> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Distributed Cloud Firewall Overview

> Distributed Cloud Firewall (DCF) uses micro-segmentation to provide granular network security rules for distributed applications in the Cloud. Distributed Cloud Firewall enables network policy enforcement between SmartGroups, WebGroups, and ExternalGroups you define in a single cloud or across...

<a id="start-help-dcf-overview" />

Distributed Cloud Firewall (DCF) uses micro-segmentation to provide granular
network security rules for distributed applications in the Cloud. Distributed
Cloud Firewall enables network policy enforcement between

<a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/components/dcf/smartgroups-about"}>SmartGroups, WebGroups, and ExternalGroups</a>
you define in a single cloud or across multiple clouds.

<a id="end-help-dcf-overview" />

<img src="https://mintcdn.com/aviatrix-14b37c43/vKpoXYmi49a-T1vW/images/concepts-architectures/components/dcf/microseg-topology.png?fit=max&auto=format&n=vKpoXYmi49a-T1vW&q=85&s=b4025314ff3c20a27b240570dbf3a89b" alt="Micro-Seg Topology" width="5686" height="1200" data-path="images/concepts-architectures/components/dcf/microseg-topology.png" />

Currently, DCF contains both Preview and GA features. See

<a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-capabilities"}>Distributed Cloud Firewall Supported Capabilities by Controller Version</a>
for more information.

<Note>
  Aviatrix strongly recommends using DCF and its integration with ExternalGroups
  to monitor for threats and block certain countries. If you are an existing
  user of ThreatIQ and/or Geoblocking (prior to Controller version 7.2.4820),
  use these{" "}
  <a href={"/docs/enterprise/" + "10.1" + "/guides/security/threatiq-geo-dcf-migration-guidelines"}>migration recommendations</a>
  to start using DCF with ExternalGroups. You cannot use ThreatIQ and/or
  Geoblocking in conjunction with DCF and ExternalGroups.
</Note>

## Supported Cloud Providers and Gateways

Distributed Cloud Firewall is supported for the following clouds:

* AWS, AWS GovCloud, AWS China
* Azure, Azure Government, Azure in China
* GCP, Google for Government
* OCI, Oracle Government Cloud, Oracle China

The following gateway types are supported:

* Spokes attached to a Transit Gateway
* Spokes detached from a Transit Gateway
* Public Subnet Filtering Gateways (<a href={"/docs/enterprise/" +
  "10.1" +
  "/guides/security/dcf/dcf-settings#psf-gateways-enforce"}>enable PSF Gateways
  with DCF here</a>)
* External connections (Site2Cloud) (<a href={"/docs/enterprise/" +
  "10.1" +
  "/guides/security/dcf/dcf-settings#external-connections-enforce"}>enable
  External Connections with DCF here</a>):
  * Terminating on a Spoke Gateway
  * Terminating on a Transit Gateway (<a href={"/docs/enterprise/" +
    "10.1" + "/reference/general/general-glossary#firewall"}>L4</a> only)
* <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/components/edge-gateways/edge-spoke-overview"}>Edge as Spoke Gateway</a>
  (
  <a href={"/docs/enterprise/" + "10.1" + "/reference/general/general-glossary#firewall"}>L4 only</a>
  ; non-CSP tag)

<Note>
  DCF rules will not be applied to traffic originating or terminating on Aviatrix gateways.

  If you want to use External Connections in your DCF rules, ensure that the Spoke
  or Transit gateway that the DCF rule terminates on is upgraded to 7.2.4820. DCF
  rules that use External Connections will not be evaluated or enforced on 7.1
  gateways.
</Note>

<a id="spoke-gateway-sizing" />

## Minimum Spoke Gateway Sizing

* 3583MB required for L7 with IDS
* 3583MB required for IDS and TLS Decryption
* 8192MB (8 GB) recommended for L7 with IPS

Minimum Spoke gateway sizing is provided in the following table.

| Cloud | L4 only                                      | L4 with <a href={"/docs/enterprise/" + "10.1" + "/reference/general/aviatrix-glossary#external-group"}>External Groups</a> | L7 with TLS Decryption only | L7 with TLS Decryption and IDS | L7 with IPS              |
| ----- | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------------- | ------------------------------ | ------------------------ |
| AWS   | t3.micro or equivalent (non-production only) | t3.medium or larger                                                                                                        | t3.small or equivalent      | t3.medium or larger            | t3.large or larger       |
| Azure | Standard\_B1ms                               | Standard\_B2s                                                                                                              | Standard\_B1ms              | Standard\_B2ms                 | Standard\_B2ms or larger |
| GCP   | n1-standard-1                                | n1-standard-2                                                                                                              | n1-standard-1               | n1-standard-2                  | n1-standard-2 or larger  |
| OCI   | VM.Standard.2.2                              | VM.Standard.2.2                                                                                                            | VM.Standard.2.2             | VM.Standard.2.2                | VM.Standard.2.2          |

<Note>
  When IPS is enabled, spoke gateways require a minimum of 8 GB memory for
  production workloads. Gateways with 4 GB memory may experience connection
  timeouts and increased failure rates under sustained IPS inspection. See

  <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/ips"}>
    Intrusion Prevention System (IPS)
  </a>

  {" "}

  for more information.
</Note>

DCF can be used to control Egress traffic by
[enabling Source NAT](https://legacy.docs.aviatrix.com/documentation/latest/network/snat-dnat-settings.html?expand=true)
on the gateway configuration, and creating policies with

<a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/components/dcf/webgroups-about"}>WebGroups</a>
.

<Note>
  As of Controller 7.1, DCF with WebGroups is the recommended method for configuring and implementing Egress Security.

  This document describes Egress functionality available in the Aviatrix
  Controller in Controller 7.1 and later. For information on configuring the
  legacy Egress FQDN solution, click

  <a href={"/docs/enterprise/" + "10.1" + "/guides/security/egress/egress-legacy-overview"}>Egress FQDN Filtering (Legacy)</a>
  .

  DCF is in Preview mode for earlier Controller versions. See

  <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-capabilities"}>Aviatrix Feature Availability by Controller Version</a>
  for more information.
</Note>

<a id="use-cases" />

## Use Cases

Use cases where you might implement DCF are:

* Workload isolation: in a typical tiered application, you may want to isolate
  tiers that do not require access to each other. For example, in a Shopping
  Cart application, there could be workloads for product inventory, billing, and
  a Product Logging app. Since the Shopping Cart application does not need to
  communicate with the Product Logging app, this traffic should be blocked.
* Quarantine compromised machines: You can isolate a compromised machine by
  placing it in its own SmartGroup and blocking communication to that
  SmartGroup.

## Related Topics

* [DCF Rule Details](https://legacy.docs.aviatrix.com/documentation/latest/security/dcf-rule-details.html?expand=true)
* <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-configuring"}>Configuring Distributed Cloud Firewall</a>