Skip to main content

Manage port groups

Topics

• Manage port groups

• Manage network policies

• Manage vFirewalls

• Manage VLAN policies

Manage port groups​

Topics

• Manage port groups

• Manage network policies

• Manage vFirewalls

• Manage VLAN policies

Manage port groups

The port group feature is not supported in RBAC mode.

The port group feature allows centralized management of the network configurations required by VMs in a virtualized environment, such as VM port profiles, virtual firewalls, and VLAN policies. You can complete the network configurations for a VM simply by selecting the desired port group. The VMs associated with the same port group share the same network configurations. VMs attached to the same port group share the same network configurations. Port groups are categorized into basic port groups and advanced port groups based on the adapted network mode. Basic port groups are used for centralized management of basic network configurations, and advanced port groups are used for centralized management of advanced network configurations. Basic port groups are divided into distributed port groups and standard port groups.

• Distributed port group—Deployed on distributed vSwitches. This type of port groups is suitable for managing the network configurations of VMs deployed across multiple hosts within the same cluster. In a cluster, each port group must have a unique name.

• Standard port group—Deployed on standard vSwitches. This type of port groups helps you manage the network configurations of VMs deployed on the same host, and is thus suitable for smaller-scale or standalone environments. Port groups attached to the same host must have different names.

Restrictions and guidelines

• Before you migrate a VM associated with a basic port group, make sure the following requirements are met:

○ The source host and the destination host use the same vSwitch, forwarding mode, and service network settings.

○ The destination port group contains the same port profile, vFirewall, and VLAN policy as the source port group.

During VM migration, the system selects the destination port group under the following rules in sequence: a. Prefers the distributed port group that uses the same name as the source port group. b. Prefers the standard port group that uses the same name as the source port group. c. Prefers distributed port groups that use a different name. d. Prefers standard port groups that use a different name. When the system cannot find a matching port group, it will migrate the VM as if the VM is not attached to a port group. After the VM is migrated, it is not attached to any port group.

• If a VM is attached to a port group and you restore it from its backup data, the port group association will be removed after you restore it from its backup data.

Add a basic port group

About this task

Perform this task to add a port group, which allows centralized management of network configurations (such as vSwitch, port profile, vFirewall, and VLAN policy).

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Port Groups.

  3. Click Add.

  4. Set the network mode to Basic, and then configure the other parameters as described in "Parameters."

  5. Click OK.

Add an advanced port group

About this task

Perform this task to add a port group, which allows centralized management of network configurations (such as network, subnet, and QoS).

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Port Groups.

  3. Click Add.

  4. Set the network mode to Advanced, and then configure the other parameters as described in "Parameters."

  5. Click OK.

Attach VMs to a port group

About this task

Perform this task to attach VMs to a port group.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Port Groups.

  3. Select the target port group, and then click Attach VMs.

  4. Select the desired VMs, and then click OK.

Edit a port group

About this task

Perform this task to redesign a VM network topology, meeting personalized network requirements.

Restrictions and guidelines

After you edit a basic port group, the system might fail to synchronize the new network settings to some of the VMs attached to that port group. In this situation, the network settings of those VMs will be restored to the network settings used before E0786, which do not include port group information.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Port Groups.

  3. Click Edit in the Actions column for the target port group. In the dialog box that opens, edit the port group settings as needed.

  4. Click OK.

Copy a port group

About this task

Perform this task to create a port group by reusing the network settings of an existing port group. This task allows fast port group creation.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Port Groups.

  3. Click Copy in the Actions column for the target port group. In the dialog box that opens, configure the port group settings as needed.

  4. Click OK.

Export a port group

About this task

Perform this task to export information about a port group for configuration backup or sharing purposes.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Port Groups.

  3. Click Export in the Actions column for the target port group. In the dialog box that opens, click OK.

  4. Click OK.

Import port groups

About this task

Perform this task to import port group configurations to the management platform.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Port Groups.

  3. Click the Import button above the port group list.

  4. In the dialog box that opens, configure the parameters as needed.

  5. Click OK.

Delete a port group

About this task

Perform this task to delete an unnecessary port group from the management platform.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Port Groups.

  3. Click Delete in the Actions column for the target port group.

  4. Click OK.

Parameters Parameters for basic port groups

• Name: Name of the port group.

• Description: Description of the port group.

• Network Mode: Set the network mode to Basic.

• Cluster: Cluster to which the port group is attached. If you select a cluster without selecting a host, only distributed vSwitches are available. In this situation, you can create a distributed port group only.

• Host: Host to which the port group is attached. This parameter is optional. After you select a host, only standard vSwitches are available. In this situation, you can create a standard port group only.

• vSwitch: vSwitch to which the port group is attached. A vSwitch can be attached to multiple port groups, but a port group can be attached to only one vSwitch.

