One firewall, one internet connection — but your staff, your students and your guests should not all get the same rules. Policy Manager is the app that splits one Arista (Untangle) firewall into separate rulebooks, one per group.
Out of the box, every device behind your firewall follows the same policy: the same Web Filter, the same blocked categories, the same apps. That is fine for a home network, but in an office or a school it breaks quickly — HR needs sites that students must never open, and guests should get a short, strict list. Policy Manager solves this by creating extra policies (Arista calls them racks). Each policy carries its own set of apps with its own settings, and a simple rule decides which group lands in which policy. This guide follows the exact flow from the video: log in, create an HR policy, install modules into it, assign people by IP or MAC address, and understand the default policy that catches everyone else.
| Policy (Rack) | Who Lands Here | Typical Web Filter Behaviour |
|---|---|---|
| HR Policy | HR team PCs, matched by IP or MAC | Job portals and social media allowed, rest standard |
| Student Policy | Lab and classroom devices | Strict — social media, games and proxies blocked |
| Default Policy | Everyone and everything else | Balanced office filtering — this one ships with the firewall |
Everything starts in the admin interface, exactly as shown in the video:
You will see one policy already sitting there: the Default policy. It is created automatically, it cannot be removed, and right now it is processing all of your traffic. Nothing you build later works until a rule sends traffic away from it — keep that in mind.
Click to add a new policy and give it a name your team will understand at a glance — the video uses HR Policy as the example, because departments are the most common reason to do this. Two settings matter here. The name is just a label, so name it after the group, not the technology: HR, Students, Guests, Servers. The Parent Policy (parent rack) decides inheritance: a child policy starts by inheriting the apps and settings of its parent, and you then change only what is different. Picking the default policy as the parent is the normal choice — the new policy begins as a copy of your working setup instead of an empty box with no filtering at all.
A policy on its own does nothing — it is an empty rack until you install apps into it. Open the new policy and install the modules that group needs, for example Web Filter. This is the heart of the whole feature: the HR policy's Web Filter is a separate instance with its own categories, block lists and pass lists. Allowing a job portal in the HR policy's Web Filter does not allow it for students, because the student policy has its own Web Filter instance with its own settings. Install only what that group needs — every extra app is extra processing and one more thing to maintain.
Now tell the firewall who belongs to this policy. Back in Policy Manager, open the Rules tab and add a rule: when traffic matches the condition, send it to the HR Policy. The video assigns users by source IP address or source MAC address — for example, the HR manager's PC at a fixed address like 192.168.1.50, or a list of the HR department's addresses. Rules are checked from the top down and the first matching rule wins, so the order of this list is not decoration — it is the logic. Anything that matches no rule at all simply falls through to the default policy.
Do not announce the new rules until you have watched one real device obey them:
If the first test fails, the usual causes are a DHCP address that changed, a rule sitting below a broader rule, or an old session that started before the rule existed. The diagnosis page in this series walks through those one by one.
Policy Manager is not part of the free core of the firewall. Untangle is now sold as Arista Edge Threat Management (ETM) NG Firewall, and Policy Manager — like the full Web Filter and the Directory Connector that adds username-based rules — is a subscription app. The platform download is free, and you can open the interface and look around during a trial, but a permanent multi-policy setup needs the subscription that covers it. Prices and bundles change, so check the current Arista licensing for your user count before you design a big rollout around it.
Creating the HR policy, setting its parent, installing the Web Filter module and assigning users by IP and MAC — the complete sequence is shown live in the video.
▶️ Watch Full VideoNo. The firewall platform (now Arista Edge Threat Management NG Firewall) is a free download, but Policy Manager is a subscription app. Without the subscription you only have the single default policy. Trial licences let you test it before paying.
Arista uses the word rack for a policy. A rack is one complete rulebook: its own set of installed apps, each with its own settings. Policy Manager rules decide which rack processes each new session, and the default rack handles everything no rule matches.
No. When a session starts, the rules are checked from the top and the first matching rule decides the policy for that whole session. A device is always processed by exactly one policy at a time, so rule order is what settles overlaps.