Distributed Cloud Firewall - Aviatrix Documentation

This section provides the purpose, elements, and actions performed on the Distributed Cloud Firewall pages.

Purpose

The Policies page creates and manages distributed firewall policies for securing traffic across the multi-cloud environments.

Elements

+ Rule button: Starts the workflow to create a new firewall rule.
Manage Rulesets: Opens the dialog to create, edit, or manage rulesets (groupings of rules). Create rulesets before adding rules to them (Controller 8.0 or later).
Actions button: Provides options to Reset Traffic Count, Turn On Enforcement, Turn Off Enforcement, Turn On Logging, and Turn Off Logging.
Policy Table: Displays the rule names and their details.
Edit button: Modifies an existing firewall rule in the table.
Move button: Changes the priority order of the firewall rules.
Delete button: Removes an existing firewall rule from the table.

Actions

View Ruleset

Each ruleset is a grouping of DCF rules with a priority that determines evaluation order.To view rulesets and the rules within a ruleset:

Go to Security > Distributed Cloud Firewall > Policies.
The Policies page appears with the Ruleset dropdown and the Policy Table.
Select a ruleset from the Ruleset dropdown.
The Policy table shows the rules in that ruleset.
Optionally, use Search or Filter to find a rule within the ruleset.

Note: Save changes for the current ruleset before switching to another.

Requires Controller version 8.0 or later.

Manage Rulesets

Use Manage Rulesets on the Policies page to:

View all rulesets and their order
Create rulesets
Edit placement and names
Change ruleset priority
Reset traffic counts for selected rulesets
Commit draft changes

Note: DCF rulesets require Controller version 8.0 or later.

To manage rulesets:

Go to Security > Distributed Cloud Firewall > Policies.
Click Manage Rulesets.
The Manage Rulesets dialog appears.
Click the edit icon to edit the ruleset change the name and placement of the ruleset.
Click the move icon to change the ruleset priority.
Click the reset icon to reset the traffic counts for the selected rulesets.
Click Save.
Repeat steps 3–6 to create additional rulesets if needed.
Click Commit to commit the saved changes.
Click Close.

Create a DCF Ruleset

Create a ruleset before adding rules to it. You must use Controller version 8.0 or later to use DCF rulesets.To create a ruleset:

Go to Security > Distributed Cloud Firewall > Policies.
Click Manage Rulesets.
The Manage Rulesets dialog appears.
Click + Ruleset.
The Create Ruleset dialog appears.
Configure Name, Place Ruleset, and Existing Ruleset (if applicable).
Refer to the Parameter Details table.
Click Save.
Repeat steps 3–5 to create additional rulesets if needed.
Click Close.
On the Policies tab, select a ruleset from the Ruleset dropdown to add rules to it.

The new ruleset appears in the Ruleset dropdown. You can then add rules to the ruleset.

Parameter Details

CoPilot Parameter Name	Description
Name	Enter a display name for the ruleset.
Place Ruleset	Select Above, Below, Top, Bottom, or Priority to position the new ruleset relative to existing rulesets.
Existing Ruleset	When you choose Above or Below, select the existing ruleset that determines where the new ruleset is inserted.
Priority	When you choose Priority, enter a priority number for the new ruleset. If another ruleset already uses that number, it is moved down in the list. Zero (0) is the highest priority. You can change priority later from the ruleset list.

Create Firewall Rule

To create a distributed firewall rule:

Go to Security > Distributed Cloud Firewall > Policies.
Click + Rule.
Configure the rule parameters. Refer to the Parameter Details table.
Save the rule.

The new rule appears in the Policy Table.

