Open Policy Model

Overview

The Open Policy Model (OPM) is Tufin’s device onboarding architecture for adding new devices to TOS. OPM uses device connectors that collect device data and report it into the native TOS architecture. This approach streamlines onboarding and provides a consistent feature set for all supported OPM-based devices.

The connectors can onboard many different kinds of devices, including firewalls, routers, and cloud platforms. They report relevant device information such as interfaces, routes, and policies. After installation on the TOS system, each connector registers automatically so the device can be added and monitored in SecureTrack. OPM device connectors are TOS-version independent. If a specific connector requires a minimum version or has a version-specific dependency, it will be stated in that device’s documentation.

OPM device connectors collect device data and report it to the TOS model. The available feature set depends on the information reported by each connector.

Devices can be added through the UI or by using the API. For API-based onboarding, see Add an OPM Device Using the API.

Supported OPM devices

Use the links below to view monitoring instructions and feature support in SecureTrack and SecureChange.

Vendor Related Links

Arista

Aruba

Huawei

Illumio

Versa

OPM feature support matrix

The table shows the TOS features that are supported depending on what is implemented in the OPM device connector.

For general questions on OPM device support or compatibility, contact [email protected]. This is not a support address.
For technical issues, contact Tufin Support.

Tier

Use Case

Feature

Supported

SecureTrack+

Centralized Security Policy

Device Viewer

Yes

Rule Viewer

Yes

Security Policy Compliance

Permissiveness

Yes

Violations

Yes

Change Tracking

Rule History

Yes

Revision History

Yes

Security Policy Cleanup

Rule Usage

No

Shadowing Rules

No

SecureChange+

Automated Path Identification and Target Selection

Includes matching rules

Yes

Automatic target identification
based on network topology

Yes

Risk Analysis

USP risk assessment

Yes

Automation Change Design

Adding Access

Yes

Ticket to rule mapping

Yes

Decommissioning Access

No

Automation Change Request Verification

Adding Access

Yes

Decommissioning Access

No

Enterprise

Automated Change Provisioning

—

Yes

OPM password requirements

General requirements

Passwords can:

  • Either be empty, or include up to 250 alphanumeric and special characters, including spaces.

  • Include special characters, used on their own, anywhere in the password: ! @ # $ ^ & * ( ) _ + - = [ ] { } | ; : , . > ? / ~ \ \ ' "`

  • Include text that resembles SQL syntax, such as OR 1=1--

Limitations

The table lists invalid character combinations in passwords for OPM devices.

A password containing any of these combinations returns this error on save: One or more fields contain invalid characters. Please remove them and try again.

Special character/pattern

Not allowed when

Example

% (percentage)

  • Followed by two or more characters – letters, digits, or special characters.

pa%ssword1

< (less than)

  • Followed by more than one letter.

  • Password includes a greater than < character anywhere in it.

<ss

<pas>ss

> (greater than)

  • Password includes a less than < character anywhere in it.

om<it>

\ (backslash)

  • Followed by a lowercase u or x.

\uword

\x41

= (equal to)

  • Followed immediately by double quotes.

password="

' (single quote)

  • Followed by a semicolon anywhere in the password.

  • Word script or SCRIPT appears after the single quote.

'jk;k

'script

[ ]

!

+

( )

  • Six or more characters appear consecutivley.

pass!!!!!!word

pass()()()()()()word

&lt

&LT

&#

  • Password includes specified sequences.
    Mixed case is allowed.

pass&lt

word&LT

pass&#

javascript:

eval(

+ADw-

<!ENTITY

  • Password includes specified sequences.

passjavascript:123

word12eval(

pass+ADw-

word<!ENTITY34