• VXLAN Port Group: VXLAN port group to which the port group is attached. A VXLAN port group is a network configuration parameter that groups multiple virtual network devices (for example, vSwitches) into a single logical group to facilitate communication between virtual network devices. With a VXLAN port group, VMs can be connected across multiple physical servers. Before you can select a VXLAN port group, make sure collaboration with SDN has been configured, and the forwarding type of the selected vSwitch is set to VXLAN.

• Port Profile: Port profile to which the port group is attached. For more information about port profiles, see "Create a VM."

• vFirewall: vFirewall to which the port group is attached. For more information about vFirewalls, see "Create a VM."

• VLAN Policy: VLAN policy to which the port group is attached. For more information about VLAN policies, see "Create a VM."

Parameters for advanced port groups

• Name: Name of the port group.

• Description: Description of the port group.

• Network Mode: Set the network mode to Advanced.

Manage network policies​

Introduction

Use this module for fine-grained control of vNetwork traffic. Configuring port profiles, rate limit policies, and ACLs to flexibly define and manage communication between VMs, port groups, and VLANs to meet enterprise-level security compliance, performance isolation, and traffic scheduling requirements.

Topics

• Manage port profiles

• Manage rate limit policies

• Manage ACLs

• Configure network security settings

Manage port profiles​

In role-based access control (RBAC) mode, only security administrators can configure port profiles, and system administrators can only view port profile information.

A port profile is a set of network management features, such as ACL, VLAN, and QoS settings. After you apply a port profile to the NIC of a VM, the VM and the virtual switch attached to the VM perform the following operations:

• The virtual switch uses the ACL in the port profile to process the VM traffic that matches the ACL.

• The VLAN ID of the VM depends on that in the port profile.

• The VM limits incoming and outgoing traffic of the NIC based on the rate limit policy or inbound and outbound traffic limits in the port profile.

• The NIC accesses the network based on the network priority in the port profile.

Restrictions and guidelines

• If you edit a port profile that is being used by VMs, the modifications take effect immediately on virtual interfaces of the VMs.

• You cannot delete a port profile that is being used by VMs.

• If a port profile is enabled with inbound and outbound traffic limits, you cannot bind that port profile to VMs configured with intelligent NICs.

Add a port profile

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click Add.

  4. Configure the parameters as described in "Parameters."

  5. Click Finish.

Edit a port profile

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click Edit in the Actions column for the desired port profile.

  4. Configure the parameters as described in "Parameters."

  5. Click Finish.

Filter port profiles

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Select All, Private, or Public to filter port profiles.

View information about a port profile

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click View in the Actions column for the desired port profile.

Copy a port profile

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click More in the Actions column for the desired port profile, and then select Copy.

  4. Configure the parameters as described in "Parameters."

  5. Click OK.

Export port profiles

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Use one of the following methods to export port profiles:

    ○ To export a single port profile, click More in the Actions column for that port profile, and then select Export.

    ○ To export multiple port profiles in bulk, select those port profiles, and then click the Export button.

  4. Click OK.

Restore backup port profiles

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Restore Backup Port Profile button, and then select the desired port profile template.

  4. Click OK.

Convert a private port profile into a public port profile

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click More in the Actions column for the desired private port profile, and then select Convert to Public Profile.

  4. Click OK.

Delete a port profile

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click More in the Actions column for the desired port profile, and then select Delete.

  4. Click OK.

Attach a port profile to VMs

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click More in the Actions column for the desired port profile, select Attach to VMs, and then select VMs as needed.

  4. Click OK.

Parameters Basic information

• Name: Specify a name for the port profile.

• Description: Specify a description for the port profile.

• ACL Name: Select the ACL used in the port profile.

• VLAN ID: Enter a VLAN ID. The VLAN ID will be assigned to the VMs that use the port profile.

• Rate Limit Policy: Select a rate limit policy. This policy defines VM bandwidth limit rules. The policy is mutually exclusive with the inbound and outbound limits and network priority. Before you enable this service, make sure the system has rate limit policies. For more information about adding rate limit policies, see "Manage rate limit policies."

• Type: Select an owner for the port profile. A public port profile can be viewed and used by all users. A private port profile can be viewed and used by only the users in the same user group as the profile creator.

Inbound and outbound traffic limit settings

• Inbound Limit: Limit the traffic from a virtual switch to a VM.

○ Avg. Bandwidth: Enter the average inbound bandwidth in Kbps.

○ Burst Buffer: Enter the inbound burst buffer in KBytes.

• Outbound Limit: Limit the traffic from a VM to a virtual switch.

○ Avg. Bandwidth: Enter the average outbound bandwidth in Kbps.

○ Burst Buffer: Enter the outbound burst buffer in KBytes.

Manage rate limit policies​

In RBAC mode, only security administrators can manage rate limit policies.

A rate limit policy is a set of rules that define average bandwidth and burst buffer for specific traffic flows. A rate limit policy provides accurate bandwidth control for the traffic between a VM and a network site. To apply a rate limit policy to VMs, you must specify it in a port profile. Compared with the inbound and outbound traffic limits of a port profile, a rate limit policy provides more granular traffic control.

