Network zones

Besides the internal and external zones, you can define your own network zones, for example a branch office, a partner's network or a list of countries, and give each one its own authentication level.

Defining zones

Zones are defined on Security settings / General / Network zones (up to 64 zones). Each zone has:

Name: shown in the access rules
Matches on:
- IP addresses: one address, range or CIDR block per line
- Country: one or more countries, found from the user's IP address
Default authentication level for users: the level the zone applies when an access rule uses Default for it. Same as external zone uses the external zone's default level.
Authentication level for Trustelem admin console: the level administrators need to sign in to the admin console from this zone

Which zone applies:

The internal network always wins: an address in the internal network is in the internal zone, even if a network zone also matches it
Otherwise the network zones are checked from top to bottom and the first matching zone wins: use the arrows to change their priority
If no zone matches, or the origin of the connection can't be determined, the external zone applies

You can't save a zone setting that would forbid your own access to the admin console from where you are connected.

Zone levels in access rules

Once a zone is defined, every access rule shows a line for it. Possible values:

Same as external zone: the rule applies its external level to users coming from this zone. This is the value of every rule until you change it, so defining a zone changes nothing for existing rules.
Default: applies the zone's Default authentication level for users
1 factor: only one authentication factor needed
2 factors: two authentication factors needed
Forbidden: the user can't access the application from this zone

Example

Company offices are in the internal network. A "Partners" zone lists the salesforce access rule for the group "Sales" is: internal -> 1 factor | external -> 2 factors | Partners -> Forbidden.

A salesperson at the office signs in with 1 factor
The same salesperson on a partner's network can't access salesforce
From anywhere else, 2 factors are needed

Renaming and deleting zones

Renaming a zone or changing its addresses keeps the levels the access rules set for it
Deleting a zone removes it from every access rule: users from its adds set for the zone they then fall into (usually external). Before saving, a warning tells you how many access rules set a level for the zone you are deleting.
A new zone never takes over the levels set for a deleted zone, even w

LDAP and Radius applications do not provide the user's IP, so zones do not apply to them.