Feature Description:

SCP tenants can set distributed firewall policies in the network topology to which they belong to manage tenant networks.

Precautions:

The role of the tenant distributed firewall takes effect only in the area of ​ ​the tenant.

Prerequisite

None.

Steps:

Log in to the SCP tenant interface, select Security Services > Distributed Firewall after successful login, enter the firewall editing page, and you can see the existing firewall policies.

Select the tenant network name from the list on the left, enter the corresponding page, and click the Create Policy button to create a firewall policy for the tenant network.

Name: The firewall policy name.

Scope: The effective domain of the firewall policy.

Priority: The policy priority created by the tenant is higher than the platform default policy, and other policy priorities can be adjusted manually.

Support group management of firewall interception rules. Add distributed firewall rules under the policy to the created policy. Click the Configure Rules button of the corresponding policy, and click New.  The options here belong to the effective domain where the policy is located.

Source/destination matching conditions: Supports configuring IP Group, IP Range, Virtual Machine, and VM groups.

When the source/destination selects a virtual machine, if the virtual machine does not have vmTools installed, the system cannot automatically obtain the virtual machine IP, and the underlying firewall rules cannot perform effective IP conversion. The rules are actually ineffective for the virtual machine. Therefore, in this case, you need to configure an IP for the virtual machine before using it as the source/destination of firewall rules.

Service: Supports the selection of the platform's predefined service and supports custom service based on protocols and port numbers. Custom service in the same effective domain can be shared by multiple rules.

Go back to the Create Rule page and click the Add button to continue adding other rules.

After confirming that all rules are added correctly, click OK. On the Rule Configuration interface, select a rule record and click the Move Up or Move Down button to adjust the priority of the created rule. Click Move to to move the rule to another policy group.

It also supports the priority adjustment of distributed firewall policies. Select the policy whose priority needs to be adjusted in the list, and click More to adjust.

IP Groups: Tenants can manage IP groups in the distributed firewall policy, click the IP Groups button, click the New button, enter the name and describe the IP range, and then complete the operation of adding an IP group

Multiple rules can share a custom IP group in the same effective domain.