> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Extending Distributed Cloud Firewall to your Network Edge

> Distributed Cloud Firewall (DCF) allows you to define granular policies for the distributed applications in the cloud. In addition to Network Segmentation Domains, you can leverage the DCF feature for additional security to allow or deny network traffic from cloud and on-premises.

Distributed Cloud Firewall (DCF) allows you to define granular policies for the
distributed applications in the cloud. In addition to Network Segmentation
Domains, you can leverage the DCF feature for additional security to allow or
deny network traffic from cloud and on-premises. You can create DCF rules to
specify the cloud resources and on-premises CIDRs that can communicate with each
other within a Network Segmentation Domain or as a policy that is created
outside a segmentation domain. These policies are then enforced at the edge by
the Aviatrix Edge Gateway.

Distributed Cloud Firewall extended to the edge offers these key benefits:

* Aviatrix Distributed Cloud Firewall integration with Aviatrix Hybrid Cloud
  Edge.
* Allows you to leverage security built into the Aviatrix Hybrid Cloud Edge to
  filter traffic between LAN segments and CSP resources.
* Provides cloud to edge and advanced threat filtering capabilities.
* Allows you to manage and operate DCF from the cloud and deploy with cloud
  automation.

## Setting Up Distributed Cloud Firewall for Edge

The following are the high-level steps to set up Distributed Cloud Firewall at
the Edge:

1. Create SmartGroups for the applications in the cloud and on-premises to
   filter the traffic between these SmartGroups.

   You can define a SmartGroup by specifying Cloud tags, WebGroups, and CIDRs.
   SmartGroups for network edge is defined using CIDRs. Enforcement of the
   policy by Edge Gateway will make use of the SmartGroups and filter traffic
   based on the DCF rules that are defined for the SmartGroups.

2. (optional) Create WebGroups to filter traffic between web applications and
   the SmartGroups.

3. (optional) Create ExternalGroups to filter traffic between external resources
   and the SmartGroups.

4. Create DCF rules to allow or deny network traffic flow between the groups.

<Note>
  DCF on Edge in Controller 8.1 does not support{" "}
  <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/components/dcf/hostname-smartgroups-about"}>hostname filtering</a>
  , L7 filtering,{" "}
  <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/components/dcf/webgroups-about#sni-verification"}>SNI-based filtering</a>
  , or DNS reachability. If you want to filter traffic for DCF on Edge, you must
  use SmartGroups or the Domain feature of WebGroups.
</Note>

To learn more about creating SmartGroups and DCF rules, see

<a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-configuring"}>Configuring Distributed Cloud Firewall</a>
.

## DCF Rules Enforcement on Edge in Different Controller Versions

In previous Controller versions, DCF is enabled by default (cannot be disabled)
on Edge platforms and all DCF rules are deployed to the Edge gateways,
regardless of their applicability to the Edge gateway.

In Controller version 8.1, DCF on Edge is disabled by default. DCF rules will
not be enforced unless DCF on Edge is explicitly enabled. It can be enabled via
the

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/dcf-settings#enforcement-on-clouds"}>Enforcement on Clouds card</a>
in the Distributed Cloud Firewall > Settings tab.

The following table summarizes DCF support on the different Controller versions:

| Controller Version | Edge Platforms                             | DCF Enforcement    |
| ------------------ | ------------------------------------------ | ------------------ |
| 8.1                | All Edge platforms                         | Disabled           |
| 8.0                | All Edge plaforms                          | Enabled, all rules |
| 7.2                | Aviatrix Edge Platform (AEP), Self Managed | Enabled, all rules |

### Enable DCF on Edge

To enable DCF on Edge gateway:

1. In Aviatrix CoPilot, go to **Distributed Cloud Firewall > Settings** tab.
2. On the **Enforcement on Clouds** card, click **Manage**.
3. In Manage Enforcements on Clouds, turn on **Edge (Hybrid Cloud)** toggle to
   make sure that relevant DCF rules are enforced by the Edge gateways.
4. Click **Save**.