Boundaries

Boundaries are the guardrails change requests are checked against. Each one describes a kind of firewall rule and says whether requests for it pass, fail, or need review. This page covers writing one, how matching works, and the grid views. Concepts has the overview.

Boundaries are created, opened, and edited by Administrators and Connect Boundary Authors. Project Managers, Readonly Users, and Firewall Change Approvers can see the Boundaries list. See Users and Roles.

The Boundaries page

Boundaries in the navigation menu opens the table view, one row per Boundary (or per statement, for a Boundary imported with several): whether it's Enforced (the switch is live, so you can enable or disable a Boundary without opening it), its Result, name, project, its Action (the request type it applies to), whether it's bidirectional, its sources, destinations, and services, which fields it requires, and who changed it last.

View switches between Boundaries (the table), Grid, and Groups; see Grid views. The buttons above the table create a new Boundary, refresh the list, and import or export Boundaries as JSON.

Creating a Boundary

Click New Boundary. The form has two parts.

Boundary details

Field	What it does
Name	Shown in change request results and in the requester's summary.
Project	The project the Boundary belongs to.
Result	Pass, Fail, or Score & Review. A Score & Review Boundary also takes a Score from 0 to 100.
Enforced	Off keeps the Boundary but leaves it out of every evaluation. Useful while drafting.
Target(s)	Accounts to export matching requests to when the Boundary's result is Pass or Score & Review: your ServiceNow accounts and your provisioned Guardicore accounts. See Guardicore and ServiceNow.
Message	Text shown to the requester when a request matches this Boundary. Explain what to change or whom to contact.

Once change requests have matched a Boundary, its page shows a Use Count.

The statement

The statement describes the requests the Boundary applies to. A request rule matches when every part of the statement matches it; a part left empty matches anything.

Part	What it matches
Request Type	Allow rules, Deny rules, or Either.
Bidirectional	Also match with the request's source and destination swapped.
Source and Destination	Network objects: Any (the firewall's any object, which matches only a request that also uses any), The Internet (every address outside your internal address space, defined under Settings > Boundaries), a CIDR or single address, a Group, or an Inventory Item. A CIDR, Group, or Inventory Item carries a comparison, Contain (the Boundary's addresses include the request's) or Equal (they're the same), and Does or Does Not to negate it; Any is used as it is, and The Internet instead carries Is or Is Not. Several objects on one side are alternatives: matching any one of them is sufficient.
Applies when	Shown once a side names an object. Any sources match, the default, applies the statement when any one of the request's sources satisfies it. All sources match requires every one of them to. Destinations have the same choice. See Any and All.
Host Limit	A minimum and maximum number of hosts the request's side may cover, added up across its objects. any counts as unlimited.
Service	Any (matches only a request for all traffic), All TCP, All UDP, All ICMPv4, All ICMPv6, a TCP or UDP port range, an ICMPv4 or ICMPv6 type and code, or a Custom Protocol number. Type a TCP or UDP port or range in one box, as 443 or 80-90. The Add service, port, or protocol search box adds a well-known service, such as HTTPS, SSH, RDP, DNS, NTP, or MySQL, as the TCP, UDP, or ICMP objects it uses (DNS adds both TCP and UDP 53), and any object that matches a well-known service is labeled with its name. A port range matches a request whose ports fall inside it; an All entry matches the corresponding all-ports request and any single range of that protocol.
Port Limit	A minimum and maximum number of ports the request's services may cover in total. A TCP or UDP range counts its ports, Any and the all-ports entries count as 65,536 each, and ICMP and custom protocols count as none.
Required	Select Comment, Expiration, Justification, or Owner to match only requests that leave that field blank. Combined with a Fail result, this rejects requests that don't say why.

A Boundary with an empty statement matches every request, which is one way to define a catch-all.

Matching rules

The details that decide borderline cases:

• Matching is per rule. A request with several rules matches a Boundary if any one of its rules does, and the result shows which rules matched.
• Contain is the default comparison. A Boundary source of 10.0.0.0/8 matches a request source of 10.1.2.0/24, and a request source that's a Group whose addresses all fall inside 10.0.0.0/8. Equal requires the same addresses on both sides.
• Groups and inventory items are resolved when the request is evaluated, so a Boundary written against a Group follows the Group's membership. A Boundary Group and a request Group with the same ID match without comparing addresses.
• any is special. A Boundary object of any matches only a request that uses any. A Boundary CIDR or Group never matches a request any, unless the object is negated (Does Not), in which case any counts as outside it. The Internet is the exception: a request any reaches the internet, so The Internet / Is matches it and Is Not doesn't.
• Bidirectional is tried one side at a time. When the request's sources don't match the Boundary's sources, they're compared with its destinations instead, and the request's destinations get the same second chance against its sources. A request can match straight on one side and swapped on the other.
• Only enforced Boundaries count, and validation errors in the request (a missing name, an invalid CIDR) fail it regardless of Boundaries.

