Hey everyone. I'm Jason, from IT. We're rolling out Banyan to replace our old VPN and I'm still getting my head around the policy model.
Our security team has a new requirement: completely isolate our R&D subnet (10.10.20.0/24) from all production networks (10.10.10.0/24, 10.10.30.0/24). R&D should only reach the internet and a couple of internal tools. With our old setup, this was a firewall mess.
I think this is a job for a Banyan Service Policy with a "deny" rule, but I'm unsure about the exact steps. Do I create a policy that blocks traffic *from* the R&D TrustSec tag *to* the production tags? And do I attach that to the R&D services, or to the production ones? I want to make sure I don't accidentally break access for everyone else.
Any clear guidance would be a huge help. Thanks in advance!