Parameter Details

CoPilot Parameter Name	Description
Name	Distributed Cloud Firewall rule name.
Source Groups	The groups (SmartGroup, ExternalGroup, Threat Feed, Country) that originate traffic. You must create the SmartGroups and ExternalGroups before creating a DCF rule. Note: You must include at least one SmartGroup. You cannot have an ExternalGroup as both a source and a destination.
Destination Groups	The groups (SmartGroup, ExternalGroup, Threat Feed, Country) that terminate traffic. You must create the SmartGroups and ExternalGroups before creating a DCF rule. Note: You must include at least one SmartGroup. You cannot have an ExternalGroup as both a source and a destination. If you are using Distributed Cloud Firewall rules for egress purposes, you must: Select Public Internet as the Destination SmartGroup. Enable SNAT on the Spoke Gateways that enforce the egress policy. The Destination Group must be Public Internet if all of the following are true: You are creating a new rule. The Destination Group has not already been modified. At least one WebGroup has been selected.
WebGroups	Select the WebGroups that filter egress traffic. You must create these groups before creating a DCF rule.
Protocol	Select TCP, UDP, ICMP, or Any. If you select TCP or UDP you can enter a port number or port range. Note: If a WebGroup is included in the rule, a warning displays if any non-standard ports are selected for TCP or UDP. Non-standard ports are those that are not commonly used for the selected protocol, such as port 80 for HTTP or port 443 for HTTPS. The ICMP protocol is unavailable if a WebGroup is selected, because WebGroups are only supported for TLS traffic. If UDP or ICMP is selected, Ensure TLS and TLS Decryption toggles are unavailable.
Port	Enter a port numbers or port range for the protocol.
Enforcement	If this slider is On, the rule is enforced in the data plane. If this slider is Off, packets are only watched so you can observe whether traffic impacted by this rule causes issues (such as drops). After the rule is created you can enable or disable enforcement from the ⋮ (vertical ellipsis) menu next to the rule.
Log	At Start: Logs when the session starts, only the initial connection metadata is logged. At Start & End: Logs both metadata and session statistics (session end time, packets received/transmitted, bytes received/transmitted, and so on). At End: Log when the session ends, a single log is created that contains full session statistics (session end time, packets received/transmitted, bytes received/transmitted, and so on). Off: Disables logging. Note: Aviatrix recommends not logging Permit rules.
Rule Behavior
Action	Select Permit or Deny. This determines the action applied to matching traffic.
SG Orchestration	On: The rule is available for Security Group Orchestration. The SG Orchestration toggle is Off for new rules when any of the following are true: A WebGroup is present in the rule. Source Group is Anywhere and action is Permit. Source Group is Anywhere, Destination Group is Anywhere, and action is Deny.
Ensure TLS	Turn On if you want traffic that matches the ports and Source and Destination Groups but that is not TLS to be denied. Traffic is denied (dropped) even if HTTP traffic matches domains or URLs in WebGroups.
TLS Decryption	Turn On to enable TLS decryption. Important: TLS Decryption must be enabled if a URL-based WebGroup is selected. TLS decryption intercepts encrypted HTTPS traffic, decrypts it for inspection, then re-encrypts it toward the destination.
Intrusion Analysis	When Intrusion Detection is enabled, traffic is inspected for threats and results appear on Detected Intrusions. When Intrusion Detection and TLS Decryption are both enabled, the TLS stream is temporarily decrypted and inspected for intrusions. Note: Download the Aviatrix CA certificate (Controller 7.0) or upload your own certificate (Controller 7.1 or later) before creating a policy that uses IDS or TLS Decryption.
TLS Profile	Select the TLS profile to use for the rule.
Rule Priority
Place Rule	Select Above, Below, Top, Bottom, or Priority.
Existing Rule	If you select Above or Below for Place Rule, select the existing rule whose position is affected by the new rule.
Priority Number	If you selected Priority for Place Rule, enter a priority number for the new rule. If another rule already has that priority, it moves down in the list. Zero (0) is the highest priority number. You can change rule priority after creation using the arrow icon next to the rule in the Rule table.

Edit Firewall Rule

To edit an existing firewall rule:

Go to Security > Distributed Cloud Firewall > Policies.
Locate the rule in the Policy table and click the Edit button.
Update the desired parameters.
Save your changes.

Changes take effect after saving.

Move Firewall Rule

To change the priority order of firewall rules:

Go to Security > Distributed Cloud Firewall > Policies.
Locate the rule in the Policy Table and click the Move button.
Move the rule to the desired position in the priority order.
Save the new order.

