Create A Zones Firewall Rule - VMware VSHIELD APP 1.0 Admin Manual

Create a Zones Firewall Rule

Zones Firewall rules allow or deny traffic based on the following criteria:
Criteria
Source (A.B.C.D/nn)
Source Port
Destination (A.B.C.D/nn)
Destination Application
Destination Port
Protocol
You can add destination and source port ranges to a rule for dynamic services such as FTP and RPC, which
require multiple ports to complete a transmission. If you do not allow all of the ports that must be opened for
a transmission, the transmission fails.
To create a firewall rule at the datacenter level
1 In the vSphere Client, go to Inventory > Hosts and Clusters.
2 Select a datacenter resource from the resource tree.
3 Click the vShield Zones tab.
4 Click Zones Firewall.
By default, the L4 Rules option is selected.
To create L2/L3 rules, see "Create a Layer 2/Layer 3 Zones Firewall Rule" on page 30.
5 Do one of the following:

Click Add to add a new rule to the Data Center Low Precedence Rules (Rules below this level have
lower precedence...).

Select a row in the Data Center High Precedence Rules section of the table and click Add. A new
appears below the selected row.
6 Double‐click each cell in the new row to select the appropriate information.
You must type IP addresses in the Source and Destination fields, and port numbers in the Source Port
and Destination Port fields.
7 (Optional) Select the new row and click Up to move the row up in priority.
8 (Optional) Select the Log check box to log all sessions matching this rule.
9 Click Commit to save the rule.
To create a firewall rule at the cluster level
1 In the vSphere Client, go to Inventory > Hosts and Clusters.
2 Select a cluster resource from the resource tree.
3 Click the vShield Zones tab.
4 Click Zones Firewall.
By default, the L4 Rules option is selected.
To create L2/L3 rules, see "Create a Layer 2/Layer 3 Zones Firewall Rule" on page 30.
VMware, Inc.
Description
IP address with netmask (nn) from which the communication originated
Port or range of ports from which the communication originated. To enter a port
range, separate the low and high end of the range with a colon. For example,
1000:1100.
IP address with netmask (nn) which the communication is targeting
The application on the destination the source is targeting
Port or range of ports which the communication is targeting. To enter a port range,
separate the low and high end of the range with a colon. For example, 1000:1100.
Transport protocol used for communication
Chapter 4 Zones Firewall Management
29