> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrictive Firewall Management Security Groups

> Aviatrix scopes inbound rules on Azure and GCP firewall management interfaces to the Aviatrix Controller IP address for Palo Alto Networks, Check Point, and Fortinet firewalls deployed through FireNet.

When Aviatrix deploys a firewall through FireNet, it restricts inbound access on
the firewall's management interface to traffic from the Aviatrix Controller's IP
address only. This replaces the open `0.0.0.0/0` inbound access used in earlier
releases.

This protection has been available for AWS FireNet since 8.x. Release 9.0
extends it to Azure, and release 10.1 extends it to GCP. Egress and LAN
interface rules are not affected; they keep their existing rules so data-plane
traffic continues to flow.

## How It Works (Azure)

When a firewall instance is launched, Aviatrix adds inbound NSG rules on the
management interface scoped to the current Controller IP. The exact rules depend
on the firewall vendor.

If the Controller IP changes (for example, after backup/restore or IP
migration), Aviatrix updates the source IP on every controller-scoped NSG rule
on existing Azure firewall instances.

## NSG Rules by Vendor (Azure)

### Palo Alto Networks

Palo Alto Networks firewalls have a dedicated management interface, separate
from the egress and LAN interfaces.

Management NSG (`<instance-name>-management`):

| Rule Name                           | Protocol | Port | Source        | Direction |
| ----------------------------------- | -------- | ---- | ------------- | --------- |
| `avx_tcp443_controller_management`  | TCP      | 443  | Controller IP | Inbound   |
| `avx_tcp3978_controller_management` | TCP      | 3978 | Controller IP | Inbound   |
| `avx_icmp_controller_management`    | ICMP     | N/A  | Controller IP | Inbound   |

<Note>
  The TCP 3978 rule is a placeholder for Panorama connectivity. Its source IP is
  initially set to the Controller IP. If you use Panorama, update the source to
  your Panorama server IP.
</Note>

Egress NSG (`<instance-name>-egress`) and LAN NSG (`<instance-name>-lan`) are
unchanged.

### Check Point

Check Point firewalls share a single interface for egress and management
traffic.

Egress NSG (`<instance-name>-egress`):

| Rule Name                      | Protocol | Port | Source        | Direction |
| ------------------------------ | -------- | ---- | ------------- | --------- |
| `avx_tcp443_controller_egress` | TCP      | 443  | Controller IP | Inbound   |
| `avx_tcp22_controller_egress`  | TCP      | 22   | Controller IP | Inbound   |

LAN NSG (`<instance-name>-lan`) is unchanged.

### Fortinet

Fortinet firewalls share a single interface for egress and management traffic.

Egress NSG (`<instance-name>-egress`):

| Rule Name                      | Protocol | Port | Source        | Direction |
| ------------------------------ | -------- | ---- | ------------- | --------- |
| `avx_tcp443_controller_egress` | TCP      | 443  | Controller IP | Inbound   |

LAN NSG (`<instance-name>-lan`) is unchanged.

## Behavior on Controller IP Change (Azure)

When the Controller IP changes, Aviatrix updates the affected NSG rules on
existing firewall instances:

| Firewall instance type                      | Behavior                                                                                                                          |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Launched after this feature was introduced  | All controller-scoped NSG rules are updated to use the new Controller IP.                                                         |
| Launched before this feature was introduced | A new rule with the new Controller IP is added. The existing Panorama rule (`avx_tcp3978_controller_management`) is not modified. |

## Limitations (Azure)

* The Panorama placeholder rule (TCP 3978) starts with the Controller IP as the
  source. If you use Panorama, update the source to your Panorama server IP.
* Firewall instances launched before this feature was introduced keep their
  original NSG rules in addition to the new controller-scoped rules.

## How It Works (GCP)

When a firewall instance is launched in GCP, Aviatrix adds inbound VPC firewall
rules on the management interface scoped to the current Controller IP address.
This replaces the open `0.0.0.0/0` inbound rule used in earlier releases. The
exact ports allowed depend on the firewall vendor.

## Firewall Rules by Vendor (GCP)

### Palo Alto Networks

Palo Alto Networks firewalls have a dedicated management interface, separate
from the egress and LAN interfaces.

Management interface firewall rule:

| Protocol | Port | Source        | Direction |
| -------- | ---- | ------------- | --------- |
| TCP      | 443  | Controller IP | Inbound   |
| TCP      | 3978 | Controller IP | Inbound   |

<Note>
  The TCP 3978 rule is a placeholder for Panorama connectivity. Its source IP is
  initially set to the Controller IP. If you use Panorama, update the source to
  your Panorama server IP.
</Note>

Egress and LAN interface firewall rules are unchanged.

### Check Point

Check Point firewalls share a single interface for egress and management
traffic.

Egress interface firewall rule:

| Protocol | Port | Source        | Direction |
| -------- | ---- | ------------- | --------- |
| TCP      | 443  | Controller IP | Inbound   |
| TCP      | 22   | Controller IP | Inbound   |

LAN interface firewall rules are unchanged.

### Fortinet

Fortinet firewalls share a single interface for egress and management traffic.

Egress interface firewall rule:

| Protocol | Port | Source        | Direction |
| -------- | ---- | ------------- | --------- |
| TCP      | 443  | Controller IP | Inbound   |

LAN interface firewall rules are unchanged.

## Behavior on Controller IP Change (GCP)

Unlike AWS, GCP firewall instance management rules are not automatically updated
when the Controller IP changes. If the Controller's IP changes (for example,
after backup/restore or IP migration), you must manually update the management
firewall rule's source, or delete and relaunch the firewall instance through
FireNet.

## Limitations (GCP)

* Firewall rules are not automatically updated when the Controller IP changes.
  See
  [Behavior on Controller IP Change (GCP)](#behavior-on-controller-ip-change-gcp).
* Firewall instances launched before upgrading to Controller 10.1 keep their
  original, open `0.0.0.0/0` management rule. The restrictive rule only applies
  to firewall instances launched after the upgrade. To apply the new rule to an
  existing GCP firewall instance, delete and relaunch it through FireNet.
* The Panorama placeholder rule (TCP 3978) starts with the Controller IP as the
  source. If you use Panorama, update the source to your Panorama server IP.

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/firenet/firewall-overview"}>FireNet Overview</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/firenet/firewall-launch-attach"}>Launch and Attach Firewall Instances</a>