Rule priority determines the order in which rules are evaluated.

Delete Firewall Rule

To delete a firewall rule:

Go to Security > Distributed Cloud Firewall > Policies.
Locate the rule in the Policy Table and click the Delete button.
Confirm the deletion.

The rule is removed from the Policy Table.

Manage Policy Enforcement and Logging

To reset traffic count, turn enforcement on or off, or manage logging for a rule:

Go to Security > Distributed Cloud Firewall > Policies.
Locate the rule in the Policy Table and click the Actions button.
Select Reset Traffic Count, Turn On Enforcement, Turn Off Enforcement, Turn On Logging, or Turn Off Logging as needed.

The selected action is applied to the rule.

Policy Logs
Intrusion Logs

Purpose

The Policy Logs page displays traffic logs generated by the Distributed Cloud Firewall policies. It helps monitor allowed and denied traffic, and supports troubleshooting and audit of policy enforcement across cloud networks.

Elements

Auto Refresh toggle: Enables or disables automatic refreshing of the log data.
Policy Logs table: Displays policy rule logs and their details.

Actions

View Policy Logs

To view Distributed Cloud Firewall policy logs:

Go to Security > Distributed Cloud Firewall > Monitor.
Select the Policy Logs tab.
The Policy Logs page appears with the Policy Logs table.
Review traffic logs for allowed and denied traffic.
Optionally, use the Auto Refresh toggle to enable or disable automatic refreshing of log data.

The table displays policy rule logs with timestamp, rule, gateway, source and destination IPs, and other traffic details for troubleshooting and audit.

Parameter Details

CoPilot Parameter Name	Description
Timestamp	Shows the date and time when the traffic log is recorded.
Rule	Shows the firewall policy rule that matches the traffic.
Gateway	Shows the gateway that processes the traffic.
Source IP	Shows the source IP address of the traffic.
Destination IP	Shows the destination IP address of the traffic.
Source MAC address	Shows the source MAC address of the traffic.
Destination MAC address	Shows the destination MAC address of the traffic.
SNI	Shows the server name indication extracted from TLS traffic.
Decrypted by	Shows the gateway that performs traffic decryption.
URL	Shows the destination URL accessed by the traffic.
Protocol	Shows the traffic protocol such as TCP, UDP, or ICMP.
Source port	Shows the source port number used by the traffic.
Destination port	Shows the destination port number used by the traffic.
Reason	Shows the reason for the policy decision.
Action	Shows whether the traffic is allowed or denied.
Enforced	Shows whether the policy enforcement is applied.

Purpose

The Intrusion Logs page displays security events detected by the Distributed Cloud Firewall intrusion detection engine. It helps identify suspicious traffic, analyze threats, and support security investigation across cloud environments.

Elements

Distributed Cloud Firewall: Intrusion Logs

Intrusion Logs table: Displays intrusion detection logs and their details.

Actions

View Intrusion Logs

To view Distributed Cloud Firewall intrusion detection logs:

Go to Security > Distributed Cloud Firewall > Monitor.
Select the Intrusion Logs tab.
The Intrusion Logs page appears with the Intrusion Logs table.
Review security events detected by the intrusion detection engine.

The table displays intrusion logs with timestamp, severity, source and destination IPs, protocol, and attack details for security investigation.

Parameter Details

CoPilot Parameter Name	Description
Timestamp	Shows the date and time when the intrusion event is recorded.
Severity	Shows the severity level of the detected intrusion.
Source IP	Shows the source IP address of the traffic.
Destination IP	Shows the destination IP address of the traffic.
Protocol	Shows the network protocol used by the traffic.
Source port	Shows the source port number used by the traffic.
Destination port	Shows the destination port number used by the traffic.
Application protocol	Shows the application-level protocol detected in the traffic.
Gateway	Shows the gateway where the intrusion is detected.
Category	Shows the intrusion category or attack type.
Attack target	Shows the target resource of the detected attack.
Deployment	Shows the deployment or environment where the event occurs.

