Skip to content
FIVEGUARDIAN5DOCUMENTATION
/
Español Open the panel
Administration

Policies and groups

How to control who can communicate with what using groups and access policies.

How access control works

In FiveGuardian5 communication between devices and resources is only allowed through policies, and policies are written against groups, not individual devices. This is the core of the zero-trust approach.

Groups

A group brings together devices (and, through their users, people). Groups are managed under Access Control › Groups. Common examples: one group per department, one for servers, one for IT administrators.

  • A device can belong to several groups.
  • Groups assigned to a user apply to the devices they register.
  • Setup keys can assign groups automatically. See Setup keys.
  • With identity provider sync, groups can come from your directory. See Integrations.
Use clear, descriptive group names. A good name makes policies self-explanatory during an audit.

Policies

Policies are created under Access Control › Policies. Each policy states:

  • Source: the groups from which connections start.
  • Destination: the groups or resources that may be reached.
  • Protocol and ports: for example all, TCP, UDP, ICMP or the built-in SSH, and the allowed ports.
  • Direction: whether access is one-way or both ways.
  • Optional posture checks: conditions the source device must meet. See Posture checks.

Policies can be enabled or disabled without deleting them, which is useful for controlled testing.

Available protocols

In addition to the usual network protocols, there is the FiveGuardian5 SSH option, which this documentation calls the built-in SSH. It allows SSH access to authorized devices without managing SSH keys separately. See Built-in SSH.

Good practices

  • Least privilege: allow only the protocols and ports needed, between the groups needed.
  • Avoid "everyone to everyone" policies; if a broad default policy exists, it should be disabled once the specific policies are in place; coordinate this with the FiveGuardian5 support team, because disabling it too early can cut connections in use.
  • Prefer one-way direction when only one side needs to start the connection.
  • Describe each policy: use the description field to explain its purpose and who requested it.
  • Review policies periodically and delete those no longer used.
  • All changes are recorded in Audit Events.
Policies control access between devices and resources on the private network. Internet exit and DNS filtering are managed separately; see Networks and routes and DNS.