Add a rate limit policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Rate Limit Policies tab.

  4. Click Add.

  5. Specify the policy name, description, and owner.

  6. To add a rule, click Add Rule, configure the rule, and then click OK.

  7. Click OK.

Edit a rate limit policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Rate Limit Policies tab.

  4. Click Edit in the Actions columns for the desired rate limit policy.

  5. Edit the description of the policy.

  6. Edit the rules of the policy:

    ○ To add a rule, click Add Rule.

    ○ To edit a rule, click Edit in the Action column.

    ○ To delete a rule, click Delete in the Action column.

    ○ To set the priorities of rules, click Edit Rule Priorities.

  7. Click OK.

Convert a private rate limit policy into a public rate limit policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Rate Limit Policies tab.

  4. Click More in the Actions columns for the desired private rate limit policy, and then select Convert to Public Policy.

  5. Click OK.

Copy a rate limit policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Rate Limit Policies tab.

  4. Click More in the Actions columns for the desired rate limit policy, and then select Copy.

  5. Configure the related parameters, and then click OK.

Export a rate limit policy

About this task

Perform this task to export a rate limit policy to the specified storage location.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Rate Limit Policies tab.

  4. Click More in the Actions columns for the desired rate limit policy, and then select Export.

  5. Click OK.

Import rate limit policies

About this task

Perform this task to import a rate limit policy template to the platform. This feature improves the efficiency of rate limit policy configuration and avoids configuration errors, allowing multiple platforms to share the same rate limit policy easily.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Rate Limit Policies tab.

  4. Click Import, and then select the desired rate limit policy file.

  5. Configure the related parameters, and then click OK.

Delete a rate limit policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Rate Limit Policies tab.

  4. Click More in the Actions columns for the desired rate limit policy, and then select Delete.

  5. Click OK.

Filter rate limit policies

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the Rate Limit Policies tab.

  4. Select Public, Private, or All to filter rate limit policies.

Parameters Rate limit policy parameters

• Name: Specify a rate limit policy name.

• Description: Specify a description for the rate limit policy.

• Type: Select the policy owner. Options include Public and Private. A public rate limit policy can be viewed and used by all users, and a private rate limit policy can be viewed and used only by users in the same user group as the policy creator.

Parameters for adding a rule

• Rate Limit Method: Select a rate limit method. Options include IP, ARP, and Broadcast.

• Remote CIDR: Enter a network segment in CIDR format. 0.0.0.0/0 represents any IPv4 address. ::/0 represents any IPv6 address. To specify any IP address, leave this field empty. This parameter is required only when the rate limit method is IP.

• Direction: Select a traffic direction:

○ Upstream—Traffic from a VM to a remote site.

○ Downstream—Traffic from a remote site to a VM.

• Average Bandwidth: Enter the average bandwidth in Kbps or Mbps.

• Burst Buffer: Enter the burst buffer size in KBytes or MBytes.

• Edit Rule Priorities: Set the priorities of rules. If a remote IP address matches two rules in the same direction, and the network segment of the high-priority rule contains that of the low-priority rules, the system uses the high-priority rule. For example, rule A and rule B are applied to the upstream

Manage ACLs​

In RBAC mode, only security administrators can manage ACLs.

An access control list (ACL) is a set of rules for identifying traffic based on criteria such as source IP address, destination IP address, and port number. The rules are also called permit or deny statements. ACL provides packet-based access control. You can configure ACLs to limit network access to VMs and improve security of the services running on the VMs.

Add an ACL

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Click Add.

  5. Enter a name and a description for the ACL, select the default inbound action, default outbound action, ACL type, and owner. For more information about the parameters, see "Parameters."

  6. Configure whether to configure the ACL as a time-based ACL. If yes, specify the time when the ACL takes effect.

  7. Click Add to add a rule for the ACL and configure the parameters as described in "Parameters."

  8. To change the priorities of the ACL rules, click Edit Rule Priorities, drag the rules to arrange their orders, and then click OK.

  9. Click OK.

Edit an ACL

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Click Edit in the Actions column for the target ACL.

  5. Configure the rules for the ACL and configure the priorities for the rules as described in "Parameters."

  6. Click OK.

Convert a private ACL to a public ACL

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Select More > Convert to Public Policy in the Actions column for the target ACL.

  5. Click OK.

Copy an ACL

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Select More > Copy in the Actions column for the target ACL.

  5. Configure the parameters and then click OK.

Import an ACL file

About this task

Perform this task to import an exported ACL file to the system.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Click Import and select the target ACL file.

  5. Configure the parameters, and then click OK.

Export an ACL to a file

About this task

Perform this task to export an existing ACL to a local file for backup.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Select More > Export in the Actions column for the target ACL.

