Restrictive Firewall Management Security Groups

When Aviatrix deploys a firewall through FireNet, it restricts inbound access on the firewall’s management interface to traffic from the Aviatrix Controller’s IP address only. This replaces the open 0.0.0.0/0 inbound access used in earlier releases. This protection has been available for AWS FireNet since 8.x. Release 9.0 extends it to Azure, and release 10.1 extends it to GCP. Egress and LAN interface rules are not affected; they keep their existing rules so data-plane traffic continues to flow.

​

How It Works (Azure)

When a firewall instance is launched, Aviatrix adds inbound NSG rules on the management interface scoped to the current Controller IP. The exact rules depend on the firewall vendor. If the Controller IP changes (for example, after backup/restore or IP migration), Aviatrix updates the source IP on every controller-scoped NSG rule on existing Azure firewall instances.

​

NSG Rules by Vendor (Azure)

​

Palo Alto Networks

Palo Alto Networks firewalls have a dedicated management interface, separate from the egress and LAN interfaces. Management NSG (<instance-name>-management): Egress NSG (<instance-name>-egress) and LAN NSG (<instance-name>-lan) are unchanged.

​

Check Point

Check Point firewalls share a single interface for egress and management traffic. Egress NSG (<instance-name>-egress): LAN NSG (<instance-name>-lan) is unchanged.

​

Fortinet

Fortinet firewalls share a single interface for egress and management traffic. Egress NSG (<instance-name>-egress): LAN NSG (<instance-name>-lan) is unchanged.

​

Behavior on Controller IP Change (Azure)

When the Controller IP changes, Aviatrix updates the affected NSG rules on existing firewall instances:

​

Limitations (Azure)

• The Panorama placeholder rule (TCP 3978) starts with the Controller IP as the source. If you use Panorama, update the source to your Panorama server IP.
• Firewall instances launched before this feature was introduced keep their original NSG rules in addition to the new controller-scoped rules.

​

How It Works (GCP)

When a firewall instance is launched in GCP, Aviatrix adds inbound VPC firewall rules on the management interface scoped to the current Controller IP address. This replaces the open 0.0.0.0/0 inbound rule used in earlier releases. The exact ports allowed depend on the firewall vendor.

​

Firewall Rules by Vendor (GCP)

​

Palo Alto Networks

Palo Alto Networks firewalls have a dedicated management interface, separate from the egress and LAN interfaces. Management interface firewall rule: Egress and LAN interface firewall rules are unchanged.

​

Check Point

Check Point firewalls share a single interface for egress and management traffic. Egress interface firewall rule: LAN interface firewall rules are unchanged.

​

Fortinet

Fortinet firewalls share a single interface for egress and management traffic. Egress interface firewall rule: LAN interface firewall rules are unchanged.

​

Behavior on Controller IP Change (GCP)

Unlike AWS, GCP firewall instance management rules are not automatically updated when the Controller IP changes. If the Controller’s IP changes (for example, after backup/restore or IP migration), you must manually update the management firewall rule’s source, or delete and relaunch the firewall instance through FireNet.

​

Limitations (GCP)

• Firewall rules are not automatically updated when the Controller IP changes. See Behavior on Controller IP Change (GCP).
• Firewall instances launched before upgrading to Controller 10.1 keep their original, open 0.0.0.0/0 management rule. The restrictive rule only applies to firewall instances launched after the upgrade. To apply the new rule to an existing GCP firewall instance, delete and relaunch it through FireNet.
• The Panorama placeholder rule (TCP 3978) starts with the Controller IP as the source. If you use Panorama, update the source to your Panorama server IP.

​

Related Topics

• FireNet Overview
• Launch and Attach Firewall Instances