Connection policies determine if a server can be accessed from a particular client. Connection policies reference other resources (policies, usergroups, keys) that must be configured and available before creating a connection policy.
URL
GET https://<IP-address-of-SPS>/api/configuration/vnc/connections/
Cookies
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For more information on authentication, see Authenticate to the SPS REST API. NOTE: This session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
Examples
For request and response examples, see VNC Connections Policies .
Element | Type | Description | ||
---|---|---|---|---|
key | string | Top level element, contains the ID of the connection policy. | ||
body | Top level element (string) | The elements of the connection policy. | ||
access_control | Top level list |
Collection of access policies. Access policies define who can authorize and audit a connection. | ||
active | boolean | Set to false to suspend the connection policy. Connection settings are preserved. | ||
client_side_transport_security | Top level item |
Defines the Transport Layer Security (TLS) settings for the connection between SPS and the client. For example: "client_side_transport_security": { "selection": "disabled" }, | ||
indexing | Top level item | Configures indexing for the connection policy. | ||
enabled | boolean | Set to true to enable indexing the connections. | ||
policy | string |
References the identifier of the indexing policy. You can configure indexing policies at the /api/configuration/policies/indexing/ endpoint. To modify or add an indexing policy, use the value of the returned key as the value of the policy element, and remove any child elements (including the key). | ||
priority | int |
Specifies the indexing priority for the connection. Possible values are:
| ||
log_audit_trail_downloads | boolean |
Set to true to log audit trail downloads. | ||
name | string | The name of the connection policy. | ||
network | ||||
clients | list, string | List of client ("from") IP addresses. | ||
ports | list, integers | List of target ports. | ||
targets | list, string | List of target IP addresses. | ||
override_log_level | Top level item |
Specifies the verbosity level of sessions handled by this connection policy. The log level of other connection policies is not affected. If disabled, the log level set at the /api/configuration/<protocol>/options endpoint is used.
| ||
policies | Top level item | List of policies referenced by the connection policy. | ||
analytics_policy | string |
References the identifier of the analytics policy. You can configure analytics policies at the /api/configuration/analytics/ endpoint. To add or modify an analytics policy, use the value of the returned key as the value of the analytics element, and remove any child elements (including the key). | ||
archive_cleanup_policy | string |
References the identifier of the archive/cleanup policy. You can configure archive and cleanup policies at the /api/configuration/policies/archive_cleanup_policies/ endpoint. To modify or add an archive/cleanup policy, use the value of the returned key as the value of the archive_cleanup_policy element, and remove any child elements (including the key). | ||
audit_policy | string |
Cannot be null. References the identifier of the audit policy. You can configure audit policies at the /api/configuration/policies/audit_policies/ endpoint. To modify or add an audit policy, use the value of the returned key as the value of the audit_policy element, and remove any child elements (including the key). | ||
backup_policy | string |
References the identifier of the backup policy. You can configure backup policies at the /api/configuration/policies/backup_policies/ endpoint. To modify or add a backup policy, use the value of the returned key as the value of the backup_policy element, and remove any child elements (including the key). | ||
channel_policy | string |
References the identifier of the channel policy. The value of this option cannot be null. To modify or add a channel policy, use the value of the returned key as the value of the channel_policy element, and remove any child elements (including the key). You can configure VNC channel policies at the /api/configuration/vnc/channel_policies/ endpoint. | ||
settings | string |
References the identifier of the settings policy. The value of this option cannot be null. To modify or add a settings policy for this protocol, use the value of the returned key as the value of the settings element, and remove any child elements (including the key). | ||
rate_limit | Top level element | Connection rate limit. | ||
enabled | boolean | Set to true to provide a connection rate limit. | ||
value | int | The number of connections (per minute) that are allowed in the connection policy. | ||
server_address | Top level item | Defines the address where the clients connect to. | ||
|
|
custom_dns |
string |
Configures a DNS server that is used to reverse-resolve the hostname if the Channel Policy contains the address of the target as a hostname instead of an IP address. By default, this is disabled and SPS uses the DNS server set in the /api/configuration/network/dns endpoint.
|
|
|
selection |
string |
Configures the address where the clients connect to. Possible values are
: |
server_side_transport_security | Top level item |
Defines the Transport Layer Security (TLS) settings for the connection between SPS and the server. For example: "server_side_transport_security": { "selection": "disabled" }, | ||
source_address | Top level element | Allows you to configure Source Network Address Translation (SNAT) on the server side of SPS. SNAT determines the IP address SPS uses in the server-side connection. The target server will see the connection coming from this address. | ||
selection | string |
Configures Source Network Address Translation. Possible values are:
| ||
address | string |
Must be used if the value of the selection element is set to fix. The IP address to use as the source address in server-side connections. | ||
web_gateway_authentication | Top level item | When gateway authentication is required for a connection, the user must authenticate on SPS as well. This additional authentication can be performed out-of-band on the SPS web interface for every protocol. | ||
enabled | boolean | Set to true to enable additional gateway authentication on the SPS web interface. | ||
groups | list, string |
By default, any user can perform gateway authentication for the connections. You can restrict authentication to members of specific usergroups. Define the usergroups at the /api/configuration/aaa/local_database/groups/ endpoint, and list the name of each group here. | ||
require_same_ip | boolean | Set to true to only accept web gateway authentication from the same host that initiated the connection. |
Elements of client_side_transport_security
Elements of client_side_transport_security | Type | Description | |
---|---|---|---|
peer_certificate_check | Top level item |
Sets how SPS authenticates the peers. To permit connections from peers without requesting a certificate, set "enabled": false, for example: "peer_certificate_check": { "enabled": false } To validate the certificate of the peer, set "enabled": true, and reference a trusted certificate authority list, for example: "peer_certificate_check": { "enabled": true, "trusted_ca": "cfc815e5-dadb-4eb9-a628-12ae0c12d358" } | |
selection | string |
Sets the encryption settings used between SPS and the client. When the connection is encrypted, SPS has to show a certificate to the client, so you must configure the sps_certificate option as well. The possible values of selection are:
| |
sps_certificate | JSON object |
Sets the certificate that SPS shows to the peer when the communication is encrypted. SPS can either use the same certificate for every session, or generate a separate certificate fpr each session.
|
Elements of server_side_transport_security
Elements of server_side_transport_security | Type | Description | |
---|---|---|---|
peer_certificate_check | Top level item |
Sets how SPS authenticates the peers. To permit connections from peers without requesting a certificate, set "enabled": false, for example: "peer_certificate_check": { "enabled": false } To validate the certificate of the peer, set "enabled": true, and reference a trusted certificate authority list, for example: "peer_certificate_check": { "enabled": true, "trusted_ca": "cfc815e5-dadb-4eb9-a628-12ae0c12d358" } | |
selection | string |
Sets the encryption settings used between SPS and the server. If SPS has to show a certificate to the peer, so you must configure the sps_certificate option as well. The possible values of selection are:
| |
sps_certificate | JSON object |
Sets the certificate that SPS shows to the peer when the communication is encrypted. SPS can either use the same certificate for every session, or generate a separate certificate for each session.
|