Creating a Secure Network Policy - Device to Device Communication

Create a Device-to-Device Communication Policy

Use a Device-to-Device Communication policy to control which devices in your organization can connect to each other, and how. Connections can be limited to the local network or allowed remotely through Secure Network.

Requirement
Secure Network requires Windows, Mac, and Linux Agent version 11.0 or greater and ThreatLocker Access App version 1.0 or later.

Important
Configuring local subnets is required for device-to-device communication. See Local Network Configuration.

In this article

Create the Policy

Log in to the ThreatLocker Portal.
Navigate to Network > Network Policies.
Select New Policy.
Select Device to Device Communication in My Organization.

Configure the Policy

Service

Select the service this policy will control, such as RDP or SMB. If the service isn’t listed, select Custom.

Ports

Ports fill in automatically based on the service. For Custom services, enter them manually.

Tip
Separate multiple ports with commas and use a dash for port ranges (e.g., 22,21,5128-5130).

Expiration and Schedule

Expiration: Set a date and time when the policy stops.
Schedule: Limit the policy to specific days or times.

Leave both off to keep the policy always active.

Permit Access Through ZTNA

Turn this on to let devices connect when they’re off the local network. Traffic is routed through Secure Network, ThreatLocker’s Zero Trust Network Access (ZTNA) service.

Selected: Devices connect through ZTNA only when a local network connection is not available. If they can reach the destination locally, they connect directly. A subnet mapping is required for peer validation. Select the Secure Network location closest to the destination.
Not selected: Devices can connect only over the local network. Devices that can't reach the destination locally can't access it.

Source and Destination

Source: The Organizations, Computer Groups, or Computers that start the connection.
Destination: The Organizations, Computer Groups, or Computers they can connect to.

You can select multiple items for each.

Applications

By default, All Applications is selected. To limit the policy, select specific local applications.

Users and Groups

By default, Everyone is selected. To limit the policy, select specific local users or groups.

Review and Create

Select Next.
Review your selections on the Secure Network Policy Summary page.
Optionally, turn on Log in Unified Audit to record when the policy is matched.
Check the Route field. It shows Local when ZTNA is off.

Tip
If you haven’t defined your local subnets yet, select Define Local Subnets in the Route field to go directly to Local Network Configuration.
Select Create.

Troubleshooting

Devices stopped communicating after upgrading the Windows Agent
When upgrading to Windows Agent version 11.0.26 or later, upgrade all devices participating in ZTNA to 11.0.26 or newer.

Devices can’t connect on the local network
Confirm local subnets are configured in Local Network Configuration.