookups fail",
      "queries": [
        {
          "srcIps": "10.10.10.0/24",
          "dstIps": "218.8.104.58",
          "ipProtocols": ["udp"],
          "dstPorts": "53"
        }
      ]
    }
  ]
}