source CIDR in Umbrella CDFW

[krezov.igor]

We want to test Umbrella CDFW for a specific set of users and as far as I know CDFW does not support identity as a source in the policy rules. I was wondering if we can set in the CIDR field as a source a private RFC 1918 segment from our organization so we can test a policy for a specific segment without touching or making any changes on the edge routers ?

I have checked the official documentation for Umbrella where it is stated that CIDR stand for Source CIDR IP Addresses—The tunnel's source addresses (IP or CIDR) to which the rules applies which is kind of confusing. 

I am not sure if this means a source address from the edge routes where the tunnel is built or it is related for the encapsulated traffic that passes trough the tunnel. 

[nbogdaje]

The ipsec headers are stripped before the firewall rules are processed. This means it looks at the original IP headers which should be the private IP of the client. I also just tested this in the lab and confirmed I can block traffic for a specific private subnet without affecting other subnets going over the tunnel by specifying the private subnet in the "source" "CIDR ip addresses" section.