Creating Egress Rule from DCF Logs

If you create a rule this way, you do not have to create SmartGroups or WebGroups ahead of time. A SmartGroup and a WebGroup will be created for you as part of creating the Egress rule.

Field	Description
Name	Distributed Cloud Firewall rule name.
Source SmartGroup	Create a SmartGroup(s) based on the selected logs. The Source SmartGroup automatically selects the VPC/VNet from the logs. Both the Source SmartGroup and WebGroup serve as the source with the destination being the Internet. The Destination is always Public Internet.
SmartGroup Name	Name the SmartGroup being created.
WebGroup	Create a WebGroup based on the selected logs. The WebGroup automatically selects the Domain from the logs. Both the Source SmartGroup and WebGroup serve as the source with the destination being the Internet.
WebGroup Name	Name the WebGroup being created.
Protocol	Select TCP, UDP, ICMP, or Any. If you select TCP or UDP you can enter a port number or port range. The ICMP protocol is unavailable if a WebGroup is selected, because WebGroups are only supported for TLS traffic.
Ports	Select the port that corresponds to the selected protocol.
Action	This determines the action to be taken on the traffic. Permit: Enforcement On Deny: Enforcement On Watch: Enforcement Off and Logging On
Logging	If this slider is On, information related to the action (such as five-tuple, source/destination MAC address, etc.) is logged. After the rule is created you can enable or disable logging from the vertical ellipsis menu next to the rule. Aviatrix recommends not logging Permit rules.
Intrusion Detection (IDS)	If Intrusion Detection is enabled, traffic is inspected for threats, and the results are displayed on the Detected Intrusions tab.
Place Rule	Select Above, Below, Top, Bottom, or Priority.
Existing Rule Name	If you select Above or Below (Place Rule), you must select the existing rule that is affected by the position of the new rule.
Priority	Enter a priority number for the new rule. If an existing rule already has that priority, it is bumped down in the list. Zero (0) is the highest priority number. You can change the rule priority after the rule is created (using the arrow icon next to that rule in the Rule table).

Field

Description

Name

Distributed Cloud Firewall rule name.

Source SmartGroup

Create a SmartGroup(s) based on the selected logs. The Source SmartGroup automatically selects the VPC/VNet from the logs. Both the Source SmartGroup and WebGroup serve as the source with the destination being the Internet. The Destination is always Public Internet.

SmartGroup Name

Name the SmartGroup being created.

WebGroup

Create a WebGroup based on the selected logs. The WebGroup automatically selects the Domain from the logs. Both the Source SmartGroup and WebGroup serve as the source with the destination being the Internet.

WebGroup Name

Name the WebGroup being created.

Protocol

Select TCP, UDP, ICMP, or Any. If you select TCP or UDP you can enter a port number or port range.

The ICMP protocol is unavailable if a WebGroup is selected, because WebGroups are only supported for TLS traffic.

Ports

Select the port that corresponds to the selected protocol.

Action

This determines the action to be taken on the traffic.

Permit: Enforcement On
Deny: Enforcement On
Watch: Enforcement Off and Logging On

Logging

If this slider is On, information related to the action (such as five-tuple, source/destination MAC address, etc.) is logged. After the rule is created you can enable or disable logging from the vertical ellipsis menu next to the rule.

Aviatrix recommends not logging Permit rules.

Intrusion Detection (IDS)

If Intrusion Detection is enabled, traffic is inspected for threats, and the results are displayed on the Detected Intrusions tab.

Place Rule

Select Above, Below, Top, Bottom, or Priority.

Existing Rule Name

If you select Above or Below (Place Rule), you must select the existing rule that is affected by the position of the new rule.

Priority

Enter a priority number for the new rule. If an existing rule already has that priority, it is bumped down in the list. Zero (0) is the highest priority number. You can change the rule priority after the rule is created (using the arrow icon next to that rule in the Rule table).

Getting Started

Security

Monitoring

Resource Groups

Best Practices

Platform Administration

​Related Topics

Related Topics