  5. Click OK. Select a path to which the ACL is exported. The export method varies by browser.

Associate an ACL to a port profile

About this task

Perform this task to quickly associate an ACL with port profiles, which implements precise control over data packet flows.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Select More > Attach Port Profile in the Actions column for the target ACL.

  5. Select port profiles as required and then click OK.

Delete ACLs

About this task

Perform this task to delete unused ACLs. ACLs that are used by port profiles cannot be deleted. To delete such ACLs, first remove the association between the ACLs and their associated port profiles.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Click More in the Action column for the target ACL and then select Delete, or select the target ACLs and click Delete.

  5. In the dialog box that opens, click OK.

Filter ACLs

About this task

Perform this task to filter existing ACLs by type or name.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Use one of the following methods to filter ACLs:

    ○ Select All, Private, or Public from the Type list.

    ○ Enter an ACL name in the Name field.

View detailed information about an ACL

About this task

Perform this task to view detailed information about an ACL, including the basic settings, rules that have been applied, and rule priorities.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > Network Policies.

  3. Click the ACLs tab.

  4. Click View in the Actions column for the target ACL.

Parameters

• Name: Enter the name of the ACL.

• Description: Enter the description for the ACL.

• Default Inbound Action: Select the action to take on inbound packets that do not match any rules. Options include Allow and Reject.

• Default Outbound Action: Select the action to take on outbound packets that do not match any rules. Options include Allow and Reject.

• ACL Type: Select an ACL type. Options include IP and Layer 2.

○ IP—The rule matches packets based on the Layer 3 and Layer 4 information such as source IP address, destination IP address, and IP protocol.

○ Layer 2—The rule matches packets based on the link layer information such as source MAC address and destination MAC address.

• Type: Select the ACL owner. Options include Public and Private. A public ACL can be viewed and used by all users, and a private ACL can be viewed and used only by users in the same user group as the ACL creator.

• Time Based Control: Configure whether to set the ACL as a time-based ACL. If yes, specify the effective time for the ACL. The rules of a non time-based ACL are always effective.

• Direction: Select the direction of packets that the rule matches. Options include Inbound, Outbound, and Inbound, outbound.

• Action: Select the action to take on packets that match the ACL rule. Options include Allow and Reject.

If you select IP for the ACL Type parameter, configure the following parameters:

• Protocol: Select the protocol of packets that the rule matches. Options include ALL, ICMP, TCP, and UDP.

• IP Type: Select an IP protocol version. Options include IPv4 and IPv6.

• Source IP: Enter the source IP address that the rule matches.

• Source Subnet Mask: Enter the source subnet mask that the rule matches.

• Source Network Prefix: Enter the prefix length of the source IPv6 address.

• Start Source Port: Specify the start source port that the rule matches.

• End Source Port: Specify the end source port that the rule matches.

• Destination IP: Enter the destination IP address that the rule matches.

• Destination Subnet Mask: Enter the destination subnet mask that the rule matches.

Configure network security settings​

This function is available only in RBAC mode. Only security administrators can configure this function.

This function enables you to configure port profiles for VMs. A port profile defines a group of network control features, such as ACL, VLAN, and QoS. After you apply a port profile to a VM's NIC, the following rules take effect:

• If the port profile references an ACL, the virtual switch will process traffic from the VM according to the ACL rules that matches the traffic.

• The VLAN to which the VM belongs is determined by the VLAN ID specified in the port profile.

Manage vFirewalls​

In RBAC mode, only security administrators can manage vFirewalls.

A vFirewall is a set of filtering rules. vFirewalls protect VMs from attacks to improve security and high availability of VMs. A vFirewall uses a connection status-based detection mechanism. A firewall identifies all packets transmitted on a connection between two peers as a traffic flow. For new application connections, the firewall checks its rules, allows the connections permitted by the rules, and generates a status table that contains status information about the connections. Subsequent packets of the connections are permitted as long as they match the status table. The system supports the following vFirewall types:

• Allowlist firewall—Permits traffic that matches its rules and drops other traffic.

• Denylist firewall—Drops traffic that matches its rules and permits other traffic.

The system supports rules for TCP, UDP, and ICMP, as well as common application protocols such as DNS, HTTP, HTTPS, IMAP, IMAPS, LDAP, MS SQL, MySQL, POP3, POP3S, RDP, SMTP, SMTPS, and SSH. The system provides the following firewall rule types:

• Ingress rule—Limits connections initiated from a remote site.

• Egress rule—Limits connections initiated by VMs.

For application protocols, the default direction of rules is Ingress.

Restrictions and guidelines

• vFirewalls and ACLs are mutually exclusive. If both a vFirewall and an ACL are configured for a VM, only the vFirewall takes effect.

• By default, a vFirewall permits all DHCP connections. To filter the DHCP packets of a VM, configure ACLs for the VM.

• You cannot delete vFirewalls being used by VMs.

Add a vFirewall

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Click Add.

