21.11 Secure Communication Settings

Secure communication settings work with the hardware security gateway. This policy must be configured only after the security gateway is deployed; otherwise, issues such as inability to access the internet may occur.

Icon Button	Description
	Modify secure communication settings.
	Delete secure communication settings.
	Options include exporting policy files, importing policy files, or copying the current policy to other clients.

When configuring secure communication settings, the "Application System Protection" and "Network Shared Document Protection" options support inheritance from parent group policies.

• If inheritance from the parent policy is disabled, only the object's own policy applies.
• If inheritance is enabled, the object's policy is combined with the parent's policy.
• If the parent also has inheritance enabled, the policy continues to inherit from higher-level parent groups.
• If a parent disables inheritance, the policy stops inheriting beyond that level, applying only the parent's policy.

Inheritance between "Application System Protection" and "Network Shared Document Protection" is independent.

Detailed setting descriptions:

Application System Protection

Settings Option	Description
Policy Inheritance	Choose from the dropdown: "Do not inherit parent policy" or "Inherit parent policy." By default, new policies are set to "Inherit parent policy + Application System Protection disabled." Inheriting the parent policy combines policies across objects; disabling inheritance applies only the object's own policy.
Enable Application System Protection	Check this option to enable protection for the client’s application system.
Secure Process Window Label	Enter specific text (e.g., "Secure Process") to display on the process window when the secure process is opened.
Exception Network Range	For secure processes in forced mode, only protected application system servers can be accessed; other network addresses are blocked. To allow access to additional networks, define them as exception ranges. Supports IP ranges, domain names, and multiple entries separated by commas (e.g., 192.168.1.1-192.168.1.100,192.168.2.102,development.tec).
Secure Process	To configure a secure process, click the to add it, and enter the process name and encryption mode. Process Name: Enter the name(s) of the process(es) to be set as secure. Multiple process names can be entered in one configuration, separated by commas (e.g., iexplore.exe, TortoiseProc.exe). When saved, multiple entries will automatically be split into separate configurations. Encryption Mode: Divided into Forced Mode, Smart Mode, and Smart Browser Mode. Forced Mode: The secure process can only access protected application servers and servers within the exception network range; all other addresses are blocked. Files uploaded to protected servers or exception network servers are decrypted, and files downloaded are encrypted. Smart Mode: The secure process can access both protected servers and exception network servers, as well as other non-protected servers. If the process has not accessed a protected server since startup, files uploaded or downloaded to non-protected servers or exception network servers are transferred without encryption/decryption. If the process has accessed a protected server, subsequent uploads to non-protected or exception servers are decrypted, and downloads are encrypted. Smart Browser Mode: The secure process can access protected servers, exception addresses, and other non-protected addresses. Regardless of whether it has accessed a protected server, files uploaded or downloaded to non-protected or exception servers are transferred without encryption/decryption. If Smart Mode is selected, the related Smart Mode Settings must be configured.
Smart Mode Settings	This setting applies only to secure processes configured in Smart Mode.
Protected Servers	Enter the protected application system servers. Multiple servers can be added, separated by semicolons, commas, or line breaks. Supported formats include: - IP:Port (e.g., 192.168.2.104:8080) - IP:Port Range (e.g., 192.168.2.104:8080-8079) - IP Range:Port (e.g., 192.168.2.1-192.168.2.255:8080) - IP Range:Port Range (e.g., 192.168.2.1-192.168.2.255:1000-8079) - Domain name (e.g., jira5.development.tec) Note: Protected servers set here must match the protected application system servers configured in the security gateway. Otherwise, smart mode secure processes cannot access the protected servers.
Upload Control	Check this option to control file uploads.
Upload Size Limit	Set the maximum file size allowed for upload. Files exceeding this size will be blocked.
Upload Control Whitelist	Specify whitelist addresses; files uploaded to these addresses are not restricted when upload control is enabled. Multiple entries are supported, separated by semicolons, commas, or line breaks. Supported formats include: - IP:Port (e.g., 192.168.2.104:8080) - IP:Port Range (e.g., 192.168.2.104:8080-8079) - IP Range:Port (e.g., 192.168.2.1-192.168.2.255:8080) - IP Range:Port Range (e.g., 192.168.2.1-192.168.2.255:1000-8079) - Domain name (e.g., jira5.development.tec)

After configuring secure communication settings, you can preview the policy effects for a selected object. In the preview page, Application System Protection is divided into two sections: Policy Settings and Policy Execution Effect. The execution effect shows the object's final combined policy and its source.

If inheritance from the parent group policy is enabled, the object's policy is combined with the parent's policy. The combination rules are as follows:

• 1. For check-type settings (e.g., "Enable Application System Protection," "Upload Control" in Smart Mode), if any inherited policy is checked, the final combined effect is checked.
• 2. For other input-type settings (e.g., "Secure Process Window Label," "Exception Network Range," "Secure Processes," "Smart Mode Settings"), non-conflicting entries are combined, while conflicting entries are resolved according to policy priority; the setting from the highest-priority policy becomes the final combined effect.