Describes how policy compliance checks compare policy application lists with the currently loaded Protocol Pack to identify reclassified or renamed applications and overly broad matches, helping preserve policy intent as Protocol Packs evolve.
A policy compliance check is a verification process that
-
determines whether policies match applications that have become classified in a more granular fashion in a later Protocol Pack release
-
checks for renamed applications, and
-
checks for policies that match traffic broadly by transport protocol, such as http.
Check policy compliance
Various types of policies specify application traffic to match by using application lists, which contain one or more applications. The applications in application lists may be from a Protocol Pack or may be user-defined custom applications. As new Protocol Packs are released, changes occur to the protocol set. These changes may include adding applications that provide more granular classification of existing applications, renaming applications, and so on.
For example, an earlier Protocol Pack may include an application that captures all traffic for a set of services. A later Protocol Pack may include separate applications for different components of the services to provide more granular classification of the traffic. To illustrate with a fictional example, an application x-media might be broken into x-audio and x-video for more granular classification.
When checking the applications in a policy, Cisco SD-WAN Manager compares them with the applications in the Protocol Pack currently loaded in Cisco SD-WAN Manager. This check keeps the policy intent intact after new applications are added.
If Cisco SD-WAN Manager detects a compliance issue with a policy, it displays the affected policies and relevant new applications.