Industrial Policy Management

L2Proxy turns an approved industrial access requirement into an active protection path. The policy-management workflow guides the customer from a precise rule, through a complete access policy, into a reviewed policy profile used by L2Proxy Connect or a standalone L2Proxy service.

Customer outcome: each authenticated remote user receives only the industrial access that has been approved for that user, destination, and operation—and that access is inspected and enforced through the approved Connect or standalone path.

Purpose and expected outcome

This section explains how an industrial access requirement becomes deployed policy. After reading it, the customer should understand the relationship between a reusable rule, an Access Policy, a Policy Profile, an authenticated user, industrial scope, and the selected enforcement path.

The capability is designed around industrial questions rather than network syntax:

• Who is requesting access?
• From which approved access context?
• When is the access permitted?
• Which plant equipment or control endpoint may be reached?
• Which monitoring or control operations are permitted?
• Should a deviation be recorded, accepted, or blocked?

From a rule to active protection

Reusable Rule
    precise source, destination, equipment, point, or operation condition
        ↓
Access Policy
    user + context + permitted industrial activity + enforcement outcome
        ↓
Policy Profile
    reviewed and ordered collection of all policies required for one service
        ↓
Enforcement selection
    L2Proxy Connect for native session identity
    or standalone Service Profile for an independent boundary service

Figure — From a rule to active protection across the policy engineering lifecycle.

This separation keeps individual rules reusable, policies understandable, and the final operating profile manageable as one controlled unit.

Complete operational workflow

Stage	What the customer does	What the system delivers
Build the rule foundation	Select reviewed source, destination, equipment-point, and industrial-operation conditions	Reusable and consistent decision logic
Compose the access policy	Identify the VPN user and define permitted industrial access	A complete, human-readable policy with logging and enforcement behavior
Manage policies	Review, search, revise, enable, disable, reorder, or remove policies	A governed policy inventory with revisions
Assemble the policy profile	Select all policies needed for the protected access path	One validated and ordered final rules file
Select the enforcement path	Use Connect for native session identity or a standalone Service Profile for an independent boundary	An explicit link between approved policy and enforcement
Activate protection	Enable Connect or start the assigned standalone instance	Active protocol-aware monitoring and blocking

Per-user industrial enforcement

L2Proxy Connect receives authenticated user and live session identity directly in its industrial decision context. A standalone service can alternatively protect an isolated path assigned to one user. Both patterns allow customers to establish:

• clear separation between vendors, engineers, operators, and support personnel;
• different equipment and operation permissions for different users;
• explicit enforcement-path and policy assignment;
• smaller impact if one credential or remote workstation is misused;
• user-specific evidence for permitted and denied industrial activity;
• the ability to change one user's protection without broadening another user's access.

The catalog intentionally focuses on the industrial result. VPN infrastructure and its administration are separate product capabilities and are not part of this chapter.

Rules, policies, and profiles

Product term	Industrial meaning
Rule	A precise test such as “destination is Feeder 12 breaker” or “operation is breaker Close”
Access Policy	A complete decision describing who may perform which operation on which equipment and what L2Proxy must do
Policy Profile	The final ordered collection of policies required for a protected user or operating context
L2Proxy Connect	Identity-aware enforcement directly inside the authenticated session path
Service Profile	The operating settings for one L2Proxy service, including its selected Policy Profile
L2Proxy Instance	The independent running enforcement service for the assigned access path

Industrial benefits

• Least-privilege remote access: approval can be limited to required equipment and operations, not merely general connectivity.
• Protocol-aware control: a user may be allowed to observe a device but prevented from issuing switching or setpoint commands.
• Consistent engineering: reusable rules and equipment-library knowledge reduce repetitive policy creation.
• Separation of duties: different users can receive different policy profiles and dedicated enforcement services.
• Traceable change: policy revisions, profile contents, and service assignment remain explicit and reviewable.
• Operational evidence: accepted and denied operations can be logged with equipment, point, command, and user context.

Continue with the Guided Policy Composer.