Internet Access traffic forwarding profile

[added: Acquisition rules determine which traffic the Internet Access profile forwards to Global Secure Access. They don't define a cloud firewall Allow or Block decision.]

Before: No saved wording on this side.

After: Acquisition rules determine which traffic the Internet Access profile forwards to Global Secure Access. They don't define a cloud firewall Allow or Block decision.

[added: After configuring acquisition, configure the security policies required for that traffic. Use cloud firewall to allow or block connections based on the supported destination, port, and protocol conditions. Ensure the acquisition configuration covers the traffic that your firewall rules are intended to protect.]

Before: No saved wording on this side.

After: After configuring acquisition, configure the security policies required for that traffic. Use cloud firewall to allow or block connections based on the supported destination, port, and protocol conditions. Ensure the acquisition configuration covers the traffic that your firewall rules are intended to protect.

[added: For example, a cloud firewall rule for UDP traffic doesn't cause the Default Acquire policy to acquire UDP. Configure acquisition for the required destination, port, and protocol before validating firewall enforcement.]

Before: No saved wording on this side.

After: For example, a cloud firewall rule for UDP traffic doesn't cause the Default Acquire policy to acquire UDP. Configure acquisition for the required destination, port, and protocol before validating firewall enforcement.

[added: Choose the configuration steps for your traffic source:]

Before: No saved wording on this side.

After: Choose the configuration steps for your traffic source:

[added: Configure cloud firewall for Global Secure Access clients (preview).]

Before: No saved wording on this side.

After: Configure cloud firewall for Global Secure Access clients (preview).

[added: Configure cloud firewall for remote networks.]

Before: No saved wording on this side.

After: Configure cloud firewall for remote networks.

[added: For broader acquisition, see Acquire traffic with wildcard destinations.]

Before: No saved wording on this side.

After: For broader acquisition, see Acquire traffic with wildcard destinations.

[added: For client traffic, Custom Acquire supports the FQDN wildcard * and the IPv4 subnet 0.0.0.0/0. Use these destinations to acquire traffic beyond the default TCP ports 80 and 443, including nonstandard TCP ports and UDP.]

Before: No saved wording on this side.

After: For client traffic, Custom Acquire supports the FQDN wildcard * and the IPv4 subnet 0.0.0.0/0. Use these destinations to acquire traffic beyond the default TCP ports 80 and 443, including nonstandard TCP ports and UDP.

[added: To configure broad acquisition for named destinations and direct-IP traffic:]

Before: No saved wording on this side.

After: To configure broad acquisition for named destinations and direct-IP traffic:

[added: Browse to Global Secure Access > Connect > Traffic forwarding and open the Internet Access profile's acquisition rules.]

Before: No saved wording on this side.

After: Browse to Global Secure Access > Connect > Traffic forwarding and open the Internet Access profile's acquisition rules.

[added: Expand Custom Acquire and select Add rule.]

Before: No saved wording on this side.

After: Expand Custom Acquire and select Add rule.

[added: Configure each of the following rules, using the destination type, destination, ports, and protocol shown in the table.]

Before: No saved wording on this side.

After: Configure each of the following rules, using the destination type, destination, ports, and protocol shown in the table.

[added: Enable Custom Acquire and save your changes.]

Before: No saved wording on this side.

After: Enable Custom Acquire and save your changes.

[added: Destination type Destination Ports Protocol FQDN * 0-65535 TCP FQDN * 0-65535 UDP IP subnet 0.0.0.0/0 0-65535 TCP IP subnet 0.0.0.0/0 0-65535 UDP]

Before: No saved wording on this side.

After: Destination type Destination Ports Protocol FQDN * 0-65535 TCP FQDN * 0-65535 UDP IP subnet 0.0.0.0/0 0-65535 TCP IP subnet 0.0.0.0/0 0-65535 UDP

[added: Keep the bypass policies in place. Traffic matching a bypass rule remains excluded even when it also matches a wildcard acquisition rule. Private Access routing takes precedence over Internet Access; traffic routed through Private Access isn't subject to Internet Access cloud firewall rules.]

Before: No saved wording on this side.

After: Keep the bypass policies in place. Traffic matching a bypass rule remains excluded even when it also matches a wildcard acquisition rule. Private Access routing takes precedence over Internet Access; traffic routed through Private Access isn't subject to Internet Access cloud firewall rules.

[added: Note DNS traffic acquisition isn't supported by the Internet Access traffic forwarding profile in this preview. Wildcard acquisition rules don't enable DNS acquisition, so cloud firewall policies don't filter DNS traffic. Configuring an FQDN destination doesn't enable DNS query acquisition.]

Before: No saved wording on this side.

After: Note DNS traffic acquisition isn't supported by the Internet Access traffic forwarding profile in this preview. Wildcard acquisition rules don't enable DNS acquisition, so cloud firewall policies don't filter DNS traffic. Configuring an FQDN destination doesn't enable DNS query acquisition.

[added: The 0.0.0.0/0 destination covers IPv4, not IPv6. You can restrict the port ranges and destinations instead of using this broad acquisition configuration.]

Before: No saved wording on this side.

After: The 0.0.0.0/0 destination covers IPv4, not IPv6. You can restrict the port ranges and destinations instead of using this broad acquisition configuration.

[added: Important QUIC acquisition and blocking through cloud firewall are supported in the preview, but end-to-end QUIC forwarding isn't supported. An Allow rule for UDP port 443 doesn't enable supported end-to-end QUIC connectivity.]

Before: No saved wording on this side.

After: Important QUIC acquisition and blocking through cloud firewall are supported in the preview, but end-to-end QUIC forwarding isn't supported. An Allow rule for UDP port 443 doesn't enable supported end-to-end QUIC connectivity.

[added: Acquisition wildcard syntax doesn't define firewall-rule FQDN matching behavior. For firewall configuration and the specific-port acquisition example, see Configure cloud firewall for Global Secure Access clients.]

Before: No saved wording on this side.

After: Acquisition wildcard syntax doesn't define firewall-rule FQDN matching behavior. For firewall configuration and the specific-port acquisition example, see Configure cloud firewall for Global Secure Access clients.