Role Attributes

Follow

 

Endpoints are able to connect to services when there is at least one online edge router in common and they are authorized by an AppWAN. Put another way, an endpoint needs two things: an edge router and an AppWAN; and a service needs the same two things, and so for an endpoint to connect to a service they need at least one common edge router and one common AppWAN.

 

Example: Global Edge Routers

In this example the dialing and service endpoints share an edge router policy named "global router policy".

Edge Router

This edge router is hosted in a NetFoundry data center and is likely be dialed by endpoints that are geographically near, depending on internet conditions.

Edge Router Policy

This edge router policy configures all endpoints to dial the network via the first-responding edge router in the policy. With a policy matching #all endpoints, there's no need to further configure router attributes for endpoints.

Example: Regional Edge Routers

Here we add a router attribute to the service and dialing endpoints so that their connections to the network can be limited to their respective geographic regions.

Endpoint

This Endpoint has a role attribute #euWestEndpoints that causes it to match a particular edge router policy, and #terminalClients which grants it permission to use a particular AppWAN's services.

Edge Router

This edge router has a role attribute #euWestRouters that causes it to match a particular edge router policy.

 

Edge Router Policy

This edge router policy configures particular endpoints to dial the network via the first-responding of a particular set of edge routers. This example steers some endpoints to only dial via routers in EU-WEST.

Service

This Service has a role attribute #terminalServers that causes it to match a particular AppWAN, and edge router attribute #usEastRouters causing it to only receive connections from those routers. It's not always best to specify the router attributes for a service. The default is #all meaning the service will receive connections from the first reachable router that responds.

 

AppWAN

This AppWAN authorizes particular endpoints to connect to particular services.

 

Policies

Resources are governed by policies that have the same #hashtag attributes as the resource itself. A policy may also @mention a particular resource by name to apply the policy to the mentioned resource. Alternatively, policies may use the magic attribute #all to match all of the resources of one type i.e. endpoints, services, or edge routers. There are three types of policies:

• AppWAN
      authorizes endpoints to connect to services
  
• Edge Router Policy
      configures endpoints to use edge routers to dial the network
  
• Service Edge Router Policy
      configures services to receive connections via edge routers

Resources

Attributes appear like #hashtag on three types of resources to authorize and configure connections.

Endpoints

Endpoints need at least one online, reachable edge router in order to dial the network.

• Endpoints may connect to services via a matching AppWAN.
• Endpoints may dial the network via a matching edge router policy. 

Edge Routers

Edge Routers are dialed by endpoints, fabric-linked by other edge routers, and may terminate services they can reach outside the Ziti network.

• Edge Routers become available to endpoints for dialing the network by matching edge router policies.
• Edge Routers receive connections for services by matching service edge router policies.

Services

Services need at least one online, reachable edge router to receive connections.

• Services become available to endpoints by matching AppWANs.
• Services also have a property "edge router attributes". This property creates a service edge router policy for the service which can be used to constrain the selection of edge routers by which the service receives connections. The default is #all.