You can edit the default firewall settings that apply to traffic that does not match any of the user-defined firewall rules.
About this task
Default firewall settings apply to traffic that does not match any of the user-defined firewall rules. The Distributed Firewall default rule is displayed on the centralized firewall user interface. The default Layer 3 rule is show under the General Tab and the default Layer 2 rule is shown under the Ethernet tab.
The default Distributed Firewall rules allows all L3 and L2 traffic to pass through all prepared clusters in your infrastructure. The default rule is always at the bottom of the rules table and cannot be deleted or added to. However, you can change the Action element of the rule from Allow to Drop or Reject (not recommended), and indicate whether traffic for that rule should be logged.
- Select Firewall in the navigation panel.
- Click the General tab for L3 rules or the Ethernet tab for L2 rules.
- In the Name column of the rule, click the pencil icon and make changes.
- In the Action column of the rule, click the pencil icon.
- Select one of the options in the dialog box:
Allow - Allows all L3 or L2 traffic with the specified source, destination, and protocol to pass through the current firewall context. Packets that match the rule, and are accepted, traverse the system as if the firewall is not present.
Drop - Drops packets with the specified source, destination, and protocol. Dropping a packet is a silent action with no notification to the source or destination systems. Dropping the packet causes the connection to be retried until the retry threshold is reached.
Reject - Rejects packets with the specified source, destination, and protocol. Rejecting a packet is a more graceful way to deny a packet, as it sends a destination unreachable message to the sender. If the protocol is TCP, a TCP RST message is sent. ICMP messages with administratively prohibited code are sent for UDP, ICMP, and other IP connections. One benefit of using Reject is that the sending application is notified after only one attempt that the connection cannot be established.
Selecting Reject as the action for the default rule is not recommended.
- In the Log column, click the pencil icon.
- Set the Log toggle to either Yes to enable logging, or No, to disable logging. You can also write notes here. Note that selecting Yes logs all sessions matching this rule. Enabling logging can affect performance.
- Click Save.