Add a Distributed Firewall Rule

You first add a distributed firewall rule to the scope of the organization virtual data center. Then you can narrow down the scope at which you want to apply the rule. The distributed firewall allows you to add multiple objects at the source and destination levels for each rule, which helps reduce the total number of firewall rules to be added.

For information about the predefined services and service groups that you can use in a rule, see View Services Available for Firewall Rules and View Service Groups Available for Firewall Rules.

Prerequisites

• Enable the Distributed Firewall on an Organization Virtual Data Center Backed by NSX Data Center for vSphere
• If you want to use an IP set as a source or destination in a rule, Create an IP Set for Use in Firewall Rules and DHCP Relay Configuration.
• If you want to use an MAC set as a source or destination in a rule, Create a MAC Set for Use in Firewall Rules.
• If you want to use a Security group as a source or destination in a rule, Create a Security Group.

Procedure

1. On the Virtual Data Center dashboard screen, click the card of the virtual data center you want to explore and under Networking, select Security.
2. Select the security services VDC network for which you want to modify firewall rules, and click Configure Services.
   The Security Services screen displays.
3. Select the type of rule you want to create. You have the option to create a general rule or an Ethernet rule.
   Layer 3 (L3) rules are configured on the General tab. Layer 2 (L2) rules are configured on the Ethernet tab.
4. To add a rule below an existing rule in the firewall table, click in the existing row and then click the Create () button.
   A row for the new rule is added below the selected rule, and is assigned any destination, any service, and the Allow action by default . When the system-defined Default Allow rule is the only rule in the firewall table, the new rule is added above the default rule.
5. Click in the Name cell and type in a name.
6. Click in the Source cell and use the now visible icons to select a source to add to the rule:

   Action	Description
   Click the IP icon	Applicable for rules defined on the General tab. Type the source value you want to use. Valid values are an IP address, CIDR, an IP range, or the keyword any. The distributed firewall supports IPv4 format only.
   Click the + icon	Use the + icon to specify the source as an object other than a specific IP address: Use the Select objects window to add objects that match your selections and click Keep to add them to the rule. To exclude a source from the rule, add it to this rule using the Select objects window and then select the toggle exclusion icon to exclude that source from this rule. When the toggle exclusion is selected on the source, the rule is applied to traffic coming from all sources except for the source you excluded. When the toggle exclusion is not selected, the rule applies to traffic coming from the source you specified in the Select objects window

7. Click in the Destination cell and perform one of the following actions:

   Action	Description
   Click the IP icon	Applicable for rules defined on the General tab. Type the destination value you want to use. Valid values are an IP address, CIDR, an IP range, or the keyword any. The distributed firewall supports IPv4 format only.
   Click the + icon	Use the + icon to specify the source as an object other than a specific IP address: Use the Select objects window to add objects that match your selections and click Keep to add them to the rule. To exclude a source from the rule, add it to this rule using the Select objects window and then select the toggle exclusion icon to exclude that source from this rule. When the toggle exclusion is selected on the source, the rule is applied to traffic coming from all sources except for the source you excluded. When the toggle exclusion is not selected, the rule applies to traffic coming from the source you specified in the Select objects window

8. Click in the Service cell of the new rule and perform one of the following actions:

   Action	Description
   Click the IP icon	To specify the service as a port–protocol combination: Select the service protocol. Type the port numbers for the source and destination ports, or specify any, and click Keep.
   Click the + icon	To select a pre-defined service or service group, or define a new one: Select one or more objects and add them to the filter. Click Keep.

9. In the Action cell of the new rule, configure the action for the rule.

   Option	Description
   Allow	Allows traffic from or to the specified sources, destinations, and services.
   Deny	Blocks traffic from or to the specified sources, destinations, and services.

10. In the Direction cell of the new rule, select whether the rule applies to incoming traffic, outgoing traffic, or both.
11. If this is a rule on the General tab, in the Packet Type cell of the new rule, select a packet type of Any, IPV4, or IPV6.
12. Select the Applied To cell, and use the + icon to define the object scope to which this rule is applicable.
    When the rule contains virtual machines in the Source and Destination cells, you must add both the source and destination virtual machines to the rule's Applied To for the rule to work correctly.

    Important: IP address groups (IP sets), MAC address groups (MAC sets), and security groups containing either IP sets or MAC sets are not valid input parameters.
13. Click Save Changes.