The verdict combines every matching Boundary: any Fail fails the request; otherwise any Pass passes it; otherwise the request takes the default result (Review, unless you've changed it under Settings > Boundaries), carrying the highest matching score. Evaluation results shows what the requester sees.

The default result

When no Pass or Fail Boundary matches a request, it goes to Review. That includes a request that matched only Score & Review Boundaries. Settings > Boundaries changes the default: choose Pass to let those requests through, or Fail to reject anything you haven't explicitly allowed. With Pass as the default, a request that matched only Score & Review Boundaries passes. The setting applies to evaluations from then on; requests already evaluated aren't re-run.

Reset to default returns the result to Review and also clears Internal CIDRs and Internal Groups. Note your internal address space before you use it.

Settings > Boundaries is also where you define your internal address space, via Internal CIDRs and Internal Groups, which is what a statement's The Internet object matches against. See The Internet.

The Internet

A Boundary can name The Internet as its source or destination: every address outside your internal address space.

Unlike 0.0.0.0/0, it leaves out your internal ranges, and unlike the Any object, it matches real addresses rather than a request that literally says any. It is the complement of what you have declared internal, so a Boundary written this way keeps meaning the right thing as your networks change.

What counts as internal. Set your internal address space under Settings > Boundaries, as Internal CIDRs, Internal Groups, or both. Pointing at a Group that already tracks your VPCs or on-premises allocations keeps the definition current without further edits. Leave both empty and Connect uses the IANA special-use ranges: RFC 1918 private space (10/8, 172.16/12, 192.168/16), carrier-grade NAT (100.64/10), loopback, link-local, multicast, the IPv6 unique-local and link-local ranges, and the documentation and benchmarking ranges. None of those are reachable across the public internet. If your organization owns public addresses, add them; otherwise a request naming one of your own public addresses evaluates as internet traffic.

How it evaluates. A rule's source or destination is on the internet when any part of it falls outside your internal space. So 0.0.0.0/0 counts, since it plainly opens the internet up, and so does a range that is only partly internal, such as 10.0.0.0/7, which reaches past 10/8 into 11/8. A request any counts too. Choosing Is Not inverts the question: the rule's addresses must stay entirely inside your internal space.

The Internet is available on Boundaries only. A change request states the specific addresses it wants, so that what gets exported to your firewalls is unambiguous.

Any and All

A statement's own sources are alternatives: a rule matches if it satisfies any one of them. The Applies when control decides how the rule's sources are read:

Setting	Meaning
Any sources match	The statement applies if any one of the rule's sources satisfies it. The default.
All sources match	The statement applies only if every one of the rule's sources satisfies it.

Destinations have the same control. The difference matters whenever a statement is written as an exclusion: The Internet, or a negated object. Take a Pass Boundary that allows the internet to reach a DMZ on 443, and a request whose sources are 8.8.8.8 and 10.99.0.5. Under Any the public address alone satisfies "is the internet" and the request passes, carrying the internal source along with it. Under All the internal source is a counterexample, the Boundary does not apply, and the request goes to review.

On a Fail Boundary the reverse is usually what you want: "fail if anything here is the internet" is Any, and it is the default.

Boundaries created before this control was added evaluate as Any.

Grid views

The Grid view lays Boundaries out as a matrix: one row per source and one column per destination, drawn from every Boundary's statement, enforced or not. Each cell covers requests from that source to that destination and is colored by the results of the Boundaries that match it. A split cell means Boundaries with different results both apply, and the number is how many (9+ past nine; hover for the list). The Legend button explains the colors. Hover a cell to list its Boundaries, or to create a Boundary for that source and destination with both already filled in. The buttons above the grid add The Internet, a CIDR, Group, or inventory item as a row and column, so you can create Boundaries for objects nothing references yet.

The Groups view is the same matrix restricted to Groups: pick the Groups to show, and each cell lists the Boundaries that name one as source and the other as destination. It counts the Boundaries that name both Groups directly.

Import and export

Export downloads one Boundary (from its row) or all of them (from the button above the table) as JSON. Import takes a JSON file containing one Boundary or a list of them and creates them in the project you choose. Importing a file exported from the same organization updates the Boundaries it contains. Together they let you copy Boundaries between organizations or keep them in version control.