Purpose

The Audit page displays audit logs for Distributed Cloud Firewall operations. It helps track user actions, review configuration changes, and support security audit and troubleshooting activities.

Elements

Time Period filter: Filters audit logs based on a selected time range.

Actions

View Audit Logs

To view Distributed Cloud Firewall audit logs:

Go to Security > Distributed Cloud Firewall > Audit.
The Audit page appears with audit logs for DCF operations.
Optionally, use the Time Period filter to filter logs by a selected time range.
Review user actions, configuration changes, and audit findings.

The audit logs help track user actions and support security audit and troubleshooting activities.

Parameter Details

CoPilot Parameter Name	Description
Check Name	Shows the name of the audit check performed.
Status	Shows whether the audit check passed or failed.
Severity	Shows the severity level of the audit finding.
Resource	Shows the resource associated with the audit finding.
Details	Provides additional information about the audit finding.

Profiles
Rules

Purpose

The Profiles page lists intrusion prevention profiles that you can attach to DCF rules for the prevention of network intrusions.

Elements

Distributed Cloud Firewall: IPS Profiles

+ Custom Profile: Opens the flow to define a new custom IPS profile.
Profiles table: Lists added custom IPS profiles.
Search bar: Narrow the profiles table by name or attributes.
Edit: Edits the a custom IPS profile.
Delete: Deletes the a custom IPS profile.
Actions: Opens the context menu to clone a profile and set an IPS profile active.

Actions

View IPS Profiles

To view the IPS Profiles:

Go to Security > Distributed Cloud Firewall > IPS > Profiles.
The IPS Profiles page appears with the IPS Profiles table.
Refer to the Parameter Details table for the details of the IPS profiles parameters.
Optionally use Search or the table toolbar filters to narrow rows.

The table displays the built-in and custom IPS profiles.

Parameter Details

CoPilot Parameter Name	Description
Name	The name of the IPS profile.
Drop Level	The minimum Suricata signature severity level at which matching traffic is dropped. Only Critical Severity: Drops traffic that matches a signature with Critical severity only. Major and Higher Severity: Drops traffic that matches a signature with Major or Critical severity. Minor and Higher Severity: Drops traffic that matches a signature with Minor, Major, or Critical severity. All Severities: Drops traffic that matches any signature regardless of severity level. No Drops: No traffic is dropped. All matching signatures generate an alert only.
Log Level	The severity level at which alerts are generated.
SID Exceptions	The total number of Signature ID (SID) overrides configured on the profile. Includes both Ignored SIDs (fully suppressed — no alert or drop) and Alert Only SIDs (alert generated, traffic not dropped)

View an IPS Profile

To view an IPS Profile:

Go to Security > Distributed Cloud Firewall > IPS > Profiles.
Locate the IPS Profile in the table and click the profile name.
The IPS Profile details page appears with the IPS Profile details.
Refer to the Parameter Details table for the details of the IPS Profile parameters.

Parameter Details

CoPilot Parameter Name	Description
Name	The name of the IPS profile.
Drop Level
Log Level
Rule Feeds
SID	The SID exceptions in the IPS profile.
Action	The action to take when the SID is matched.

Create a Custom IPS profile

To create a custom IPS profile:

Go to Security > Distributed Cloud Firewall > IPS > Profiles.
Click + Custom Profile.
Configure the profile parameters. Refer to the Parameter Details table.
Click Save.

A notification appears confirming the creation of the custom IPS profile.

Parameter Details

CoPilot Parameter Name	Description
Name	The name of the IPS profile.
Rule Feed
Drop Level	Only Critical Severity: Major and Higher Severity: Minor and Higher Severity: All Severities: No Drops:
Alert Level

Edit an IPS profile

To change an existing profile:

Go to Security > Distributed Cloud Firewall > IPS > Profiles.
Locate the IPS Profile in the table and click the edit icon.
The Edit IPS Profile form appears.
Update the profile parameters. Refer to the Parameter Details table.
Click Save.

A notification appears confirming the edit of the IPS Profile.

