Cloud NGFW: Secure Tags replace network tags

Speaker notes

• Cloud NGFW network firewall policies attach globally, regionally, or hierarchically at a folder or org level, the same inheritance pattern as org policies, and they introduce Secure Tags as the targeting mechanism instead of legacy network tags.
• The detail that trips up engineers with classic-firewall-rule experience: policies do not support plain network tags at all, only Secure Tags, migrating an existing setup means re-expressing every network-tag target as a Secure Tag first, it isn't a drop-in syntax change. A service account can still be a target in a policy, but not a source filter, a Secure Tag fills that role instead.
• Secure Tags are the same Resource Manager tags from earlier in this deck, applied specifically to firewall targeting, a rule matching 'any resource tagged env=production' keeps working correctly through a resize or migration, since it matches an identity attribute, not an address.

Deck map