sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-08-28 02:31:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: document posture check evaluation timing and policy distribution (#774)

Browse Source 
Add a 'When Posture Checks Are Evaluated' section to the posture checks
page covering connect/login evaluation, immediate distribution of changes,
and the connection-time evaluation caveat for mid-session state changes.

Add a 'How Policy Changes Are Distributed' section to the access control
overview covering event-driven push, no redistribution interval, and
change coalescing. The two sections cross-link.
This commit is contained in:
Jack Carter
2026-06-01 10:14:31 +02:00
committed by GitHub
parent 109140a77a
commit 93e57b61f6
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/pages/manage/access-control/index.mdx
View File

@@ -349,6 +349,14 @@ Protocol: ALL
This creates an unclear mesh where laptops, servers, and everything else can all access each other bidirectionally. It's impossible to tell from this policy what's actually happening, and you've likely granted more access than needed.
## How Policy Changes Are Distributed
When you create or change a policy, group, posture check, DNS setting, route, or network resource, NetBird distributes the updated configuration to all connected peers immediately. Peers receive the change without reconnecting.
Distribution is event-driven. There is no periodic redistribution interval; updates are sent in response to configuration changes, not on a timer. When many changes happen in quick succession, NetBird coalesces them so connected peers receive a single consolidated update rather than one update per change.
Posture checks follow the same distribution model. For how and when a posture check is evaluated for a peer, see [When Posture Checks Are Evaluated](/manage/access-control/posture-checks#when-posture-checks-are-evaluated).
## Advanced Patterns and Use Cases
### Pattern 1: Port Ranges for Application Suites

10
src/pages/manage/access-control/posture-checks/index.mdx
View File

@@ -117,6 +117,16 @@ If you revisit the `Posture Checks` dashboard, you'll notice a green dot next to
Following these steps, you can effectively implement and manage NetBird's Posture Checks, significantly enhancing your network's security posture.
## When Posture Checks Are Evaluated
NetBird evaluates posture checks when a peer connects or logs in. The check result is computed at connection time and is not re-evaluated continuously for the duration of an active session.
When you add or change a posture check on a policy, the updated configuration is distributed to connected peers immediately. A peer that is already connected is evaluated against the new check on its next connection. There is no periodic redistribution interval; distribution is driven by configuration changes, not a timer. For more on how changes reach peers, see [How Policy Changes Are Distributed](/manage/access-control#how-policy-changes-are-distributed).
<Note>
Because evaluation happens at connection time, a peer that passes a posture check and later changes state during a long-lived session (for example an operating system downgrade or a required process being stopped) is not re-evaluated until it reconnects. If you require enforcement to react to a peer changing state mid-session, account for this connection-time evaluation model in your design.
</Note>
## Known Limitations
### Peer Network Range Check on Mobile Platforms