  4. Enter a name and a description for the vFirewall.

  5. Select a firewall type.

  6. Click Add Rule.

  7. To add a rule and return to the Add Virtual Firewall dialog box, configure the rule, and then click OK. To add rules in bulk, configure each rule, click Append, and then click OK after you add all desired rules.

  8. Click OK.

Import a vFirewall

About this task

You can import a vFirewall from a vFirewall configuration file that has been exported from the system if you mistakenly delete the original vFirewall on the system or want to fast create a vFirewall. You can import a vFirewall to the management platform that exports the vFirewall configuration file or another cloud management platform. After you import a vFirewall, you can edit or delete its rules. The name of the vFirewall must be unique across the local management platform.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Click Import, and select a file that contains vFirewall settings.

  4. Enter a name and a description for the vFirewall.

  5. Select a firewall type.

  6. Click Add Rule.

  7. To add a rule and return to the Import Virtual Firewall dialog box, configure the rule, and then click OK. To add rules in bulk, configure each rule, click Append, and then click OK after you add all desired rules.

  8. Click OK.

Convert vFirewalls to distributed firewalls

About vFirewall-to-distributed firewall conversion

Distributed firewalls and vFirewalls are two different network security solutions. Distributed firewalls enforce security policies across network nodes, providing protection closer to data sources. They are applicable to large-scale, complex multi-layer networks. vFirewalls are software-based firewalls running in virtualized environments. They mainly protect traffic between VMs and in cloud computing environments. Distributed firewalls are applicable to scenarios that require consistent security policies. vFirewalls are applicable to scenarios for flexible protection in dynamic virtual environments. Select them based on your network architecture and security needs. The management platform supports converting vFirewalls into distributed firewalls (retaining traditional vFirewall functions).

• For new installations or upgraded environments, the system reserves vFirewalls by default. You can select whether to switch to a distributed firewall as needed. Distributed firewalls implement granular security policies across network nodes, delivering higher security and real-time response.

• In a mixed management environment, vFirewall policies applied to VMs on CentOS-based CVK hosts cannot be switched to distributed firewalls. Therefore, these VMs must use traditional vFirewalls. For VMs on NingOS-based CVK hosts, you can choose whether to use distributed firewalls as needed. This ensures that the system can provide uninterrupted network security services to VMs on CentOS-based CVK hosts while improving overall security and compatibility in a mixed management environment.

Mechanism Design principles

• Compatibility first—The compatibility-first design allows you to retain traditional vFirewall functions during new installations or upgrades. It also supports active switchover to distributed firewalls. This effectively prevents function conflicts and ensures smooth transitions between versions and system stability.

• Lossless policy conversion—After a vFirewall is converted to a distributed firewall, multiple security policies are generated to ensure that all rules are converted and applied. Additionally, the precedence of the distributed firewall policy will remain consistent with the original vFirewall policy, ensuring precedence inheritance.

• Default action inheritance—If both a denylist and allowlist exist in a vFirewall and are associated with VMs, security policies will be generated separately based on the denylist and allowlist. The default action (allow or deny) of the generated security policies will be determined by the default VM action parameters in VM configuration.

Switchover mechanism

  1. The system automatically scans the current vFirewall policy database and excludes policies associated with the VMs on the CentOS CVK host (marked as non-switchable) after you manually trigger Switch to Distributed Firewall.

  2. Parses and analyzes each vFirewall rule (such as direction, protocol, and port). For example, for ingress rules of the vFirewall, the destination object in the distributed firewall policy is the VM associated with the vFirewall. For egress rules, the source object is the VM associated with the vFirewall. In the vFirewall, 0.0.0.0 represents all IPv4 addresses and :: represents all IPv6 addresses. After the vFirewall is converted into a distributed firewall, 0.0.0.0/0 represents all IPv4 addresses, and ::/0 represents all IPv6 addresses.

  3. Generates distributed firewall policies. For each vFirewall rule, a distributed firewall policy will be generated. The system also creates a distributed firewall policy based on the default action of the vFirewall. If the original vFirewall uses a denylist, the default action is allow (only blocks explicitly denied traffic). If it uses an allowlist, the default action is deny (only permits explicitly allowed traffic).

  4. The newly generated distributed firewall policy takes effect immediately. The original vFirewall policy remains but no longer takes effect on VMs.

Example vFirewall denylist conversion

Rules in the original vFirewall denylist:

• Ingress: The VM at 1.1.1.5 cannot access the SSH service of the VM associated with the original vFirewall.

• Egress: The VM cannot access the ICMP service on subnet 2.2.2.0/24. Direction IP Port/Type-Code Remote CIDR

Egress TCP 22 (SSH) 1.1.1.5 Ingress ICMP Any 2.2.2.0/24 After you convert a vFirewall into a distributed firewall, the following security policies are generated:

• A security policy for the default action of a virtual firewall.

• A security policy converted from the vFirewall ingress rule, with the destination object as the VM attached to the vFirewall.

