Now that you know what you're building and why, you can start to build your own scope tree.

Before you continue, you need to choose the application to work with. See the guidelines at Choose An Application for This Wizard.

Note that when you run the wizard, you won't be able to return to these informational pages unless you restart the wizard.

The internal scope includes all IP addresses that define your organization's internal network, including public and private IP addresses.

The wizard walks you through adding IP addresses to each scope in the tree branch. As you add addresses, the wizard assigns to each address the labels that define that scope.

Organization = Internal

By default, the wizard adds the IP addresses in the private internet address space as defined in RFC 1918.

You don't have to add all of the IP addresses in your internal network now, but you must include the IP addresses associated with your chosen application, and you should include as many others as you can easily include. You can add the rest later.

This scope includes the IP addresses that define your on-premises data centers.

You can change the scope name, but keep the meaning the same. Scope names should be short and meaningful.

On this page, the IP addresses you enter must be a subset of the addresses for your internal network that you entered on the previous page. You must also include the IP addresses associated with your chosen application, and ideally you should include other addresses that represent workloads in your data centers – but it's OK to continue without them if you don't have those available. (If you have multiple data centers, you will include all of them in this scope so you can define a single set of policies.) You can always add more addresses later.

Organization = Internal

Infrastructure = Data Centers

This scope includes IP addresses of non-production applications and hosts, such as development, lab, test, or staging systems. It should NOT include addresses of any applications that you're using to conduct actual business, which will be part of the Production scope that you define later.

The IP addresses you enter on this page must be a subset of the addresses you entered for your data centers, and they must again include the addresses of your chosen application. Ideally, they should also include pre-production addresses that are not part of your chosen application. Again, you can add more addresses later.

"Application 1" is an application you choose. See guidelines at Choose An Application for This Wizard. An application consists of multiple workloads.

Add the IP addresses of the workloads that comprise your application. For example, include databases, web services, backup volumes, standby instances in high availability deployments, etc. You can add more addresses later, but you should try to include most of them now.

On the left, you see a different representation of the same scope tree that is shown on the other pages. You can expand and collapse branches, and scroll down to click a specific scope.

On the right, you see the IP addresses and labels assigned to the workloads in the scope you've clicked on the left. The column headings are the label keys, and the table cells show the label values.

In the image above, the top-level scope is selected, so you see the data for all IP addresses you specified in the wizard. The empty cells in the table are awaiting future labeling, for example for workloads that are not in your data center or are part of non-production applications other than your chosen application.

If you want to view this information after you've exited the wizard, choose Organize > Scopes and Inventory from the menu on the left side of the window.

Install Agents

You should install Secure Workload agents as soon as possible on the workloads associated with your chosen application. The data that the agents gather is used to generate suggested policies based on the existing traffic on your network. More data produces more accurate policies. For details, see Install Agents on Workloads.

Generate Policies

After you've installed agents and allowed at least a few hours for traffic flow data to accumulate, you can tell Secure Workload to generate ("discover") policies based on that traffic. For details, see Automatically Generate Policies.

Other

If you use the navigation bar at the left of the window, be sure to open new pages in a separate window or tab, or you won't be able to return to this page.

Take a look at the discovered policies. (If you have navigated away from the page, you can return to it by following the steps in View Policies.)

Do the policies make sense? The labels should help you understand the type of hosts each workload is communicating with.

Do you see any mysteries? See if you can find out what the mystery workloads or communications are.

You can ask a colleague who is familiar with this application to evaluate the suggested policies.

As flow data accumulates, you should extend the configured time range and discover policies again, as often as needed to generate policies that address your traffic.