Parameter Details

CoPilot Parameter Name	Description
Name	The name of the IPS profile.
Rule Feed
Drop Level	Only Critical Severity: Major and Higher Severity: Minor and Higher Severity: All Severities: No Drops:
Alert Level

Delete an IPS profile

To delete an IPS Profile:

Go to Security > Distributed Cloud Firewall > IPS > Profiles.
Locate the IPS Profile in the table and click the delete icon.
The Delete IPS Profile confirmation dialog appears.
Click Delete.

The IPS Profile table updates with the new list of IPS profiles.

Clone an IPS Profile

To clone an IPS Profile:

Go to Security > Distributed Cloud Firewall > IPS > Profiles.
Locate the IPS Profile in the table and click Actions (⋮) > Clone profile.
The Clone Profile form appears.
Update the profile parameters. Refer to the Parameter Details table.
Click Clone.

A notification appears confirming the cloning of the IPS Profile.

Parameter Details

CoPilot Parameter Name	Description
Name	The name of the IPS profile.
Rule Feed
Drop Level	Only Critical Severity: Major and Higher Severity: Minor and Higher Severity: All Severities: No Drops:
Alert Level

Set an IPS Profile Active

To set an IPS Profile active:

Go to Security > Distributed Cloud Firewall > IPS > Profiles.
Locate the IPS Profile in the table and click Actions (⋮) > Set As Active.
Read and understand the message, and tick to confirm the setting.
Click Apply.

A notification appears confirming the setting of the IPS Profile active.

Purpose

The Rules page lists intrusion prevention rules used when IPS inspection runs for Distributed Cloud Firewall.

Elements

+ Custom Rule Federal: Opens the form to define a new custom IPS rule.
Rules table: Lists added custom IPS rules.
Search bar: Narrow the rules table by name or attributes.
Edit button: Edits the a custom IPS rule.
Delete button: Deletes the a custom IPS rule.
Actions (⋮) button: Opens the context menu to download a rule feed.

Actions

View Custom Rules

To view the Custom Rules:

Go to Security > Distributed Cloud Firewall > IPS > Rules Feeds.
The Custom Rules page appears with the Custom Rules table.
Refer to the Parameter Details table for the details of the Custom Rules parameters.
Optionally use Search or the table toolbar filters to narrow rows.

The table displays the added custom rules.

Parameter Details

CoPilot Parameter Name	Description
Name	The name of the customIPS rule.
Rules	The number of rules in the custom IPS rule.
Last Updated	The date and time the custom IPS rule was last updated.

View a Custom Rule

To view a custom Rule:

Go to Security > Distributed Cloud Firewall > IPS > Rules Feeds.
Locate the custom Rule in the table and click the name of the rule.
The Custom Rule details page appears with the Custom Rule details.
Refer to the Parameter Details table for the details of the Custom Rule parameters.

The Custom Rule details page displays the Custom Rule, the rule syntax.

Parameter Details

CoPilot Parameter Name	Description
SID	The SID of the custom Rule.
Content	The content of the custom Rule.
Severity	The severity of the custom Rule.

Create a Custom Rule Feed

To create a custom Rule Feed:

Go to Security > Distributed Cloud Firewall > IPS > Rules Feeds.
Click + Custom Rule Feed.
Enter the name of the custom IPS rule.
Upload the custom IPS rule feed file.
Click Upload.

A notification appears confirming the creation of the custom Rule Feed.

Edit a Custom Rule Feed

To edit a custom Rule Feed:

Go to Security > Distributed Cloud Firewall > IPS > Rules Feeds.
Locate the custom Rule Feed in the table and click the edit icon in the row.
The Edit Custom Rule Feed form appears.
Update the name of the custom Rule Feed and upload new rule feed file.
Click Upload.

A notification appears confirming the update of the custom Rule Feed.

