--- title: "Configuring Security Policies" canonical: "https://docs.infoblox.com/space/BloxOneThreatDefense/35371559/Configuring%20Security%20Policies" format: markdown --- A security policy is a set of rules and actions that you define to balance access and constraints, so you can mitigate malicious attacks and provide security for your networks. > ⚠️ ### Note > ⚠️ > ⚠️ To provide flexibility and support for the new policy types, Infoblox Threat Defense has updated the evaluation process for security policies. Previously, Infoblox Endpoint and DNS Forwarding Proxy had implicit precedence over external networks. After the update, the policies are evaluated in the order you define and observe on the *Security Policies* page of the Infoblox Portal. If you have existing security policies, the policy precedence is updated to match the behavior that was defined before the update. Infoblox Threat Defense provides a default global policy that gives you a head start in protecting your networks. You can review the default global policy, and decide whether you want to add or remove some of the rules based on your business requirements. In addition to the default global policy, you can add new security policies from scratch or clone an existing policy to complement the default policy. When you create a new security policy, you must first define a network scope to which you add external networks, user groups, DNS forwarding proxies, DDI IPAM, and Endpoint groups. Infoblox Threat Defense applies the security policy to all the entities that you include in the network scope. After you define the network scope, you can add policy rules and specify actions and their precedence order. For more information, see *[Security Policy Precedence](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35439943)*. To quickly create a new security policy, you can clone an existing one and modify certain elements before you save the new configuration. The *Security Policies* page displays the following information for each security policy you have configured by default: 1. **PRECEDENCE ORDER**: Infoblox Threat Defense enforces security policies in an ascending precedence order in which the policy rule with the lowest precedence order has the highest priority in the evaluation process. 2. **NAME**: The policy name. 3. **DEFAULT ACTION**: The default action currently configured for the entities that are not included in the network scope. 4. **DESCRIPTION**: The policy description. For additional information on precedence order, see *[Security Policy Precedence](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35439943)*. You can also click the expandable menu icon to choose the following columns for display: - **EXTERNAL NETWORKS**: The total number of external networks included in the network scope for this policy. - **INFOBLOX ENDPOINT GROUPS**: The total number of endpoint groups included in the network scope for this policy. - **IPAM**: The number of IPAM objects associated with the security - **IPAM HOSTS**: The number of IPAM Hosts associated with the security policy. - **TAGS**: Any tags associated with the security policy. - **METADATA**: Any metadata associated with the security policy. - **USER GROUPS**: The total number of user groups included in the network scope for this policy. - **LISTS**: The total number of custom lists configured for the security policy. - **CATEGORY FILTERS**: The total number of category filters configured for the security policy. - **APPLICATION FILTERS**: The total number of application filters configured for the security policy. - **BYPASS CODES**: The number of bypass codes associated with a security policy. - **GEOLOCATION**: The geolocation state for the policy. Geolocation can be enabled or disabled. For more information about geolocation support, see *[Geolocation Support on a Per-Policy Basis](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35469854)*. - **SAFE SEARCH**: This indicates whether safe search is enabled or disabled for the security policy. For more information about safe search enforcement, see *[Safe Search Enforcement](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35469836)*. - **DNS FORWARDING PROXIES**: The total number of DNS forwarding proxies included in the network scope for this policy. - **DOH PER POLICY**: DNS over HTTPs (DoH) is an encrypted protocol for DNS resolution. DoH per Policy can be enabled or disabled. Infoblox Threat Defense can terminate DoH connections and associate custom DoH FQDNs with specific customer policies. This allows customers to securely redirect their DNS traffic to Infoblox Threat Defense without a client and integrate our solution with third-party solutions. For information on how to use an agentless client over DoH, see *[Implementing the Client over DoH](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/611944899)*. - **BLOCK DNS REBIND ATTACK (BLOCK DRA)**: In a DNS rebinding attack, the attacker first gains control of a malicious DNS server. For information, see *[Blocking DNS Rebind Attacks](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/610861335)*. - **Local On-Prem Resolution**: For information on how to use Local Internet DNS Breakout (local on-prem resolution) with Infoblox Threat Defense and Universal DNS, see *[Using Local On-prem Resolution](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35469508)*. > ⚠️ ### Note > ⚠️ > ⚠️ The warning message will appear in the Infoblox Portal within 24 hours. Infoblox executes the job every 24 hours. If user1 makes changes during the first hour of this cycle, they will need to wait 23 hours to see those modifications reflected. Conversely, if user2 makes changes in the 23rd hour of the job cycle, they will only have to wait one hour to view their updates. You can also view more information about each security policy in the right panel. When you expand **Network Scope**, **Policy Rules**, and **Bypass Codes**, you can see the total number of each entities within the respective category. When you click the number next to each entity, the system takes you to the **Summary** page of the security policy. On the **Summary** page, you can find more information about the specific entity or navigate to other sections to view or modify certain information about the security policy. You can also perform the following in this tab: - Click **Create Security Policy** to create a new security policy. - Click the expandable menu icon > **Edit** to modify the respective security policy information. You can also choose the respective security policy and click the **Edit** button to do so. - Click the expandable menu icon > **Edit Precedence** to set the precedence order for the security policy. Click the checkbox icon to save the changes, or click the close icon to discard the changes. For more information, see *[Security Policy Precedence](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35439943)*. - Choose a security policy and click **Clone** to create a new policy by cloning the selected one. - Click the expandable menu icon > **Remove** to delete a security policy. You can also choose the respective security policy and click **Remove**. - Choose a security policy to view additional details in the right panel. You can collapse the right panel by clicking the information icon. - Enter the value that you want to search in the **Search** text box. The Infoblox Portal displays the list of records that match the keyword in the text box. - Click the expandable menu icon to choose the columns you want to display or use the arrow keys to reorder the columns. For more information about how to create security policies, see the following: > Macro (children)