# Global Secure Access cloud firewall protects branch office internet traffic
When you connect remote networks to Global Secure Access through IPsec tunnels but don't set up cloud firewall policies, all internet-bound traffic from…
Source: https://maester.dev/docs/tests/ZTA.25416
## Overview
When you connect remote networks to Global Secure Access through IPsec tunnels but don't set up cloud firewall policies, all internet-bound traffic from branch offices goes through the Security Service Edge without egress filtering controls. If a threat actor gains access to a branch office workstation, they can make outbound connections to command-and-control infrastructure, exfiltrate data over standard ports, or download malicious payloads without network-layer inspection.
Without Global Secure Access cloud firewall:
- You can't enforce a deny-by-default posture or restrict outbound communications from branch networks to unauthorized internet destinations.
- Threat actors can stage data for exfiltration, pivot to cloud resources, or move laterally without detection.
- Traditional perimeter defenses might assume all egress is legitimate, resulting in gaps in security coverage.
Cloud firewall policies linked to the baseline profile provide centralized egress control for all remote network traffic. Administrators can use these policies to define granular filtering rules that restrict unauthorized outbound communications.
## Remediation
- As a prerequisite for cloud firewall, [configure remote networks for internet access](https://learn.microsoft.com/entra/global-secure-access/how-to-create-remote-networks?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
- Follow the steps in [Configure Global Secure Access cloud firewall](https://learn.microsoft.com/entra/global-secure-access/how-to-configure-cloud-firewall?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to:
- Create a cloud firewall policy with appropriate filtering rules.
- Add or update firewall rules based on source IP, destination IP, ports, and protocols.
- Link the cloud firewall policy to the baseline profile for remote networks.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Access control |
| ATT&CK | [T1071](/docs/tests?mitre=T1071) Application Layer Protocol, [T1041](/docs/tests?mitre=T1041) Exfiltration Over C2 Channel, [T1105](/docs/tests?mitre=T1105) Ingress Tool Transfer |
| Licence | Entra_Premium_Internet_Access |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.