Edit a Custom Rule Syntax

To edit a custom Rule Syntax:

Go to Security > Distributed Cloud Firewall > IPS > Rules Feeds.
Locate the custom Rule Feed in the table and click the name of the rule.
The Custom Rule Syntax details page appears with a table of the SID and the rule syntax.
Click the edit icon in the row and edit the rule syntax.
Turn On the Suricata Rule Syntax toggle to edit the rule syntax in the Suricata format.
Refer to the Parameter Details table for the details of the Suricata Rule Syntax parameters.
Click Save. A notification appears confirming the update of the custom Rule Syntax.

Parameter Details

CoPilot Parameter Name	Description
Severity	Informational: Minor: Major: Critical: Unknown:
Rule
Action	Alert: Pass: Drop: Reject: Reject Source: Reject Destination: Reject Both:
Protocol	ip: tcp:
Direction	Unidirectional: Bidirectional: Stateful:
Source
Source Port
Destination
Destination Port
Options

Delete a Custom Rule Feed

To delete a custom Rule Feed:

Go to Security > Distributed Cloud Firewall > IPS > Rules Feeds.
Locate the custom Rule Feed in the table and click the delete icon in the row.
The Delete Custom Rule Feed confirmation dialog appears.
Click Delete. A notification appears confirming the deletion of the custom Rule Feed.

Download a Custom Rule Feed

To download a custom Rule Feed:

Go to Security > Distributed Cloud Firewall > IPS > Rules Feeds.
Locate the custom Rule Feed in the table and click the Actions icon (⋮) in the row.
The Actions menu appears.
Click Download Rule Feed. A notification appears on your browser confirming the download of the custom Rule Feed.

Profiles
Decryption CA Certificates
Trust Bundles

Purpose

The Profiles page is a central management hub for creating, configuring, and managing TLS Profile objects that control how the Distributed Cloud Firewall inspects, validates, and decrypts TLS traffic.

Elements

Distributed Cloud Firewall: TLS Profiles

+ Custom Profile: Opens the flow to create a new custom TLS profile.
Search: Filters rows in the profiles table.
Profiles table: Shows the list of TLS profiles and their trust and enforcement settings.
Actions: Edit, Delete, and More (⋮) buttons to edit, delete, and clone a profile.

Actions

View TLS Profiles

To view TLS profiles and their trust and enforcement settings:

Go to Security > Distributed Cloud Firewall > TLS > Profiles.
The Profiles page appears with the Profiles table.
Refer to the Parameter Details table for the details of the TLS profiles parameters.
Optionally use Search or the table toolbar filters to narrow rows. The table displays TLS profiles with their name, trust bundle, SNI verification, and enforcement settings.

Parameter Details

CoPilot Parameter Name	Description
Name	The name of the TLS profile.
Trust Bundle	Collection of CA certificates used to validate the origin server’s certificate when this TLS profile is applied to a rule.
SNI Verification	On: Server Name Indication verification is enforced for decrypted sessions using this profile. Off: Server Name Indication verification is not enforced for decrypted sessions using this profile.
Enforcement	Permissive: Checks are performed; failures are logged but traffic is allowed. Strict: Checks are performed; failures cause the connection to be terminated. None: No certificate or SNI checks are performed.

The Default SNI Verify row is a built-in default profile (marked Default) and cannot be deleted.

Create a TLS Profile

To create a custom TLS profile:

Go to Security > Distributed Cloud Firewall > TLS > Profiles.
Click + Custom Profile.
Configure the profile parameters. Refer to the Parameter Details table.
Click Save.

Parameter Details

CoPilot Parameter Name	Description
Name	Enter a name for the TLS profile.
Trust Bundle	Collection of CA certificates used to validate the origin server’s certificate when this TLS profile is applied to a rule.
SNI Verification	On: Server Name Indication verification is enforced for decrypted sessions using this profile. Off: Server Name Indication verification is not enforced for decrypted sessions using this profile.
Enforcement	Permissive: Checks are performed; failures are logged but traffic is allowed. Strict: Checks are performed; failures cause the connection to be terminated. None: No certificate or SNI checks are performed.

The new profile appears in the table and can be selected where TLS profiles are referenced (for example, from DCF policy rules that support TLS profile selection).

