> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Distributed Cloud Firewall Rulesets

> Your Distributed Cloud Firewall (DCF) policies are essential for managing and securing network traffic across various parts of an organization.

Your Distributed Cloud Firewall (DCF) policies are essential for managing and
securing network traffic across various parts of an organization.

Your DCF policies consists of multiple rulesets or other policies for easier
management. You can use policies to apply a consistent security posture across
multiple accounts, VPCs, or environments.

Each ruleset consists of a set of DCF rules. Rulesets allow for logical grouping
of rules based on function, environment, geography, application, or any
user-determined type. Each ruleset has a unique priority range (typically
between 1000 and 8999) and is evaluated in order of priority.

It is crucial for different groups within an organization to collaborate and
decide which rulesets take precedence. This collaboration ensures that the most
critical rules are applied first.

<Note>
  You can switch between rulesets, but it is important to save changes on the
  Policies tab for a specific ruleset before switching to another. A rule can be
  used in more than one ruleset, providing further flexibility in managing network
  security.
</Note>

Rules are the most granular unit in DCF. A rule defines a specific traffic control action, such as Permit or Deny, and is based on criteria such as source/destination IPs, ports, protocols, and SmartGroups. Each rule has a priority value that determines its evaluation order within a ruleset.

<Note>
  DCF rulesets are supported in Controller 8.0 or later. If you started using DCF
  rulesets in Controller 8.0, two predefined rulesets were created: V1 Policy List
  (editable) and Post Rules Policy List (non-editable). The former contained all
  existing legacy rules (created prior to Controller 8.0) and the Greenfield Rule.
  The latter contained the DefaultDenyAll rule. In Controller 8.0, two predefined
  rulesets will be available: V1 Policy List (editable) and Post Rules Policy List
  (non-editable). The former will contain all existing legacy rules (created prior
  to Controller 8.0) and the Greenfield Rule. The latter will contain the
  DefaultDenyAll rule. After monitoring or protecting VPC/VNets, rules are added
  to the Egress Protection Policy List ruleset. This ruleset is created
  automatically when you monitor or protect VPC/VNets, and it contains the rules
  that are created as part of the monitoring or protection workflows. The legacy
  DefaultDenyAll rule is moved from the Post Rules Policy List (8.0) to the Legacy
  Default Deny Ruleset, which can be deleted. The Greenfield Rule will no longer
  be created by default and is being replaced by the zero trust <a href={"/docs/enterprise/" + "10.1" +
  "/guides/security/dcf/dcf-enable-feature#default-action-rule"}>Default Action
  Rule</a>.
</Note>

## Security Control Templates

Aviatrix provides Security Control templates built from Aviatrix-provided threat
intelligence feeds. Use a template to add threat-detection rules to your
environment without writing custom rules.

To explore available templates, go to **Dashboard > Security Control**, then
click **Explore Recommended Security Control**. Current templates include
**Common Threats**. Click **Add** on a template to apply it.

Each Security Control you add starts in the **Monitored** state, which logs
matching traffic without blocking it. Review the matched traffic on the
Dashboard, and when you are ready to block that traffic, switch the control to
**Protect**. You can switch a control back to **Monitored** at any time.

<Note>
  The Dashboard's traffic details depend on **Log Enrichment**, which is in
  Preview and turned off by default. Turn on **Log Enrichment** on \*\*Security

  > Distributed Cloud Firewall > Settings\*\* to see enriched traffic detail for
  > a Security Control's matched traffic.
</Note>

A Security Control is separate from the predefined rulesets described earlier on
this page (**V1 Policy List**, **Post Rules Policy List**, and **Egress
Protection Policy List**), and from the Premium IPS Feed, which drops traffic
based on **Drop Level** severity tiers instead of **Monitored**/**Protect**
states. See <a href={"/docs/enterprise/" + "10.1" +
"/guides/security/dcf/ips"}>Intrusion Prevention System (IPS)</a> for more
information.

## Related Topics

* [Create a DCF Ruleset](https://legacy.docs.aviatrix.com/documentation/latest/security/dcf-ruleset-create.html?expand=true)
* [Manage DCF Rulesets](https://legacy.docs.aviatrix.com/documentation/latest/security/dcf-ruleset-manage.html?expand=true)
* [Create DCF Rules](https://legacy.docs.aviatrix.com/documentation/latest/security/dcf-ruleset-create.html?expand=true)
* <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-configuring"}>Configuring Distributed Cloud Firewall</a>