Distributed Cloud Firewall Supported Capabilities

Ranges

Capability	6.8	6.9	7.0	7.1	7.2	8.0	8.1	8.2	9.0	10.0
Number of SmartGroups	500	500	500	500	1,200	1,200	1,200	1,200	1,200	1,200
Number of Domains per WebGroup				3,000	3,000	3,000	3,000	3,000	3,000	3,000
Number of CIDRs per Group	3,000	3,000	3,000	3,000	10,000	10,000	10,000	10,000	10,000	10,000
Total Number of CIDRs			10,000	10,000	300,000	300,000	300,000	300,000	300,000	300,000
Number of DCF Rules	2,000	2,000	2,000	2,000	5,000	5,000	5,000	5,000	5,000	5,000

Supported Features

The following are supported on AWS, Azure and GCP unless otherwise noted.

PV = feature is in Preview

GA = feature is Generally Available

If a cell is blank the feature was not supported in that release.

Feature	6.9	7.0	7.1	7.2	8.0	8.1	8.2	9.0
DCF on Edge Spoke (L4)						PV	PV	PV
DCF on Edge Spoke (L7)								PV
DCF on Edge Transit S2C (L4)						PV	PV	PV
DCF on Serverless								PV (AWS)
DCF Rules
Layer 4 Rules	GA	GA	GA	GA	GA	GA
Rules with Domain (SNI) WebGroups		PV	GA	GA	GA	GA
Rules with URL WebGroups		PV	PV	PV	PV	PV	PV	GA
Rules with ExternalGroups (formerly GeoGroups and ThreatGroups)				GA	GA	GA
DCF on Public Subnet Filtering Gateways				PV	PV	GA (AWS)
DCF on Site2Cloud (L4 only on Transit)				PV	PV	GA (AWS/AWS Gov Cloud/Azure/Azure Gov) PV (GCP/OCI)	GA (AWS/AWS Gov Cloud/Azure/Azure Gov) PV (GCP/OCI)
DCF on Transit Egress						PV	PV	GA
Security Group Orchestration (not supported on GCP)		PV (Azure)	PV (Azure, AWS)	PV (AWS) GA (Azure)	PV (AWS) GA (Azure)	PV (AWS) GA (Azure)	PV (AWS) GA (Azure)	PV (AWS) GA (Azure)
DCF Rulesets					GA	GA
Deep Packet Inspection
Transparent TLS Decryption			PV	PV	PV	PV	PV	GA
Suricata IDS (Egress only)			PV	PV	PV	PV	PV	GA
Suricata IPS (Egress Only)							PV	GA
Advanced Features
IPS Custom Signatures/Feed							PV	GA
Import Decryption Certificate		PV	PV	PV	PV	PV	PV	GA
Logging
Layer 4 logging (+Domain)		GA	GA	GA	GA	GA
IDS/IPS logging		PV	PV	PV	PV	PV	PV	GA
Log export via Syslog		GA	GA	GA	GA	GA
Asset Groups/SmartGroups
SmartGroups (VM/VPC/Subnet)	GA	GA	GA	GA	GA	GA
DNS Hostname SmartGroups				PV	PV	GA
Kubernetes SmartGroups (Workloads and Nodes)						PV	PV	PV
Domain WebGroups		PV	GA	GA	GA	GA
URL WebGroups		PV	PV	PV	PV	PV	PV	GA
SNI Verification (valid with WebGroups)					PV	PV	PV	GA
ExternalGroups (includes Threat Feeds and Countries)				PV	PV	GA
SmartGroups (S2C)				GA	GA	GA
SaaS-Based Services (Azure and GitHub)					PV	Azure (GA) GitHub (PV)	Azure (GA) GitHub (PV)	Azure (GA) GitHub (GA)

Additional Capabilities

Overlapping IPs have been supported since Controller Version 7.0. Distributed Cloud Firewall (DCF) understands any defined SNAT/DNAT rules and updates the address for each gateway, enforcing the DCF rules.

DCF auto-prunes all rules and pushes only related rules to specific gateways.

SmartGroups dynamically change the resources inside the groups by tracking EC2 changes (AWS, Azure, GCP).

Shared VPC instance tags are not supported in GCP-based SmartGroups.

Log Export to Splunk HTTP Event Collector

Concepts & Architecture

Guides

Reference

Distributed Cloud Firewall Supported Capabilities

Ranges

Supported Features

Additional Capabilities

​Ranges

​Supported Features

​Additional Capabilities

Ranges

Supported Features

Additional Capabilities