You first add distributed firewall rules at the scope of the organization virtual datacenter. Then using the Applied To setting, you can narrow down the scope at which you want to apply the rule. The distributed firewall allows you to add multiple objects at the source and destination levels for each rule, which helps reduce the total number of firewall rules to be added.

Prerequisites

The organization virtual datacenter must be enabled for the distributed firewall before you can configure distributed firewall rules for that organization virtual datacenter. For details, see Enable the Distributed Firewall on an Organization Virtual Datacenter using the Tenant Portal.

Procedure

  1. Launch Security Services by going to Network > Security.
  2. Select the security services VDC network for which you want to modify firewall rules, and click Configure Services.

    The Security Services screen displays.

  3. Select the type of rule you want to create. You have the option to create a general rule or an Ethernet rule.

    Layer 3 (L3) rules are configured on the General tab. Layer 2 (L2) rules are configured on the Ethernet tab.

  4. To add a rule below an existing rule in the firewall table, click in the existing row and then click the + icon.

    A row for the new rule is added below the selected rule, and is assigned any destination, any service, and the Allow action by default . When the system-defined Default Allow rule is the only rule in the firewall table, the new rule is added above the default rule.

  5. Click in the Name cell and type in a name.
  6. Click in the Source cell and use the now visible icons to select a source to add to the rule:

    Option

    Description

    Click the IP icon

    Applicable for rules defined on the General tab. Type the source value you want to use. Valid values are an IP address, CIDR, an IP range, or the keyword any. The distributed firewall supports IPv4 format only.

    Click the + icon

    Use the + icon to specify the source as an object other than a specific IP address:

    • Use the Select objects window to add objects that match your selections and click Keep to add them to the rule.

    • To exclude a source from the rule, add it to this rule using the Select objects window and then select the toggle exclusion icon to exclude that source from this rule.

    When the toggle exclusion is selected on the source, the rule is applied to traffic coming from all sources except for the source you excluded. When the toggle exclusion is not selected, the rule applies to traffic coming from the source you specified in the Select objects window

  7. Click in the Destination cell and perform one of the following options:

    Option

    Description

    Click the IP icon

    Applicable for rules defined on the General tab. Type the destination value you want to use. Valid values are an IP address, CIDR, an IP range, or the keyword any. The distributed firewall supports IPv4 format only.

    Click the + icon

    Use the + icon to specify the source as an object other than a specific IP address:

    • Use the Select objects window to add objects that match your selections and click Keep to add them to the rule.

    • To exclude a source from the rule, add it to this rule using the Select objects window and then select the toggle exclusion icon to exclude that source from this rule.

    When the toggle exclusion is selected on the source, the rule is applied to traffic coming from all sources except for the source you excluded. When the toggle exclusion is not selected, the rule applies to traffic coming from the source you specified in the Select objects window

  8. Click in the Service cell of the new rule and perform one of the following options:

    Option

    Description

    Click the IP icon

    To specify the service as a port–protocol combination:

    1. Select the service protocol.

    2. Type the port numbers for the source and destination ports, or specify any, and click Keep.

    Click the + icon

    To select a pre-defined service or service group, or define a new one:

    1. Select one or more objects and add them to the filter.

    2. Click Keep.

  9. In the Action cell of the new rule, configure the action for the rule.

    Option

    Description

    Allow

    Allows traffic from or to the specified sources, destinations, and services.

    Deny

    Blocks traffic from or to the specified sources, destinations, and services.

  10. In the Direction cell of the new rule, select whether the rule applies to incoming traffic, outgoing traffic, or both.
  11. If this is a rule on the General tab, in the Packet Type cell of the new rule, select a packet type of Any, IPV4, or IPV6.
  12. Select the Applied To cell, and use the + icon to define the object scope at which this rule is applicable.
    Note:

    When the rule contains virtual machines in the Source and Destination cells, you must add both the source and destination virtual machines to the rule's Applied To for the rule to work correctly.

  13. Click Save Changes.