• A security policy converted from the vFirewall egress rule, with the source object as the VM attached to the vFirewall. Applied Source Enabling Policy Name Target Object Service Action To Object Status

xxx_1 VM 1.1.1.5 VM 22 (SSH) Deny Yes xxx_2 VM VM 2.2.2.0/24 ICMP Deny Yes xxx_3(Default VM Global Global Global Allow Yes action policy)

vFirewall allowlist conversion

Rules in the original vFirewall allowlist:

• Ingress: The VM at 3.3.3.2 can access VM port 23 (UDP).

• Egress: VMs can access HTTPS services on subnet 5.1.1.0/24. Direction IP Port/Type-Code Remote CIDR

Egress UDP 23 3.3.3.2 Ingress TCP 443 (HTTPS) 5.1.1.0/24 After you convert a vFirewall to a distributed firewall, the following security policies are generated:

• A security policy for the default action of a virtual firewall.

• A security policy converted from the vFirewall ingress rule, with the destination object as the VM attached to the vFirewall.

• A security policy converted from the vFirewall egress rule, with the source object as the VM attached to the vFirewall. Applied Source Enabling Policy Name Target Object Service Action To Object Status

xxx_1 VM 3.3.3.2 VM 23 (UDP) Allow Yes xxx_2 VM VM 5.1.1.0/24 Allow Yes (HTTPS) xxx_3(Default VM Global Global Global Deny Yes action policy) The example above shows that the vFirewall rules are successfully converted to distributed firewall security policies, enabling unified management and application of the rules.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Click Switch to Distributed Firewall, and then click OK.

Edit a vFirewall

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Click Edit in the Actions columns for the target vFirewall.

  4. Enter a description for the vFirewall.

  5. Manage the rules of the firewall:

    ○ To add a rule, click Add Rule.

    ○ To edit a rule, click Edit for that rule.

    ○ To delete a rule, click Delete for that rule.

  6. Click OK.

Delete a vFirewall

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Click Delete in the Actions columns for the target vFirewall.

  4. Click OK.

Export a vFirewall as a JSON file

About this task

You can export a vFirewall as a JSON file for backup or to synchronize the vFirewall to another management platform. You can import the JSON file to the management platform that exported it or another management platform.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Select More > Export in the Actions columns for the target vFirewall.

  4. Click OK to confirm the export operation.

  5. Select a storage path for the JSON file, and then click Save.

Attach a vFirewall to VMs

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Select More > Attach to VMs in the Actions columns for the target vFirewall.

  4. To attach multiple VMs in bulk to the vFirewall, click the VMs tab, and then select the target VMs.

  5. To attach VMs in a VM group to the vFirewall, click the VM Group tab, and then select the target VM group.

  6. To attach VMs with a specific tag to the vFirewall, click the Tags tab and then select the target tag.

  7. Click OK.

Detach a vFirewall from VMs

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Select More > Detach VMs in the Actions columns for a vFirewall.

  4. To detach multiple VMs in bulk from the vFirewall, click the VMs tab and then select the target VMs.

  5. To detach VMs in a VM group from the vFirewall, click the VM Group tab, and then select the target VM group.

  6. To detach VMs with a specific tag from the vFirewall, click the Tags tab and then select the target tag.

  7. Click OK.

Attach a vFirewall to port groups

About this task

Perform this task to apply the rules of a vFirewall to the network traffic of the attached port groups, which implements network-specific traffic control and security protection.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Select More > Attach to Port Group in the Actions columns for the target vFirewall.

  4. Select port groups as required, and then click OK.

Detach a vFirewall from port groups

About this task

Perform this task to flexibly adjust the application scope for the rules of a vFirewall to make sure the rules always meet the current service requirements.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Select More > Detach from Port Group in the Actions columns for the target vFirewall.

  4. Select port groups as required, and then click OK.

Copy a vFirewall

About this task

Perform this task to create a vFirewall based on an existing one. The new vFirewall must use a unique name on the management platform. You can edit or delete rules for the new vFirewall, but you cannot edit the firewall type for the new firewall.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > vFirewalls.

  3. Select More > Copy in the Actions columns for the target vFirewall.

  4. Enter a name and a description for the vFirewall.

  5. Click Add Rule.

  6. To add a rule and return to the Copy Virtual Firewall dialog box, configure the rule, and then click OK. To add rules in bulk, configure each rule, click Append, and then click OK after you add all desired rules.

  7. Click OK.

Parameters vFirewall list

• Name: Enter the name of the vFirewall.

• Description: Enter the description for the vFirewall.

• Firewall Type: Select the type of the vFirewall. Options include Allowlist and Denylist. An allowlist firewall permits traffic that matches its rules and drops all the other traffic. A denylist firewall drops traffic that matches its rules and permits all the other traffic.

○ When you configure an allowlist vFirewall, two default egress rules exist to permit all traffic from the VM to the remote site. If IPv6 is disabled for VMs, only the IPv4 egress rule exists. By default, all traffic from the remote site to the VM is denied. To permit specific traffic from the remote site to the VM, configure ingress rules as needed. To control traffic from the VM to the remote site, delete the two default egress rules and configure egress rules as needed.

