Quick Overview

Rulesets in zAccess define the conditions under which specific policies are applied to endpoint devices during login and periodically throughout the session. A ruleset evaluates various contextual attributes—such as MAC address, IP address, SSID, serial number, or geolocation—and triggers the assignment of a corresponding policy if the criteria are met. This allows for dynamic, context-aware access control.

How to Use This Feature in the UI

1. Go to Policy Configuration > Rulesets.
2. Click ADD RULESET.
3. Provide a Ruleset Name (e.g., “Trusted Devices at HQ”).
4. Choose whether ANY or ALL conditions must be satisfied for the ruleset to apply (default is ALL).
5. Add one or more conditions based on:
   • MAC Group
   • IP Group
   • SSID Group
   • Serial Number Group
   • Geo Fence
6. Select the Policy that should be applied when the ruleset matches.
7. Assign a Priority to determine the order in which the rulesets are evaluated. Lower values have higher precedence.
8. Click Save to activate the ruleset.

Concepts & Use Cases

• Contextual Policy Assignment: Automatically assign access policies based on who the user is, where they are, and what device they’re using.
• Zero Trust Enforcement: Only devices that satisfy strict multi-attribute conditions receive policy access.
• Priority-Based Resolution: Multiple rulesets can be defined; the first one that matches is applied.
• Modular Access Logic: Keep policies generic and manage logic centrally through rulesets.

Troubleshooting & FAQs

• Why is the wrong policy being applied?
  Check the order of ruleset priorities and verify which ruleset is matching. Use the Endpoint Sessions view for insights.
• Can I disable a ruleset without deleting it?
  Currently, the interface does not provide a “disable” toggle. To prevent application, remove conditions or raise its priority below active rulesets.
• What happens if no ruleset matches?
  No policy is applied, and access to applications may be denied by default. Consider creating a fallback ruleset with a catch-all condition.
• Can a device match more than one ruleset?
  Yes, but only the first matching ruleset (by priority) is used. Others are ignored once a match is found.