Configure the distributed firewall

Concepts

A distributed firewall is a security solution in virtualization environments that deploys firewall protections individually to each VM or host. Instead of relying on a centralized firewall, this model applies security policies directly to VMs, independent of their physical host or virtualization platform. This approach ensures uniform security enforcement across the entire infrastructure, enabling granular control that adapts to dynamic workloads without being constrained by traditional network topology.

About this feature

Traditional access control mechanisms (for example, ACLs and vFirewalls) depend on parameters such as IP addresses, protocols (for example, TCP/UDP), and port numbers. Advanced policies might expand to include MAC addresses and time-based ACL rules, creating 5-tuple policies. For common Web-App-DB three-layer application architectures, where each layer contains 3 or 4 VMs, managing security policies can be complex and prone to errors. When VMs at any layer need to be added, deleted, or edited, the associated security rules must be adjusted. IT teams must have strong network expertise to edit these rules, and might even need to re-plan IP subnets. The management platform distributed firewall feature streamlines security management by implementing tag-driven policies, which dramatically reduces the number of required security policies to three. This approach enables IT teams to concentrate entirely on VM communication requirements without getting entangled in underlying network configurations. By leveraging tags for security management, the system automatically adapts to changes, such as adding, removing, or editing VMs, eliminating the need to manually adjust existing policies. This dramatically improves operational efficiency while maintaining robust security. Additionally, the management platform distributed firewall feature groups VMs into different security zones and provides L3/L4 traffic protection for each zone. This ensures consistent security policies even when VMs within the same security zone are distributed across different CVK hosts. Therefore, the management platform distributed firewall feature is not only a flexible security solution but also a powerful tool for addressing security challenges in complex virtualized environments. The management platform distributed firewall feature, through tag-based security policies, offers an efficient, easy-to-manage, and highly flexible security solution for virtualized environments, enabling IT teams to focus more on business needs rather than complex security setting adjustments.

Benefits

Compared to traditional ACLs and vFirewalls, the distributed firewall feature offers the following benefits:

• Simplified management—Streamlines VM-to-VM security policy configuration with intuitive controls, reducing administrative overhead while maintaining clarity for users.

• Zero-trust enforcement—A security policy with a strict default deny framework, ensuring only traffic flows explicitly authorized by the administrator between VMs. Unauthorized access is blocked.

• Self-adjusting policies—Dynamically updates policies in response to VM group membership changes or tag modifications (for example, VM migrations or tag updates), eliminating manual policy adjustments.

• Granular control—Enables granular, context-aware policies at the VM, service, or port level. You can tailor policies to individual application requirements, minimizing attack surfaces.

Restrictions and guidelines

• If a VM has vFirewalls, ACLs, port mirroring, bridge port mirroring, and distributed firewalls configured, only the distributed firewalls take effect.

• Distributed firewall settings for a VM might lose effect after a management platform restoration when the following conditions are met:

○ You perform a management platform backup after you configure distributed firewall settings for that VM.

○ You edit the distributed firewall settings during the management platform restoration.

In this case, you must synchronize the settings.

• After you restore a VM by using a backup file or a VM snapshot, you must reconfigure the distributed firewall settings for that VM.

• If some VMs in the source or destination objects of a security policy fail to obtain IP addresses, the rule state will be displayed as Partially Effective. The rule state will be displayed as Ineffective when the following conditions are met:

○ All VMs in the source or destination objects fail to obtain IP addresses.

○ The rule is disabled.

○ All VMs in the objects where the policy is applied run on old-version CVK hosts.

• If a VM has multiple IP addresses and does not have VMPtools installed, the management platform can obtain only one IP address for communication. As a best practice, install VMPtools on the VM for the management platform to obtain all IP addresses.

• In VLAN passthrough scenarios, if a VLAN subinterface inside a VM has a new IP address configured, VMPtools cannot obtain or update the IP address configured for that VLAN subinterface in the VM group to which the VM belongs.

• As a best practice to prevent the security group settings for VMs managed by NCloud from becoming ineffective, do not use the distributed firewall feature in NSphere if you manage NSphere through the NCloud platform.

• If multiple VMs with the same name exist on different CVK hosts in the current management platform, the distributed firewall policy is applied to only the VM created the first when you import a distributed firewall policy with the objects as those VMs to the current management platform.

• When multiple VMs share the same MAC address, configuring a security policy for one VM automatically applies the same policy to the other VMs.

• When the global default policy of a distributed firewall is set to deny, a large number of VMs and heavy network traffic might increase CPU and memory resource consumption on the host.

• If a host in the management platform has exceptions, changes to security policies, IP object groups, or service object groups will not take effect on that host. Avoid deleting security policies while the host is malfunctioning. If you must delete them, wait until the host recovers.

• If you remove a VM in abnormal status when you edit the application object of a security policy, you must synchronize the modified security policy after completing the changes to ensure that the VM rules return to normal status.

• Before you add or edit VMs, make sure distributed firewall rules have been deployed successfully. You can verify that in the task console.

