Traffic View in the Policy Matrix

Traffic View allows you to analyze detailed traffic between Policy Groups directly from the Policy Matrix. For each pair of Policy Groups, it shows both the traffic sent and the reply traffic received. This view provides visibility into observed traffic, including protocols, statuses, services, and other metrics that can inform your policy decisions. Here is how to navigate and use this feature effectively.

Accessing Traffic Details

1. Navigate to the Policy Matrix by selecting Policy > Matrix.
   
   

   

2. Click Show Traffic View on the lower right menu. Click to view the legend for traffic.

   

Reading Traffic View Cells

Each cell represents traffic between the Policy Group in its row (Side A) and the one in its column (Side B) during the selected time frame. Hover over a cell to view its details.

The tooltip reports each direction separately:

• Total Sent Traffic and Total Sent Packets: Traffic that Side A sent to Side B.
• Total Received Traffic and Total Received Packets: Reply traffic that Side A received from Side B.
• Allowed Sent Traffic, Denied Sent Traffic, and, with exclusion filters enabled, Filtered Sent Traffic: A breakdown of the sent traffic.

A row appears only when its value is not zero. Exclusion filters reduce the sent figures but not the received figures.

A cell with received traffic but no sent traffic is marked with a light ring and is listed in the legend as Received Traffic Only. Simulated policies are drawn with a dashed border in both the Outlined Cells and Filled Cells cell styles.

Filtering Traffic

You can select Time Frame filters, View Options, or Custom Filters for filtering traffic.

Time Frame Filters

Traffic on the Policy Matrix can be filtered to show traffic for an Hourly, Daily, Weekly, or Monthly time window by selecting one of the time frame options available. To move between windows, use the date navigation bar described in Cloud Control Center Traffic Analytics.

View Options

The View Options menu includes the following features:

• Multiselect
• Matrix Order

The Traffic Exclusion Filter toggle and its edit (pencil) icon in the filter bar above the matrix control the following features:

• Enable Exclusion Filters
• Edit Exclusion Filters

Read more about each option in the sections below.

Multiselect in Traffic View

Multiselect, a powerful tool in the Policy Matrix for deploying a policy across multiple cells, is also available in Traffic View. This streamlines policy deployment by letting you apply a single policy across multiple matrix cells, while still viewing the specific traffic observed in each individual cell.

Use Case: Deploying Deny All Policies for Unused Paths

If no traffic is observed between certain Side A and Side B Policy Groups over a week or month, and as a Network Administrator, you do not expect traffic between them, applying a Deny All policy is likely the correct choice. Before you deny a cell with no sent traffic, check that it is not marked Received Traffic Only.

Here’s how to use multiselect for this purpose:

1. Enable Multiselect in the Traffic View by clicking the Multiselect button in the top-right corner under the View Options menu.
2. Drag your mouse over the cells representing the Side A and Side B pairs with no observed traffic, or use Shift+click to select them individually. CTRL/CMND + Click enables you to select a range of cells.
3. Select Deny in the action bar and click Save.

This approach allows you to enforce security policies quickly and efficiently while reducing manual effort. Multiselect enables you to act immediately on observed traffic data, ensuring unused communication paths are securely locked down to minimize risk.

Matrix Order

The Policy Groups along the Side A and Side B axes can be reordered alphabetically from A-Z or from Z-A - or based on when they were created (New and Old) as seen in the selection pane below. 

Enable/Disable Exclusion Filters

The Policy Matrix Traffic view shows all observed traffic by default (exclusion filter disabled), which is often mixed with low value traffic or "noise" - which can make it challenging to see traffic of interest. You can filter out this type of traffic by turning on the Traffic Exclusion Filter toggle.

By default, the exclusion filters match the following traffic. To view or change the list, click the edit (pencil) icon next to the toggle, as described below.

• UDP 137–139 (NetBIOS)
• UDP 3702 (WS-Discovery)
• UDP 5355 (LLMNR)
• UDP 5353 (mDNS)
• TCP 7680 (MS-DO)
• ICMP

Editing the Matrix Exclusion Filters

The ports/protocols which are excluded can be modified by clicking the edit (pencil) icon next to the Traffic Exclusion Filter toggle. In the Ports and Protocols section of the Edit Exclusion Filters drawer, you can search for and select from a pre-defined list of all common ports (both TCP and UDP) and add them to the Chosen Filters column, or remove existing filters. Select the protocols and use the arrows between the two columns to transfer selected protocols (<, >) or ALL protocols (<<, >>).  Click Restore Default Filter to return to the default list above.

