Create An App Firewall Rule - VMware VSHIELD APP 1.0 Admin Manual

Create an App Firewall Rule

App Firewall rules allow or deny traffic based on the following criteria:
Criteria
Source (A.B.C.D/nn)
Source Port
Destination (A.B.C.D/nn)
Destination Application
Destination Port
Protocol
You can add destination and source port ranges to a rule for dynamic services such as FTP and RPC, which
require multiple ports to complete a transmission. If you do not allow all of the ports that must be opened for
a transmission, the transmission fails.
To create a firewall rule at the datacenter level
1 In the vSphere Client, go to Inventory > Hosts and Clusters.
2 Select a datacenter resource from the resource tree.
3 Click the vShield App tab.
4 Click App Firewall.
By default, the L4 Rules option is selected.
To create L2/L3 rules, see "Create a Layer 2/Layer 3 App Firewall Rule" on page 77.
5 Do one of the following:

Click Add to add a new rule to the Data Center Low Precedence Rules (Rules below this level have
lower precedence...).

Select a row in the Data Center High Precedence Rules section of the table and click Add. A new
appears below the selected row.
6 Double‐click each cell in the new row to select the appropriate information.
You can type IP addresses in the Source and Destination fields, and port numbers in the Source Port and
Destination Port fields.
7 (Optional) Select the new row and click Up to move the rule up in priority.
8 (Optional) Select the Log check box to log all sessions matching this rule.
9 Click Commit to save the rule.
N Layer 4 firewall rules can also be created from the Flow Monitoring report. See "Add an App Firewall
OTE
Rule from the Flow Monitoring Report" on page 69.
VMware, Inc.
Description
Container, direction in relation to container, or IP address with netmask (nn) from
which the communication originated.
Port or range of ports from which the communication originated. To enter a port
range, separate the low and high end of the range with a colon. For example,
1000:1100.
Container, direction in relation to container, or IP address with netmask (nn) which
the communication is targeting.
The application on the destination the source is targeting. If you select a protocol
from the drop‐down list, the well‐known port for the selected protocol appears in
the Destination Port field.
Port or range of ports which the communication is targeting. To enter a port range,
separate the low and high end of the range with a colon. For example, 1000:1100.
Transport protocol used for communication.
Chapter 13 App Firewall Management
75