Firewall Target Tags are applied on the SE VMs to allow the ingress and egress traffic to the Controller, other SEs and virtual services. The firewall tags need to be created in the VPC in the network project.