Using the tenant portal, you can configure the firewall capabilities provided by NSX Data Center for vSphere in your VMware Cloud Director organization virtual data center. You can create firewall rules for distributed firewalls to provide security between virtual machines in an organization virtual data center and firewall rules to apply to an edge gateway firewall to protect the virtual machines in an organization virtual data center from outside network traffic.
The NSX Data Center for vSphere logical firewall technology consists of two components to address different deployment use cases. The edge gateway firewall focuses on North-South traffic enforcement while the distributed firewall focuses on East-West access controls.
Key Differences Between Edge Gateway Firewalls and Distributed Firewalls
An edge gateway firewall monitors North-South traffic to provide perimeter security functionality including firewall, Network Address Translation (NAT) as well as site-to-site IPSec and SSL VPN functionality.
A distributed firewall provides the capability to isolate and secure each virtual machine and application down to the layer 2 (L2) level. Configuring distributed firewalls effectively quarantines any external or internal network security compromise, isolating East-West traffic between virtual machines on the same network segment. Security policies are centrally managed, inheritable, and nestable, so networking and security administrators can manage them at scale. Additionally, once deployed, defined security policies follow the virtual machines or applications when they move between different virtual data centers.
About Firewall Rules
As described in the relevant product documentation, in NSX Data Center for vSphere, the firewall rules defined on the centralized level are referred to as pre rules. You can also add rules at an individual edge gateway level, and those rules are referred to as local rules.
Each traffic session is checked against the top rule in the firewall table before moving down the subsequent rules in the table. The first rule in the table that matches the traffic parameters is enforced. Rules are displayed in the following order:
- User-defined pre rules have the highest priority, and are enforced in top-to-bottom ordering with a per-virtual NIC level precedence.
- Auto-plumbed rules (rules that enable control traffic to flow for edge gateway services).
- Local rules defined at an edge gateway level.
- Default distributed firewall rule
For more information about how the NSX Data Center for vSphere software enforces firewall rules, see Change the Order of a Firewall Rule in the NSX Data Center for vSphere documentation.
