Create An App Firewall Rule - VMware VSHIELD APP 1.0.0 UPDATE 1 Admin Manual


Deny all traffic by default.You can change the Action status of the default rules from Allow to Deny, and
add allow rules explicitly for specific systems and applications. In this scenario, if a session does not
match any of the allow rules, the vShield App drops the session before it reaches its destination. If you
change all of the default rules to deny any traffic, the vShield App drops all incoming and outgoing traffic.

Create an App Firewall Rule

App Firewall rules allow or deny traffic based on the following criteria:
Criteria
Source (A.B.C.D/nn)
Source Port
Destination (A.B.C.D/nn)
Destination Application
Destination Port
Protocol
You can add destination and source port ranges to a rule for dynamic services such as FTP and RPC, which
require multiple ports to complete a transmission.
To create a firewall rule at the datacenter level
1 In the vSphere Client, go to Inventory > Hosts and Clusters.
2 Select a datacenter resource from the resource tree.
3 Click the vShield App tab.
4 Click App Firewall.
By default, the L4 Rules option is selected.
To create L2/L3 rules, see
5 Do one of the following:

Click Add to add a new rule to the Data Center Low Precedence Rules (Rules below this level have
lower precedence...).

Select a row in the Data Center High Precedence Rules section of the table and click Add. A new
appears below the selected row.
6 Double-click each cell in the new row to select the appropriate information.
You can type IP addresses in the Source and Destination fields, and port numbers in the Source Port and
Destination Port fields.
7 (Optional) Select the new row and click Up to move the rule up in priority.
8 (Optional) Select the Log check box to log all sessions matching this rule.
9 Click Commit to save the rule.
N Layer 4 firewall rules can also be created from the Flow Monitoring report. See
OTE
Rule from the Flow Monitoring Report"
VMware, Inc.
Description
Container, direction in relation to container, or IP address with netmask (nn) from
which the communication originated.
Port or range of ports from which the communication originated. To enter a port
range, separate the low and high end of the range with a colon. For example,
1000:1100.
Container, direction in relation to container, or IP address with netmask (nn) which
the communication is targeting.
The application on the destination the source is targeting. If you select a protocol
from the drop-down list, the well-known port for the selected protocol appears in
the Destination Port field.
Port or range of ports which the communication is targeting. To enter a port range,
separate the low and high end of the range with a colon. For example, 1000:1100.
Transport protocol used for communication.
"Create a Layer 2/Layer 3 App Firewall Rule"
on page 65.
Chapter 13 App Firewall Management
on page 73.
"Add an App Firewall
71