Procedure

1. Configure IP object groups: Create one or more IP object groups. You can add single IPs, IP ranges, or subnets. For more information, see “IP object groups.”

2. Configure service object groups: Create one or more service object groups. You can add built-in or custom services to these groups to define the protocols and ports for traffic between source and destination VMs. For more information, see “Service object groups.”

3. Add security policies: Create a security policy, set its priority, and select the objects where the security policy will be applied. Object types include VMs, VM groups, tags, and port groups. For more information, see “Security policies.”

4. Add rules to a security policy: After you select an object, add rules for it. You can configure the priority, rule name, source object, destination object, service object group, action (allow or reject), and status (on or off) in each rule.

5. Apply the rules and verify the settings: Make sure all rules are correctly configured and applied to the selected objects. Perform inbound and outbound traffic tests to verify that the traffic is transmitted between objects as configured in the policy.

Security policies

A security policy provides a highly flexible and customizable object management and

rule management solution to meet the needs of various complex virtualization environments. You can perform the following tasks:

• Source/destination object configuration—You can select multiple object types such as VM, VM group, tag, port group, and custom IP, delivering high flexibility to meet diverse network architecture requirement.

• Priority management—You can adjust the priority of policies as needed by moving them to ensure that key policies are executed first.

• Enabling or disabling a security policy—You can enable or disable a security policy as needed.

• Error message prompt—You can view the specific reasons why a security policy is not effective or partially effective to quickly troubleshoot failures.

Add a security policy

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Security Policy.

3. Click Add.

4. Configure the security policy name and priority. Click the icon on the right of the Object field. Select the objects where the security policy will be applied. Click OK.

   ○ Name: Name of the security policy.

   ○ Description: Description for the security policy.

   ○ Priority: Priority of the security policy that determines which policy takes precedence when conflicts occur.

   ○ Object: Types of objects where the security policy will be applied, including VMs, VM groups, tags, and port groups. The default is global.

5. Click Add Rule. Configure the rule name, and select the source object, destination object, and service object group. Set the action to allow or reject, and then enable or disable the rule. Click OK.

   ○ Priority: Specify the priority of a rule in the security policy to ensure timely execution of key rules.

   ○ Name: Enter a rule name to easily manage and identify the rule.

   ○ Source: Specify the source object for the rule. It defines the starting location of the traffic. Object types include VM, VM group, tag, port group, and IP group. The default is global.

   ○ Destination Specify the destination object for the rule. It defines the target location of the traffic. Object types include VM, VM group, tag, port group, and IP group. The default is global.

   ○ Service: Select a service object group to define the services where the rule is applied.

   ○ Action: Configure the action to take on the matching traffic. Options are allow and reject.

   ○ Enabling state: Specify whether to enable the rule.

6. (Optional.) To copy a rule, click Copy in the Actions column for that rule.

7. (Optional.) To delete a rule, click Delete in the Actions column for that rule or select that rule and click Delete Rule.

Edit a security policy

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Security Policy.

3. Click Edit in the Actions column for a security policy.

4. Edit the parameters as needed, and then click OK.

Import security policies

Perform this task to import security policies information exported from another management platform.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Security Policy.

3. Click Import, select the security policy file to be imported, and then click OK.

   ○ Name: Name of the security policy.

   ○ Description: Description for the security policy.

   ○ Object: Types of objects where the security policy will be applied, including VMs, VM groups, tags, and port groups. The default is global.

   ○ Duplication: Identify whether the imported security policy names are the same as existing ones. The system automatically adds serial numbers to duplicate names.

Export security policies

Perform this task to export all security policies on the management platform.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Security Policy.

3. To export multiple security policies in bulk, select one or more security policies, click Export on top of the list, and then click OK in the dialog box that opens. The exported file will be downloaded to your local device automatically.

4. To export a single security policy, click More in the Actions column for a security policy and select Export, and then click OK in the dialog box that opens. The exported file will be downloaded to your local device automatically.

Adjust the priority of security policies

Perform this task to adjust the priority of security policies. A smaller number indicates a higher priority.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Security Policy.

3. To adjust the priority of multiple security policies in bulk, select one or more security policies, click Bulk Actions on top of the list and select Move To. In the dialog box that opens, select the position of the security policies, and then click OK.

4. To adjust the priority of a single security policy, click More in the Actions column for the target security policy and select Move Up, Move Down, or Move To as needed. In the dialog box that opens, click OK.

Copy a security policy

Perform this task to quickly copy an existing security policy and edit it. The new security policy has a priority one level lower than the source policy.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Security Policy.

3. Click Copy in the Actions column for a security policy.

4. Edit the parameters as needed, and then click OK.

Synchronize security policies

When the state of a security policy is partially effective or not effective, you can re-deploy the settings by synchronizing the security policy.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Security Policy.

3. To synchronize multiple security policies in bulk, select one or more security policies, click Bulk Actions on top of the list and select Synchronize, and then click OK in the dialog box that opens.