Edit a TLS Profile

To edit a TLS profile:

Go to Security > Distributed Cloud Firewall > TLS > Profiles.
The Profiles page appears with the Profiles table.
Locate the profile and use Edit to update the profile parameters. Refer to the Parameter Details table.
Use More actions (⋮) and click Clone to create a copy of the profile.
Click Save.

A notification appears confirming the edit.

Parameter Details

CoPilot Parameter Name	Description
Name	The name of the TLS profile.
Trust Bundle	Collection of CA certificates used to validate the origin server’s certificate when this TLS profile is applied to a rule.
SNI Verification	On: Server Name Indication verification is enforced for decrypted sessions using this profile. Off: Server Name Indication verification is not enforced for decrypted sessions using this profile.
Enforcement	Permissive: Checks are performed; failures are logged but traffic is allowed. Strict: Checks are performed; failures cause the connection to be terminated. None: No certificate or SNI checks are performed.

Delete a TLS Profile

To delete a TLS profile:

Go to Security > Distributed Cloud Firewall > TLS > Profiles.
The Profiles page appears with the Profiles table.
Locate the profile and click Delete.
Read the warning message and tick to confirm the deletion.
Click Delete. A notification appears confirming the deletion.

Purpose

The Decryption CA Certificates page shows the CoPilot-managed Decryption CA used for TLS decryption in DCF flows, its validity, association to a trust bundle, and actions to renew or download the certificate.

Elements

Distributed Cloud Firewall: Decryption CA Certificate

Decryption CA Certificate Certificate card showing the certificate details such as name, expiry date, and trust bundle association.
Renew Certificate button: Button to renew the decryption CA certificate.
Download Certificate button: Button to download the decryption CA certificate.
More Options dropdown: The dropdown menu contains the following options:
- Upload New Certificate: Button to upload a new certificate.
- Upload New Trust Bundle: Button to upload a new trust bundle.
- Remove Certificate: Button to remove the certificate.
- Remove Trust Bundle: Button to remove the trust bundle.

Actions

Renew a Decryption CA Certificate

To renew a Decryption CA certificate:

Go to Security > Distributed Cloud Firewall > TLS > Decryption CA Certificates.
Locate the Decryption CA Certificate card to renew.
Click Renew Certificate.

. A notification appears confirming the renewal.

Download a Decryption CA Certificate

To download a Decryption CA certificate to your local machine:

Go to Security > Distributed Cloud Firewall > TLS > Decryption CA Certificates.
Locate the Decryption CA Certificate card to download.
Click Download Certificate. A notification on your browser appears confirming the download.

Upload a New Certificate

To upload a new certificate:

Go to Security > Distributed Cloud Firewall > TLS > Decryption CA Certificates.
Locate the Decryption CA Certificate card to upload.
Click the dropdown next to the Download Certificate button and click Upload New Certificate.
The Upload New Certificate dialog appears.
Upload the Certificate and the Certificate Key.
Click Upload. A notification appears confirming the upload.

Upload a New Trust Bundle

To upload a new trust bundle:

Go to Security > Distributed Cloud Firewall > TLS > Decryption CA Certificates.
Locate the Decryption CA Certificate card to upload.
Click the dropdown next to the Download Certificate button and click Upload Trust Bundle.
The Upload Trust Bundle dialog appears.
Upload the trust bundle file.
Click Upload. A notification appears confirming the upload.

Remove a Certificate

To remove a certificate:

Go to Security > Distributed Cloud Firewall > TLS > Decryption CA Certificates.
Locate the Decryption CA Certificate card to remove.
Click the dropdown next to the Download Certificate button and click Remove Certificate.
The Remove Certificate dialog appears.
Click Remove. A notification appears confirming the removal.

Remove a Trust Bundle

To remove a trust bundle:

Go to Security > Distributed Cloud Firewall > TLS > Decryption CA Certificates.
Locate the Decryption CA Certificate card to remove.
Click the dropdown next to the Download Certificate button and click Remove Trust Bundle.
The Remove Trust Bundle dialog appears.
Click Remove. A notification appears confirming the removal.

