creating-edge-router-policies

New edge router policy via UI

1. On the left side nav bar, click "Ziti Policies"
2. It should already be selected, but if not, on the top nav bar, click "Edge Router Policies"
3. In the top right corner of the screen click the "plus" image to add a new edge router policy
4. Choose a name for the edge router policy, such as "My edge router policy"
5. Enter the edge routers you want to include in the policy
   1. Specific edge routers can be referenced by ID or name using @. For example, an edge router called us-east-4 can be referenced using @us-east-4.
   2. Edge routers can be referenced by role attribute using #. For example, any edge router which has the us-seast role attribute will be included if #us-east is included in the edge routers roles list.
6. Enter the identities you want to include in the policy
   1. Specific identities can be referenced by ID or name using @. For example, as identity called jsmith-desktop can be referenced using @jsmith-desktop.
   2. Identities can be referenced by role attribute using #. For example, any identity which has the sales role attribute will be included if #sales is included in the identities roles list.
7. Specify the role semantic
   1. If you select Has Any Role then if you specify multiple roles then all entities which include any of the roles will be included.
   2. If you select Must Have All Roles, then if you specify multiple roles then only entities which include all of the given roles will be included
8. Click save

New edge router policy via CLI

To create an edge router policy using the CLI issue the following commands.

1. To use the CLI, you'll need to be logged in. Link to instructions

2. Create an edge router policy named my-policy which allows all identities to use all routers.

   ziti edge create edge-router-policy my-policy --identity-roles '#all' --edge-router-roles '#all'