The drawer also includes a Minimum Traffic Volume Threshold (value and unit) and an Exclude Low-Volume TCP Flows check box, selected by default.

With the filter enabled, cells that contain only traffic matched by the exclusion filters appear faded, as shown in the image below.

Traffic Details from the Matrix

Clicking a cell with no policy in Traffic View opens the traffic flow details drawer, which shows the observed traffic within the specified time frame. Clicking a cell that has a policy opens that policy's details on the Traffic Analytics tab instead.

The drawer shows one direction at a time, from the Side A Policy Group to the Side B Policy Group named in the header. Click Reverse to swap them and view the opposite direction. Reverse is unavailable when both sides are the same Policy Group.

The toolbar shows the Traffic Exclusion Filter status, a time frame selector, and two view buttons:

• List view (default): A table of observed traffic, including sent and received bytes and packets for each service. A port column shows Ephemeral when only the other side uses a fixed port. With exclusion filters enabled, matching rows are greyed out.
• Chart view: A Sankey chart that traces traffic from Side A through the Side A and Side B ports to Side B.

In list view, you have the ability to create custom filters to refine the displayed data. The General Filter section provides filter options for each column present, as described below:

1. Action: Whether the protocol is allowed or denied.
2. First Observed: Filter traffic by the date it was first detected.
3. Last Observed: Filter traffic by the date it was last detected.
4. Policy Status: Whether there is an active or simulated policy is present.
5. Protocol: Filter traffic based on the communication protocol (e.g., TCP, UDP).
6. Received Bytes: Refine data by the amount of data (in bytes) received.
7. Received Packets: Refine data by the number of data packets received.
8. Sent Bytes: Refine data by the amount of data (in bytes) sent.
9. Sent Packets: Refine data by the number of data packets sent.
10. Service: Filter by the specific service being used in the communication (e.g. LDAP).
11. Side A Port: Filter traffic by the Side A port number.
12. Side B Port: Filter traffic by the Side B port number.

Users can select an operator, such as contains, equals, or is any of, to apply precise logic to each filter. Once configured, the filter can be applied instantly to the traffic view for real-time analysis. Additionally, there is an option to Save Filter, allowing users to quickly reapply frequently used filtering criteria without manually reconfiguring them each time.

Create Policy

Click Create Policy at the bottom of the drawer and select Deny All, Allow All, Custom Policy, or Independent Control. The same policy dialog used in the Policy Matrix opens with the Side A and Side B Policy Groups shown in the drawer header. To create the policy for the opposite direction, click Reverse first. Create Policy is not available on Replica Policy Sets or without permission to create policies.

Traffic Analytics

Clicking Traffic Analytics in the drawer toolbar opens the Traffic Analytics page in a new browser tab, showing traffic only between the displayed Side A and Side B Policy Groups for the same time frame. The Side A and Side B Policy Groups from the drawer are applied as filters. Add more filters to narrow down the results.

Custom Filters

Custom filters can be created and saved in both table view and matrix view. Both views have their own separate saved filters, offering the flexibility to have different custom filters in each view that leverage the different criteria available. 

Saved Filters per Policy Set: Because each Policy Set can have its own unique subset of Policy Groups, filters are saved per Policy Set. This means that filters saved in one Policy Set will not appear in the list of saved filters for other Policy Sets.

Import and Export Functionality: Saved filters can be exported and imported, allowing filters to be shared between users in Cloud Control Center.

In Matrix view, the policy matrix can be filtered to show select Side A and Side B Policy Groups, and even selected Security Profiles. These filters can be saved and loaded at any time with just a couple of clicks. 

To create a filter, click All Filters in the filter bar above the Policy Matrix. To load a saved filter, click Saved Filters.

Select a filter category and the appropriate values, then click Apply. You can filter on a number of key values in Matrix view:

You can layer multiple filters to create granular, multifaceted filters to narrow down the matrix view to only the data that you need.

To save the applied filter, click the more options menu next to Clear Filters and select Save Filters. In the Saved Filters list, hover over a filter to edit, export, or delete it, or click Import Filters to add one shared by another Cloud Control Center user.