From 93e57b61f6c57b8e8b4df9ec19b50ccd2284e614 Mon Sep 17 00:00:00 2001 From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com> Date: Mon, 1 Jun 2026 10:14:31 +0200 Subject: [PATCH] docs: document posture check evaluation timing and policy distribution (#774) Add a 'When Posture Checks Are Evaluated' section to the posture checks page covering connect/login evaluation, immediate distribution of changes, and the connection-time evaluation caveat for mid-session state changes. Add a 'How Policy Changes Are Distributed' section to the access control overview covering event-driven push, no redistribution interval, and change coalescing. The two sections cross-link. --- src/pages/manage/access-control/index.mdx | 8 ++++++++ .../manage/access-control/posture-checks/index.mdx | 10 ++++++++++ 2 files changed, 18 insertions(+) diff --git a/src/pages/manage/access-control/index.mdx b/src/pages/manage/access-control/index.mdx index 2777515b..b7ed5002 100644 --- a/src/pages/manage/access-control/index.mdx +++ b/src/pages/manage/access-control/index.mdx @@ -349,6 +349,14 @@ Protocol: ALL This creates an unclear mesh where laptops, servers, and everything else can all access each other bidirectionally. It's impossible to tell from this policy what's actually happening, and you've likely granted more access than needed. +## How Policy Changes Are Distributed + +When you create or change a policy, group, posture check, DNS setting, route, or network resource, NetBird distributes the updated configuration to all connected peers immediately. Peers receive the change without reconnecting. + +Distribution is event-driven. There is no periodic redistribution interval; updates are sent in response to configuration changes, not on a timer. When many changes happen in quick succession, NetBird coalesces them so connected peers receive a single consolidated update rather than one update per change. + +Posture checks follow the same distribution model. For how and when a posture check is evaluated for a peer, see [When Posture Checks Are Evaluated](/manage/access-control/posture-checks#when-posture-checks-are-evaluated). + ## Advanced Patterns and Use Cases ### Pattern 1: Port Ranges for Application Suites diff --git a/src/pages/manage/access-control/posture-checks/index.mdx b/src/pages/manage/access-control/posture-checks/index.mdx index e9849c28..8e0551dd 100644 --- a/src/pages/manage/access-control/posture-checks/index.mdx +++ b/src/pages/manage/access-control/posture-checks/index.mdx @@ -117,6 +117,16 @@ If you revisit the `Posture Checks` dashboard, you'll notice a green dot next to Following these steps, you can effectively implement and manage NetBird's Posture Checks, significantly enhancing your network's security posture. +## When Posture Checks Are Evaluated + +NetBird evaluates posture checks when a peer connects or logs in. The check result is computed at connection time and is not re-evaluated continuously for the duration of an active session. + +When you add or change a posture check on a policy, the updated configuration is distributed to connected peers immediately. A peer that is already connected is evaluated against the new check on its next connection. There is no periodic redistribution interval; distribution is driven by configuration changes, not a timer. For more on how changes reach peers, see [How Policy Changes Are Distributed](/manage/access-control#how-policy-changes-are-distributed). + + +Because evaluation happens at connection time, a peer that passes a posture check and later changes state during a long-lived session (for example an operating system downgrade or a required process being stopped) is not re-evaluated until it reconnects. If you require enforcement to react to a peer changing state mid-session, account for this connection-time evaluation model in your design. + + ## Known Limitations ### Peer Network Range Check on Mobile Platforms