Skip to main content

Create your first connection

This guide walks you through your first working zero trust connection: create a location, deploy and enroll a connector, write an access policy, and confirm traffic is flowing in Live Audit.

Prerequisites​

  • Sign in as a service provider admin or a customer admin. The steps are the same for both roles; the navigation paths differ only in /provider vs /customer.

New to the terminology? Key concepts defines the terms used in this guide.

1. Add a location​

A location is where your connector software runs.

  1. Click Locations in the sidebar.
  2. Click Add Location, then click Create New in the prompt.
  3. On the New Location page, fill in the fields:
    • Name: A label for this location.
    • Type: Physical Site or Virtual / Cloud.
    • Address: A map preview loads and autodetects the Latitude and Longitude.
    • Description: Optional notes about the location.
  4. Click Save Location.

2. Deploy and enroll a connector​

A connector is the software that carries traffic onto the zero trust network.

  1. Click Connectors in the sidebar.

  2. Click Add Connector.

    The Create New Connector page opens on the Details tab.

  3. On the Details tab, fill in the fields:

    • Model: Leave the model unselected. This guide builds the connector from a built-in type rather than from a saved blueprint. (If you've already saved models, choose Built-in type instead of From a saved model.)

    • Name: A label for the connector.

    • Type: One of three connector types. Pick whichever fits what you're connecting:

      • Device: Runs on a device to expose local services.
      • Gateway: Acts as a network gateway for subnet access.
      • SDK Embedded: Embeds the zero trust client directly in an application.

      For this guide, choose Gateway, a common starting point that forwards to any network-reachable target.

    • Location: Select the location you just created.

  4. Under Hosted Applications, click Add Application and select an application Type.

    Selecting a type autofills the remaining fields, which you can adjust as needed.

  5. Click Save Connector.

  6. From the connector's row or detail view, download its enrollment token (a JWT) and apply it where the connector software runs.

    The connector status updates to online and enrolled in the console.

For the full connector lifecycle and all three connector types, see Deploy and enroll a connector.

3. Write an access policy​

Nothing is reachable until an access policy links two connectors — that's zero trust by default.

  1. Click Access Policies in the sidebar, then click New Access Policy to open the builder.
  2. On the source side, match the connector you want to grant access from.
  3. On the destination side, match the connector you just enrolled.
  4. Review the materialized source/destination pairs to confirm they're what you expect.
  5. Name the access policy and save.

For more on rules, exclusions, and the graph/map/table views, see Build access policies.

4. Confirm traffic in Live Audit​

  1. Click Live Audit in the sidebar.
  2. On the Map, find the location and connector you set up. The access policy appears as a line to its destination.
  3. Switch to the Table view to check the connector's usage and confirm it has no Critical alerts.

For more on views, scope, and time ranges, see Live Audit.

What to do next​

  • Add more locations and connectors, then expand your policy by matching on location or connector model instead of a specific connector.
  • Define a connector model to give future deployments a consistent set of applications. For more info, see Manage connector models and templates.
  • Save your customer setup as a customer template to reuse as a starting point for the next customer. For more info, see Manage connector models and templates.