Purpose

The Trust Bundles view lists trust bundles available for TLS operations (including those referenced by TLS profiles and the decryption CA configuration).

Elements

Distributed Cloud Firewall: Trust Bundles

+ Trust Bundle: Button to start the workflow for adding a new trust bundle.
Trust Bundles table: Displays the list of added trust bundles and their details.
Search: Filters trust bundle rows in the table.

Actions

View Trust Bundles

To view trust bundles:

Go to Security > Distributed Cloud Firewall > TLS > Trust Bundles.
The Trust Bundles page appears with the Trust Bundles table.
Refer to the Parameter Details table for the details of the trust bundles parameters.
Optionally, use Search or the table toolbar filters to narrow rows. The table displays trust bundles with their name.

Add a Trust Bundle

To upload a trust bundle:

Go to Security > Distributed Cloud Firewall > TLS > Trust Bundles.
Click + Trust Bundle.
Enter the name of the trust bundle.
Upload the trust bundle file.
Note: Ensure the trust bundle file is in .pem format.
Click Save. A notification appears confirming the addition.

Edit a Trust Bundle

To edit a trust bundle:

Go to Security > Distributed Cloud Firewall > TLS > Trust Bundles.
Locate the trust bundle and click the edit icon in the row.
The Edit Trust Bundle dialog appears.
Update the name of the trust bundle and upload new trust bundle file.
Click Save. A notification appears confirming the update.
Note: Ensure the trust bundle file is in .pem format.

Delete a Trust Bundle

To delete a trust bundle:

Go to Security > Distributed Cloud Firewall > TLS > Trust Bundles.
The Trust Bundles page appears with the Trust Bundles table.
Locate the trust bundle and click the delete icon in the row.
Read the warning message and tick to confirm the deletion.
Click Delete. A notification appears confirming the deletion.

Download a Trust Bundle

To download a trust bundle to your local machine:

Go to Security > Distributed Cloud Firewall > TLS > Trust Bundles.
The Trust Bundles page appears with the Trust Bundles table.
Locate the trust bundle and click the Actions icon (⋮) in the row.
Click Download Trust Bundle. A notification on your browser appears confirming the download.

Purpose

The Settings page allows configuration of global firewall settings, logging, and alerting options.

Elements

Global Settings Panel: Configure default action, logging, and alert thresholds.
Notification Settings: Enable alerts for intrusion detection and policy violations.
Advanced Options: Configure threat intelligence feeds and update intervals.

Actions

Configure Global Firewall Settings

To configure global firewall settings:

Go to Security > Distributed Cloud Firewall > Settings.
In the Global Settings Panel, configure the default action for unmatched traffic.
Set the Logging Level (Minimal, Standard, or Detailed).
Configure Alert Threshold for triggering alerts.
Save your changes.

Global settings apply to all Distributed Cloud Firewall policies.

Parameter Details

CoPilot Parameter Name	Description
Default Action	Specifies default action for unmatched traffic (Allow/Deny).
Logging Level	Sets logging verbosity (Minimal, Standard, Detailed).
Alert Threshold	Configures thresholds for triggering alerts.
Threat Feed URL	URL for external threat intelligence feed.
Update Interval	Frequency of threat feed updates.

Configure Notification Settings

To configure notification settings for alerts:

Go to Security > Distributed Cloud Firewall > Settings.
In Notification Settings, enable alerts for intrusion detection and policy violations.
Configure notification destinations and preferences.
Save your changes.

Notifications are sent when configured thresholds or events occur.

Configure Advanced Options

To configure threat intelligence and advanced options:

Go to Security > Distributed Cloud Firewall > Settings.
In Advanced Options, configure the Threat Feed URL for external threat intelligence.
Set the Update Interval for threat feed updates.
Save your changes.

Threat intelligence feeds enhance intrusion detection and policy enforcement.

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Parameter Details

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Purpose

​Elements

​Actions

​Purpose

​Elements

​Actions

​Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Parameter Details

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Parameter Details

Purpose

Elements

Actions

Purpose

Elements

Actions

Purpose

Elements

Actions

Parameter Details