Versions Compared

Old Version 3

changes.mady.by.user MS

Saved on

compared with

New Version 4

changes.mady.by.user MS

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

NSX distributed firewall rules can apply to services or protocols. Abiquo 4.7.0 introduces support for Application Services with Application Level Gateway (ALG) access.

NSX provides an extensive list of of  protocols and the administrator can configure them for use in the platform and Abiquo will display them as protocols in the firewall rules.

To configure the ALG feature:

  1. To allow additional Applications (that are not listed here in the default value of the property), add them to the list delimited by hash '#' characters in the abiquo.properties file on the Remote Services server:Enable the protocols using Abiquo Configuration Properties 
    By default the following protocols are enabled: FTP, SMB, ORACLE_TMS, MS_RPC_TCP, SUN_RPC_TCP

    Code Block
    # Allowed firewall protocols to use services applications (aka  ALG (Application Level Gateway))
# Collections separated using # delimiter
abiquo.nsx.firewall.applicationprotocols = FTP#SMB#ORACLE_TNS#MS_RPC_TCP#SUN_RPC_TCP

    To add more protocols, edit the abiquo.properties file on the Abiquo server and add the appropriate protocol names (see #Listing application protocols)

  2. In Abiquo 4.7.x, specify the protocol mappings in the UI. To do this, edit the client-config-custom.json (for more information, see Configure Abiquo UI). 

    Note

    Always set a "port" value of "0" for application services. Any other value will cause a validation error in the plugin

    For example, for to add the default Applications in the UI, add the following lines at the top of configure protocols (above "Own TCP rule"):

    Code Block
        "config.protocols" : [
        {"value":"NSX - FTP", "protocol":"FTP", "port":0 },
        {"value":"NSX - SMB", "protocol":"SMB", "port":0 },
        {"value":"NSX - ORACLE_TNS", "protocol":"ORACLE_TNS", "port":0 },
        {"value":"NSX - MS_RPC_TCP", "protocol":"MS_RPC_TCP", "port":0 },
        {"value":"NSX - SUN_RPC_TCP", "protocol":"SUN_RPC_TCP", "port":0 },
        {"value":"Own TCP rule", ....


  3. When users create a firewall rule, they can now select the service. 

    Note

    Users can set a "Port range" value of "0" only for application services. Any other value will cause a validation error in the plugin

    Screenshot: Edit firewall rules

Listing application protocols

...