○ When you configure a denylist vFirewall, no default rules exist and all packets are permitted. To deny specific traffic from the remote site to the VM, configure ingress rules as needed. To deny specific traffic from the VM to the remote site, configure egress rules as needed.

Rules

• Direction: Select the direction of connections. Ingress indicates connections initiated from a remote site. Egress indicates connections initiated by VMs.

• IP Protocol: Select a protocol for which the vFirewall implements traffic control. Any represents all protocols.

• Description: Description for a rule.

• Port/Type-Code: Select a TCP or UDP port number, or select an ICMP type code.

• Remote CIDR: Enter a remote site IP address. 0.0.0.0/0 represents any IPv4 address. ::/0 represents any IPv6 address.

Rule parameters

• Rule: Select a rule type. Options include Custom TCP Rule, Custom UDP Rule, Custom ICMP Rule, Other Rules, All TCP Rules, All UDP Rules, All ICMP Rules, DNS (TCP), DNS (UDP), HTTP, HTTPS, IMAP, IMAPS, LDAP, MS SQL, MYSQL, POP3, POP3S, RDP, SMTP, SMTPS, and SSH.

• Description: Enter the description of the rule.

• Direction: Select the direction of connections. Ingress indicates connections initiated from a remote site. Egress indicates connections initiated by VMs.

• Port: Enter semicolon-separated port numbers or port ranges in the format of start port number-end port number, 1;2-3;4 for example. You cannot enter identical port numbers or port ranges, and the port numbers and port ranges must be in ascending order. The system generates a rule for each port number or port range. If the direction is Ingress, the port number is the VM port that the remote site visits. If the direction is Egress, the port number is the remote site port that VMs visit. This parameter is required if Custom TCP Rule or Custom UDP Rule is selected.

• Type: Select an ICMP type. This parameter is required if Custom ICMP Rule is selected.

• Code: Select an ICMP code. This parameter is required if Custom ICMP Rule is selected.

• IP Protocol: Select a protocol for which the vFirewall implements traffic control. This parameter is required if Other Rules is selected.

• IP Type: Select an IP packet type. Options include IPv4 and IPv6. To configure this parameter, you must first enable VM IPv6 Address Management on the Basic System Parameters page.

Manage VLAN policies​

Introduction

Use this module for implementing network logic isolation and traffic control. By configuring VLAN passthrough policies and private VLAN policies, users can flexibly define communication rules between VMs, containers, or physical devices at the distributed vSwitch level, meeting complex network requirements such as multi-user isolation, security partitioning, and service grouping.

Topics

• Manage VLAN passthrough policies

• Manage private VLAN policies

Manage VLAN passthrough policies​

VLAN passthrough policies are not supported in RBAC mode.

Configure VLAN passthrough policies to enable the vNICs to identify and process VLAN tagged packets received and sent by VMs in service and forwarding VLANs. VLAN passthrough policies allow one vNIC to connect to multiple VLANs.

Restrictions and guidelines

The VLAN settings in the port profile do not take effect on a NIC if the NIC is configured with VLAN passthrough policies.

Add a VLAN passthrough policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click Add.

  4. Enter a name and a description for the policy.

  5. Configure rules for the policy as needed. To create a rule, click Add Rule, configure the rule parameters as described in "Parameters," and then click OK.

  6. Click OK.

View information about a VLAN passthrough policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click View in the Actions column for the target policy.

Edit a VLAN passthrough policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click Edit in the Actions column for the target VLAN passthrough policies.

  4. Edit the policy description as needed.

  5. Edit the policy rules as follows:

    ○ To create a rule, click Add Rule.

    ○ To edit a rule, click Edit in the Actions column for that rule.

    ○ To delete a rule, click Delete in the Actions column for that rule.

  6. Click OK.

Delete a VLAN passthrough policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click Delete in the Actions column for the target policy.

  4. Click OK.

Parameters

• Name: Enter the name of the VLAN passthrough policy.

• Description: Enter the description for the VLAN passthrough policy.

• Service VLAN: Specify the VLAN over which the VM sends traffic.

• Forwarding VLAN: Specify the VLAN over which traffic is forwarded to other networks.

Manage private VLAN policies​

Private VLAN policies are not supported in RBAC mode.

The IEEE 802.1Q protocol allows devices to use up to 4094 VLAN resources. This cannot meet the requirements of assigning a VLAN to each user for core devices. Traditional switches typically require one VLAN interface per VLAN for VLAN intercommunication. This approach not only consumes a large number of IP addresses but also increases deployment costs and the workload of daily maintenance and management. To address this challenge, the private VLAN (PVLAN) technology emerged. PVLAN divides the Layer 2 broadcast domain of a VLAN into multiple subdomains. Each subdomain contains a pair of VLANs, a primary VLAN and a secondary VLAN. This effectively enhances the efficiency and management flexibility of VLANs. The primary VLAN acts as an uplink interface to connect to the vSwitches in the cluster. The secondary VLAN acts as a downlink interface to connect to user VMs. This design makes the user VMs within the secondary VLAN transparent to the uplink vSwitch, achieving flexible isolation and access control. A PVLAN supports isolated ports, community ports, and promiscuous ports (ports in the primary VLAN).

