Unprotecting and Monitoring a VPC/VNet
There are several scenarios where you might want to unprotect a previously protected VPC/VNet while still maintaining monitoring:
-
During development cycles or when testing new applications, you may need to temporarily allow all outbound traffic while still keeping an eye on communication patterns.
-
If application issues arise that might be related to overly restrictive egress policies, temporarily unprotecting a VPC/VNet can help identify if security rules are causing the problem without losing visibility.
-
When integrating new cloud services or third-party tools, you might need to allow broader access initially to discover all required endpoints before implementing targeted protection.
-
Some compliance frameworks require traffic monitoring while allowing business operations to continue without restriction.
-
To determine if protective filtering is causing latency issues, you might unprotect while continuing to monitor traffic patterns and performance metrics.
When you unprotect and continue to monitor a VPC/VNet:
-
The Default Deny Rule for this VPC/VNet will be removed, allowing all egress traffic to flow
-
The VPC/VNet is removed from the Protected VPC/VNets SmartGroup and added back to the Monitored VPCs SmartGroup
-
Any Permit protection rules you created are kept
To remove protection from a VPC/VNet, but continue to monitor its traffic:
-
On the Security > Egress > Egress VPC/VNets tab, click the vertical ellipsis
next to a VPC/VNet that is currently protected.
-
Click Unprotect and Monitor.
After unprotecting a VPC/VNet, you should review the monitoring data regularly to:
-
Observe new traffic patterns that might emerge with unrestricted access
-
Identify any potential security concerns that warrant re-enabling protection
-
Build more refined protection rules based on the actual traffic needs observed
-
Document legitimate business traffic that should be explicitly allowed when protection is reapplied