NSX Edge Firewall Configuration
creating firewall rules
creating firewall rules
Last updated 25th November 2021
The NSX firewall service restricts or allows network traffic based on rules applied to network nodes or groups.
This guide explain how to create rules.
In the vSphere interface menu, go to the Networking and Security
dashboard.
On the left side, navigate to the NSX Edges
section then click on the appliance you're setting up.
The Firewall tab shows the status with a simple button to stop or start the service.
Any change made will need to be published to be validated, so you will not shut down the service at the single push of a button.
The basics of a firewall rule is to manage identified service(s) from specified source(s) to specified destination(s).
Click on + Add Rule
.
The new rule shows with:
By default, rules have Any as source and destination, meaning it encompasses all traffic. To avoid security issues, it is best practices to avoid broad targets.
Name the rule by clicking the Name
field. ID and Type fields are automatically populated.
The source field defines the origin of the traffic.
Hover over the field and click on the pencil
icon. You can add objects and/or IP addresses as needed.
If "Negate Source" is turned on, the rule is applied to all sources except for the sources selected.
Click Save
when ready.
The destination field defines the target of the traffic.
Hover over the field and click on the pencil
icon. You have the same choices for destination as you had for source.
If "Negate Source" is turned on, the rule is applied to all destinations except for the destinations selected.
Click Save
when ready.
The service field defines the type of traffic aimed at.
Hover over the field and click on the pencil
icon. You have the choice between using existing services and groups or add raw ports/protocols.
Clicking on an existing service or group will show you a description with the ports and protocols involved.
Click Save
when ready.
The action field defines how to handle the traffic.
You have three possible options to choose from:
The log slider allows you to keep a journal of events on the rule.
Aside from a comments section and a statistics section, the advanced settings section allows you to define if the target traffic is inbound, outbound or both. In case of NAT traffic, you can choose if the rule applies to the original or translated source.
Once the rule is set up, you see it in the list. The number of the rule in the list defines its priority.
Rules are applied from top to bottom.
The first rule that matches the traffic overrides all the other rules below.
That means that in the case of conflicting rules, the rule with the highest priority (lowest number) will be applied.
You can modify the rule order by selecting a rule and using the up and down arrows.
No creation/modification of a rule will be registered until you click the Publish
button.
Join our community of users on https://community.ovh.com/en/.
Please feel free to give any suggestions in order to improve this documentation.
Whether your feedback is about images, content, or structure, please share it, so that we can improve it together.
Your support requests will not be processed via this form. To do this, please use the "Create a ticket" form.
Thank you. Your feedback has been received.
Access your community space. Ask questions, search for information, post content, and interact with other OVHcloud Community members.
Discuss with the OVHcloud community