Restrictions and guidelines

• VMs configured with microsegmentation, port mirroring, bridge port, VLAN passthrough policy, and VMs with a network type of traffic direction do not support private VLAN policies.

• A VLAN ID in a private VLAN policy cannot be the same as the VLAN ID in a port profile, VLAN passthrough policy, or port mirroring configuration.

• When a VM is using a private VLAN policy, you cannot delete that policy. To delete that private VLAN policy, first dissociate the private VLAN policy from the VM.

• Removing an abnormal CVK host does not remove the private VLAN policies configured on that host. If the host recovers and rejoins the management platform, the new private VLAN policies might fail to be deployed to the related VM. To resolve this issue, clear the private VLAN policy configuration for the VMs, and then deploy the policies again.

• When the only host that uses a private VLAN policy becomes abnormal, you can directly delete that private VLAN policy without detaching that policy from the VMs on that host. To avoid remnant configuration on the host, remove the abnormal host from the system in time.

• After VM backup and restoration, VM import/restoration, or VM migration is completed, you must reconfigure a private VLAN policy for the VM.

• When you migrate a VM configured with a PVLAN, make sure both the destination and source hosts are connected to the same vSwitch.

• For inter-host communication, you must make sure the external physical switch also supports PVLAN and the private VLAN policy configuration is the same as the private VLAN policy configuration on the management platform.

• Only cluster vSwitches whose network types include Service support configuring private VLAN policies. You can associate only one private VLAN policy with a cluster vSwitch. Each private VLAN policy supports up to 32 rules, and each rule supports up to 16 isolation VLAN IDs and 16 community VLAN IDs.

Add a private VLAN policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click the Private VLAN Policies tab.

  4. Click Add.

  5. Configure the parameters as described in "Parameters."

  6. Click OK.

Add a rule in a private VLAN policy

About this task

Perform this task to add rules to a private VLAN policy. A rule contains a primary VLAN and a secondary VLAN. You can add multiple primary VLANs, and each primary VLAN can have multiple secondary VLANs. You can add only one promiscuous secondary VLAN, and can add multiple secondary VLANs of other types. For more information about the types of secondary VLANs, see "Parameters."

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click the Private VLAN Policies tab.

  4. Click the name of the target private VLAN policy.

  5. Click Add in the Rules area.

  6. To add a primary VLAN: a. Click Add in the left. b. Configure primary VLAN parameters as described in "Parameters," and then click OK.

  7. To add a secondary VLAN: a. Click Add in the right. b. Configure secondary VLAN parameters as described in "Parameters," and then click OK.

  8. Click Close.

Delete a rule in a private VLAN policy

About this task

Perform this task to delete a secondary VLAN in a private VLAN policy. If a community-type or isolated-type secondary VLAN exists in the private VLAN policy, you cannot delete a promiscuous-type VLAN. Before you delete a promiscuous-type VLAN, delete the community-type or isolated-type secondary VLAN.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click the Private VLAN Policies tab.

  4. Click the name of the target private VLAN policy.

  5. Click Remove in the Actions column for the target private VLAN rule.

  6. Click OK.

Bulk delete rules in a private VLAN policy

About this task

Perform this task to bulk delete rules in a private VLAN policy or delete all secondary VLANs of a primary VLAN.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click the Private VLAN Policies tab.

  4. Click the name of the target private VLAN policy.

  5. Click Add in the Rules area.

  6. Delete rules:

    ○ To delete all rules in the private VLAN policy, select the target primary VLAN, and then click Remove on top of the primary VLAN list.

    ○ To delete selected rules in the private VLAN policy, select the target secondary VLANs, and then click Remove on top of the secondary VLAN list.

  7. Click OK.

Edit a private VLAN policy

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click the Private VLAN Policies tab.

  4. Click Edit in the Actions column for the target private VLAN policy.

  5. Edit the description of the private VLAN policy, and then click OK.

Delete a private VLAN policy

About this task

Perform this task to delete a private VLAN policy. You cannot delete a private VLAN policy if it is bound to a VM. To delete such a policy, you must unbind the VM from the policy first.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Port Groups > VLAN Policies.

  3. Click the Private VLAN Policies tab.

  4. Click Delete in the Actions column for the target private VLAN policy.

  5. Click OK.

Parameters Private VLAN policy parameters

• Name: Specify the name of the private VLAN policy.

• Description: Specify the description of the private VLAN policy.

• Cluster: Select the cluster to which the private VLAN policy belongs.

• vSwitch: Select a pure service network vSwitch in the cluster.