4. To synchronize a single security policy, click More in the Actions column for the target security policy and select Synchronize. In the dialog box that opens, click OK.

Filter security policies

Perform this task to set filter criteria and filter security policies.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Security Policy.

3. Set filter criteria at the top of the page, and then click Filter. To set more filter criteria, click More.

Manage rules

The system allows you to manage the security rules in the system, including adding, moving up or down, moving to top or bottom, copying, deleting, and repositioning rules before or after other rules.

IP object groups

An IP object group contains specific IP addresses, IP ranges, or subnets to identify

devices in a network. You can create IP object groups to organize and manage related devices. You can add these IP object groups to security policies to allow or deny specific network traffic.

Add an IP object group

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > IP Object Group.

3. Click Add.

4. Configure the parameters and then click OK.

   ○ Name: Name of the IP object group.

   ○ Description: Description for the IP object group.

   ○ IP: Specify a single IP, an IP range, or a subnet. To specify multiple IPs, use carriage returns. For example, enter a single IP 192.168.1.2, and IP range 192.168.2.3-192.168.2.10, or subnet 192.168.1.0/24.

Edit an IP object group

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > IP Object Group.

3. Click Edit in the Actions column for an IP object group.

4. Configure the parameters as needed and then click OK.

   ○ Name: Name of the IP object group.

   ○ Description: Description for the IP object group.

   ○ IP: Specify a single IP, an IP range, or a subnet. To specify multiple IPs, use carriage returns. For example, enter a single IP 192.168.1.2, and IP range 192.168.2.3-192.168.2.10, or subnet 192.168.1.0/24.

Delete IP object groups

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > IP Object Group.

3. To delete IP object groups in bulk, select one or more IP object groups, click Delete on top of the list, and then click OK in the dialog box that opens.

4. To delete a single IP object group, click Delete in the Actions column for an IP object group, and then click OK in the dialog box that opens.

Import IP object groups

Perform this task to import IP object group information exported from another management platform.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > IP Object Group.

3. Click Import, select the IP object group file to be imported, and then click OK.

   ○ Name: Name of the IP object group.

   ○ Description: Description for the IP object group.

   ○ IP: Specify a single IP, an IP range, or a subnet. To specify multiple IPs, use carriage returns. For example, enter a single IP 192.168.1.2, and IP range 192.168.2.3-192.168.2.10, or subnet 192.168.1.0/24.

   ○ Duplication: Identify whether the imported IP object group names are the same as existing ones. The system automatically adds serial numbers to duplicate names.

Export IP object groups

Perform this task to export IP object group information on the management platform.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > IP Object Group.

3. Select one or more IP object groups, click Export on top of the list, and then click OK in the dialog box that opens. The exported file will be downloaded to your local device automatically.

Copy an IP object group

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > IP Object Group.

3. Click Copy in the Actions column for an IP object group.

Service object groups

Service object groups offer a convenient way to manage multiple services together,

allowing for unified and consistent security policy enforcement. This is especially useful when the same policy needs to be applied to several services, ensuring both accuracy and efficiency in policy implementation.

Add a service object group

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Service Object Group.

3. Click Add.

4. Configure the service object group name, and select built-in services or custom services.

5. To add a custom service, click the Custom Service tab, and then click Add. Configure the name, protocol, source port, destination port, type, code, and protocol number. To add multiple protocols, click Add Protocol. Click OK. For more information, see "Parameters." The selected services will be displayed in the selected service list on the right.

6. Click OK.

Edit a service object group

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Service Object Group.

3. Click Edit in the Actions column for a service object group.

4. Edit the parameters as needed, and then click OK.

Delete a service object group

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Service Object Group.

3. Click Delete in the Actions column for a service object group.

4. In the dialog box that opens, click OK.

Import service object groups

Perform this task to import service object group information exported from another management platform.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Service Object Group.

3. Click Import, select the service object group file to be imported, and then click OK.

Export service object groups

Perform this task to export service object group information on the management platform.

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Service Object Group.

3. Select one or more service object groups, click Export on top of the list, and then click OK in the dialog box that opens. The exported file will be downloaded to your local device automatically.

Copy a service object group

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Service Object Group.

3. Click Copy in the Actions column for a service object group.

4. Configure the parameters as needed and then click OK.

View service object group information

1. On the top navigation bar, click Security.

2. From the left navigation pane, select Distributed Firewall > Service Object Group.

3. View information about the service object groups in the management platform. Alternatively, you can use the search box at the top of the page to find specific service object groups.

Parameters

• Name: Specify a name for the service object group.

• Description: Specify a description for the service object group.

• Built-In Services: Select built-in services, including VPN, routing protocol, cluster, network protocol, file transfer, video, Web, email, authentication protocol, database, connectivity, remote login, and log.

• Custom Service: Add custom services. The system supports adding custom services. You can configure the protocol type, source port, destination port, and protocol number in a custom service.

• Name: Specify a custom service name.