| Table of Contents |
|---|
...
Introduction to firewalls
...
Synchronize firewall policies with the cloud provider
...
| Table of Contents |
|---|
| Info |
|---|
This section describes firewall policies in private cloud with network managers (NSX, NSX-T) and in public cloud (AWS, Amazon, OCI), and firewall rules in Google Cloud Platform. |
Introduction to firewalls
The platform provides a unified interface to firewalls in varied cloud environments.
This section describes firewall policies, which are similar to security groups.
Abiquo firewall policies represent.
AWS security groups
Azure firewall policies
GCP firewall rules
OCI network security groups
For more details, please see the public cloud features table for each provider.
...
Synchronize firewall policies with the cloud provider
...
Create a firewall policy
...
Edit firewall rules
...
The synchronization process will onboard firewalls and it will update the platform's information about firewalls that already exist in the cloud provider. The platform synchronizes automatically when you onboard virtual resources from public cloud. Depending on the provider, the platform may support synchronization at the level of the location (public cloud region) or virtual datacenter.
To synchronize firewalls do these steps:
In the myCloud view go to Virtual datacenters, or Locations, or for Google Cloud Platform select the Global view
Go to Network → Firewalls
Click the double-arrow synchronize button
To synchronize a firewall in AWS before you add new firewall rules:
Select the firewall and click the double-arrow synchronize button
...
Create a firewall policy
The platform can create firewall policies in virtual datacenters in the provider, or in the platform only, for later use in providers, depending on provider support.
| Panel |
|---|
Privileges: Manage firewall |
To create a new firewall, do these steps:
Go to Virtual datacenters → Network → Firewalls
For GCP go to Global → Network → Firewalls
Click the Add button
Enter the firewall details
In GCP, if you assign a firewall to a Virtual datacenter, you can then use it as a default firewall
In VCD, if you do not select a Virtual datacenter, the platform will create the firewall in the platform only, not in the provider
Click Save to create the firewall
Add Firewall rules as describe in Create firewall rules.
...
Edit firewall rules
You can edit firewall rules after you create a firewall.
See Edit firewall policy rules
...
Create a firewall policy in GCP
| Excerpt | ||
|---|---|---|
| ||
In GCP Create a firewall policy in GCP, the platform can create firewall rules in virtual datacenters or in global networks, to later attach to VMs.
To create a new firewall, do these steps:
The platform will create your firewall in the provider. |
...
Set a firewall policy as the default for a virtual datacenter
...
You can set a default firewall policy for each virtual datacenter.
| Panel |
|---|
Privileges: Manage default firewall |
To set or unset a default firewall for a virtual datacenter:
...
Select the firewall
Click the star default firewall button
...
When the user creates a VM, the platform will assign the default firewall. The firewall rules apply to VMs, not individual NICs on the VMs. Changes to the firewall ruleset will apply to every VM in the virtual datacenter with the default firewall. If you do not set a default firewall but the provider requires one, for example, AWS, the platform will set the provider's default firewall. In AWS the default firewall is not marked.
...
Edit a firewall policy
...
If your provider allows it, you may edit a firewall policy in the platform.
To edit a firewall policy
...
Add tags to a firewall policy
...
:
Go to Virtual datacenters → select virtual datacenter OR
select a region → Network → FirewallsSelect the firewall policy and click the pencil edit button.
In GCP only, optionally select a virtual datacenter. You can use this option to recommend firewalls for your users.
If you do not select a virtual datacenter, the firewall will still exist in the provider and users can still attach this firewall to their VMs.If you select the Default option, the platform will assign this firewall to new VMs.
Make your changes and click Save
...
Add tags to a firewall
...
policy
When you edit a firewall, you can add tags to group resources. You can then go to Control view to manage tagged resources.
To manage tags for a firewall, edit the firewall, go to Tags, and add tags.
...
For more details, see Manage tags.
...
Move a firewall policy to another virtual datacenter
...
Display firewall policies
...
Before you begin:
Check if your provider allows you to move firewalls. For example, Azure ARM allows you to move firewalls to other VDCs in the same resource group
To move a firewall to another virtual datacenter
Go to Virtual datacenters → Locations or Global
Select the public cloud region, or Azure provider and resource group
Edit the firewall policy and select the new Virtual datacenter
...
Display firewall policies
You can display and manage firewalls in the platforms at the level of the virtual datacenter or the location (public cloud region or datacenter).
To display firewalls in a virtual datacenter in a provider:
Go to Virtual datacenters → select a virtual datacenter → Network → Firewalls
To display all firewalls in Google Cloud Platform
Go to myCloud → Global view
Select the GCP provider → Networks → Firewalls
To display all firewalls in a location (public cloud region or datacenter):
Go to Cloud virtual datacenters view → Locations
Select a location
Go to Network → Firewalls
Firewalls that do not exist in the provider are grayed out, and you should delete these firewalls.
| Tip |
|---|
To filter firewalls, enter text in the Search box to search by the Name, Description, and Provider ID in the Firewalls list. |
To display firewalls in an Azure Resource Group:
Go to Cloud virtual datacenters view
Go to Global → Azure → Resource Groups
Select a resource group
To display the details of the firewall, edit the firewall
...
Assign a firewall policy to a VM
See VM firewalls.
...
Delete firewall policy rules
...
Delete a firewall policy
...
To delete firewall rules, do these steps.
Go to Virtual datacenters → select a virtual datacenter OR
select All → Network → FirewallsEdit the firewall
Select the Inbound or Outbound tab
On the left-hand side of each rule you wish to delete, click the trash bin Delete button
Click Save
...
Delete a firewall policy
To delete a firewall policy:
Edit each VM that is using the firewall policy to remove the firewall policy
Select the firewall policy
Click the Delete button
| Excerpt | ||
|---|---|---|
| ||
In private cloud with NSX-T, you can delete network resources by deleting the virtual datacenters. The platform will automatically remove VMs, virtual appliances, load balancers, public IPs, and firewalls from the virtual datacenter. The firewalls will remain in the enterprise and you can reuse them. When you delete a virtual datacenter, public IPs that are not used by VMs will remain in the provider and the synchronization process will delete them. |
...
Manage firewalls with the API
| Tip |
|---|
API Documentation For the Abiquo API documentation of this feature, see Abiquo API Resources and the page for this resource FirewallPoliciesResource. |