Barracuda SecureEdge allows administrators to define a number of policies that specify the access requirements associated with the various resources that the Barracuda SecureEdge Access Agent can connect to. As with SD-WAN and security policies, there is a zero trust access policy per workspace or tenant. The Barracuda SecureEdge Access Agent allows users or groups of users to connect to different resource types like custom apps or public endpoints such as SaaS services. The policies also define the security attributes, such as the security inspection and device posture of the device itself, that must be in place to grant access. A zero trust access policy defines the resources made available to end users of the Barracuda SecureEdge Access Agent and the associated access restrictions. 

Before You Begin

• If you want to use the users or groups from user directories (such as Microsoft Entra ID, LDAP, Google Workspace, Okta, SCIM, and Barracuda Cloud Control) for SecureEdge Access, you must first connect your SecureEdge Identity Management in order to synchronize users and groups. For more information, see Identity Management. 

• If you want to select users or groups from user directories such as BCC-linked Microsoft Entra ID or the BCC-linked LDAP directory in the zero trust access policies, you must first connect your directory with Barracuda Cloud Control in order to synchronize users and groups. For more information, see LDAP Active Directory and Microsoft Entra ID and How to Connect Microsoft Entra ID with Barracuda Cloud Control.

Create a ZTNA Policy

1. Go to https://se.barracudanetworks.com and log in with your existing Barracuda Cloud Control account.

2. The chosen Tenant/Workspace is displayed in the top menu bar.

   Open

   

3. Click the expandable drop-down menu and select the workspace you want to configure a zero trust access policy for.

4. In the left menu, go to Security > ZTNA and click Policies.

   Open

   

5. The ZTNA Policies page opens. To create a new zero trust network access policy, click Add policy.

   Open

   

6. The Create ZTNA Policy window opens. In the Policy tab, specify values for the following:

   • Name – Enter a unique name for the policy.

   • Description – Enter a brief description.

   • In the RESOURCES section, specify values for the following:

     • Resources Type – Select a resource type. You can choose between Internal resources (custom apps) and Public endpoint (SaaS). Note: Select either Internal resources for resources that are accessible internally via a point of entry or Public endpoints for publicly accessible resources.

       • If you select the Internal resources (custom apps), the Security Inspection field is disabled by default. 

       • If you select the Public Endpoint (SaaS), the Security Inspection  field is optional.

     • Resources – Select a resource from the drop-down list, or type to search.

   • In the ACCESS CRITERIA section, specify values for the following:

     • All Users – Click to enable/disable. By default, All Users is enabled. Note: If All Users is enabled, the selected apps are accessible to all. You can set the device posture for All Users directly.

       • When All Users is disabled, specify values for the following:

         • Users – Select a user from the drop-down list, or type to search. For example, in this case, since the All Users field is disabled, you can select a user or groups.

         • Groups – Select a group from the drop-down list, or type to search.

     • Re-Authentication – Click to enable/disable. You must enforce authentication before granting users access to resources via ZTNA. Note: To enable the Re-Authentication feature, first install SecureEdge Access Agent version 3.0 or higher.

       • If Re-Authentication is enabled, specify the re-authentication policy time for each resource. Enter the time value in minutes, hours, or days. Note: The minimum duration is 1 hour; the maximum is 90 days.

         Open

         

          

     • Device Posture – Select a device posture from the drop-down list. You can decide whether the attributes of the configured device should be enforced or if violations should simply be logged. You can choose between the following:

       • Enforce Compliance – Device attributes are evaluated and matched to the security compliance requirements defined in the Device Posture tab (Step 2) of the Zero Trust Access Policy. If the defined device attributes match, the user can access the resources. Otherwise, the user cannot access the resources. For example, in this case, select Enforce Compliance.

       • Log Violations – Device attributes are evaluated and matched to the security compliance requirements defined in the Device Posture tab (Step 2) of the Zero Trust Access Policy.  If the defined device attributes fail, the user can access the resource. However, there is a log entry showing this violation.

       • Disable –  If you select Disable, the Device Posture tab (Step 2) is disabled in the Zero Trust Access Policy.

     • Security Inspection – Click to enable/disable. For example, in this case, Security Inspection is enabled.

       Open

       

        

7. Click Next.

8. In the Device Posture tab, specify values for the following:

   • Screen lock enabled – Click to enable/disable.  Supported platforms: Android and iOS.

   • Firewall enabled – Click to enable/disable. Supported platforms: MacOS and Windows.

   • Antivirus enabled – Click to enable/disable. Supported platform: Windows.

   • Block jailbroken devices – Click to enable/disable. Supported platforms: Android and iOS.

   • Enforce disk encryption – Click to enable/disable. Supported platforms: Android, Windows, MacOS, and iOS.

   • Barracuda SecureEdge Access Agent updates – Click to enable/disable. When enabled, specify Minimum Version of the Barracuda SecureEdge Agent. Supported platforms: Android, Windows, MacOS, Linux, and iOS.

   • OS updates – Click to enable/disable. Click + to add more than one OS platform. When enabled, specify values for the following:

     • Platform –  You can select from the drop-down list. You can choose among the following platforms: Android, Windows, MacOS, and iOS.

     • Minimum Version – Specify the minimum version of the operating system. 

     Open

     

9. Click Save.

10. In the Create ZTNA Policy window, verify the status of newly created zero trust access policy.

11. Click Finish.

After the configuration is completed, your zero trust access policy is created. On the ZTNA Policies page, you can see the new zero trust network access policy. 

Open

Edit an Existing ZTNA Policy

1. Expand the ZTNA menu on the left and select Policies. The ZTNA window opens.

2. Click on the pencil icon next to the policy you want to edit.

   Open

   

3. The Edit ZTNA Policy window opens. Edit the value you are interested in.

4. Click Save.

Remove an Existing ZTNA Policy

1. Expand the ZTNA menu on the left and select Policies. The ZTNA window opens.

2. Click on the trash can icon next to the policy you want to remove.

   Open

   

3. The Delete ZTNA Policy < Name of Your ZTNA Policy> window opens.

   Open

   

4. Click Ok to confirm.

Additional Information

Logs and Reports

SecureEdge Logs collects log data from your connected Sites/ Edge Services when Web Filtering is enabled. The data streams to your selected region.

For more information on logs and reporting, see:

• SecureEdge Logs

• SecreEdge Reports.

• How to Enable Reporting in SecureEdge.

In addition, you can create reports and notifications using Azure Log Analytics Workspace. Your Barracuda SecureEdge service must be connected to Azure Log Analytics Workspace via Azure Monitor. The Azure Monitor is used to stream logs to a Microsoft Log Analytics workspace.

For more Information, see:

• How to Configure Log Streaming to Microsoft Azure Log Analytics Workspace.

• How to Configure Log Streaming via the Azure Log Analytics Daemon in SecureEdge.