Netskope Help

Time Based Policies

Time Based Policies extend your existing Inline policy infrastructure by supporting policies with time restrictions on day, date, and time of day. Once created, time intervals can be reused in other policies.

Some examples of time based policies include the following scenarios:

  • Block all social media sites for all users across the world during work hours 9 am-5 pm, Monday to Friday, starting on Jan 10th, 2020 and ending on Feb 20, 2020.

  • Block access to work-related sites on the weekends, 24 hours a day, starting now with no end date.

  • Block online retail sites Monday to Sunday, 9am-5pm PST, starting Nov 1, 2020 to Dec 31, 2020.

To create a Policy Schedule:

1. Navigate to Policies > Real-time Protection > New Policy > Status. This feature is enabled by default if you have this feature enabled in your account. You will see the TimePolicyEnabled.png checkmark.

Important

Contact Support to enable this feature in your account if you do not see the option in the Policy creation page.

Currently, you cannot use time based policies to enforce time quotas, daylight savings, and predefined time zones functionality.

Click the TBPpolicySchedule.png button to configure the start and end dates for the policy. The Policy Schedule window opens.

TBPpolicyScheduleMain.png

2. Select a Time Range. A calendar picker appears and you must choose a single start date with start time, and a single end date with end time. The Time Range always applies to Policy Schedule, regardless if the Time Interval is modified for not.

  • The default setting is set to start “Now” (today’s date at 12AM) and end time is default set to “Infinite“ (no set date and time).

  • The dates before TODAY (based on UTC-12:00) are disabled for both “Start” and “End".

3. Select a Time Interval. Time Interval emphasizes intervals, allowing you to make further specifications during the chosen Time Range. Click the TBPTimeIntervalPlusIcon.png plus icon to open the Create Time Interval window. You must create a time interval before you're able to select it from the dropdown.

Click the gear TBPTimeIntervalGearIcon.png icon to open the Manage Time Intervals window.

TBPManageTimeInterval.png

This window populates with any time intervals you have already created. These can be reused in other policies and easily searched and added from this window.

Note

If you try to delete a time interval that is used in other policies, an error displays, you must delete the time interval from the other policies before deleting from the Manage Time Intervals list.

Click TBPnew.png button to create a new Time Interval from the Manage Time Intervals window.

4. Type a name for the time interval profile.

5. Specify Daily or Weekly intervals. If you select Daily, the system assumes all days of the week. Within the Weekly interval, you can further specify Days of the Week and Time of Day between a set time. Time of Day is enabled by default. However, if you disable the TBPTimeOfDayToggle.png toggle button, the system treats Time of day as 'all day'.

TBPWeeklyTimeInterval.png

It is important to note the difference between Time Range and Time Interval. Time Range has a single start and end date / time. Time Interval specifies the periods IN Time Range to which the Policy Schedule applies.

Note

The time zone is based on the user's local time and source IP addresses.

The diagram below shows a graphical example.

TBPtimeRangeEx.png

6. Once you have made time based selections, click Save. The system checks if there is any overlap between time range and time interval. If there is NO overlap, you will see an error message similar to the following:

TBPPolicyScheduleError.png

If there are no errors, the Policy creation page shows shows the details of the policy schedule, similar to the following:

TBPEnabledActiveTimeInterval.png

However, if there are any errors such as an expired time range, the time range appears grayed out and a notice displays, similar to the following:

TBPEnabledActiveError.png

7. Click theApplyChangesButton.pngbutton in the Policies > Real-time Protection policy list page to save the policy. The earlier Save is to create the Time Interval.

From the Policies > Real-time Protection policy list page if a policy schedule is configured, you will see a clock ClockIcon.png icon   beside the policy name in the Policy list page.

If a time range has expired, you will see a grayed out GrayedClockIcon.png clock icon and policy name. The policy is no longer enabled because the time range no longer matches the criteria.

In both cases, you can hover over the clock icon for details.