Configuring Distributed Cloud Firewall

This section describes the Distributed Cloud Firewall functional area of Aviatrix CoPilot.

DCF Constraints

  • For any VNets that have Security Group Orchestration applied, and that are included in a rule that is not enforced, the application security group (ASG) in the network security group (NSG) rule remains associated with the VM even though the NSG rule using the ASG is not present.

  • Logging can consume a significant amount of disk space. You can manage disk space settings and retention settings. You can also configure how long to keep your Distributed Cloud Firewall logs.

  • A SmartGroup traffic flow can belong to more than one rule. If this occurs, the priority of the rule determines the action that is taken first.

DCF Prerequisites

Before applying Distributed Cloud Firewall:

  • Your version of CoPilot must be 2.0 or greater.

  • Your version of Aviatrix Controller must be 6.7 or greater.

  • Gateways must have their image updated to version 6.7 or greater.

  • Network reachability should be configured between the VPCs that contain applications that require connectivity. You configure network reachability using Connected Transit/MCNS.

  • Enable SNAT on the Spoke gateways enforcing Egress filtering.

  • If you plan to use Cloud Tags in your SmartGroups, Cloud resources must be tagged appropriately.

  • Create the following groups, if you want to use them in your Distributed Cloud Firewall configuration:

    If you select a WebGroup when creating a rule, the Destination Group must be 'Public Internet'. Any Spoke gateways that are part of the Source Group must contain a VPC/VNet Resource Type that has Local Egress enabled (Spoke gateway).

Intrusion Detection

If you plan to enable Intrusion Detection in a Distributed Cloud Firewall policy, remember:

  • IDS cannot be applied to east-west traffic if HA VPC/VNets are being used.

  • IDS can work with HA for egress traffic.

Enabling the Distributed Cloud Firewall Feature

If you see a message on the Distributed Cloud Firewall page (Security > Distributed Cloud Firewall) that you require the Aviatrix Universal Subscription, in the cloud marketplace you must subscribe to and accept terms for the correct Aviatrix subscription:

  • In AWS, subscribe to the Aviatrix Cloud Network License Service offer.

  • In Azure or GCP, subscribe to the Aviatrix Secure Networking Platform 2208-Universal 24x7 Support offer (not supported in OCI).

Take note of your Customer ID for this offer.

If there is no pre-existing customer ID (you are a new user), you entered this customer ID when logging on to CoPilot. You do not need to reset the Customer ID on the License tab before enabling the feature.

If you have already subscribed to the Aviatrix Universal Subscription license, you do not need to subscribe again. You can just enable the feature from Configuration > Settings > License in CoPilot.

If you configured the ThreatIQ and/or Geoblocking features prior to Controller version 7.2.4820, in 7.2.4820 you automatically receive a free Distributed Cloud Firewall (DCF) license.

If you did not configure the ThreatIQ and/or Geoblocking features prior to Controller version 7.2.4820, you are expected to purchase a DCF license. This will include the GeoGroup and ThreatGroup features.

After subscribing to the license (if you are a new user), do the following to enable the Distributed Cloud Firewall feature:

  1. In CoPilot, go to Settings > Configuration > License.

    controller-customer-id-field

  2. In the Add-on Features list, click Enable for the Distributed Cloud Firewall feature.

  3. Assuming that the Distributed Cloud Firewall add-on feature is enabled, you can enable Enforcement on PSF Gateways and/or Enforcement on External Connections from the Feature Previews list if desired. You cannot enable these preview features if DCF is not enabled.

    If for some reason you disable DCF, the following features are also disabled:

    • Enforcement on PSF Gateways

    • Enforcement on External Connections

    • WebGroups

    • GeoGroups

    • Default ThreatGroup

Placeholder and Default Distributed Cloud Firewall Rules

If you have not yet configured Distributed Cloud Firewall, when you first navigate to the Distributed Cloud Firewall > Rules tab you are prompted to begin using the feature.

If you have already started using Distributed Cloud Firewall, you can skip this section.

  1. Click Begin Using Distributed Firewall.

  2. A message displays indicating that a 'placeholder' Greenfield Rule will be created to allow traffic that maintains the current state, which facilitates the creation of custom rules for specific security needs.

300

  1. Click Begin to confirm you want to start using DCF. The Greenfield Rule and the DefaultDenyAll Rule are added to the Rules list:

    • Greenfield Rule: This placeholder rule prevents traffic from being dropped before you start configuring the rest of your rules. By default (if you selected the recommended Permit All Traffic option), the rule has the following attributes:

      • Source/Destination Groups: Anywhere (0.0.0.0/0)

      • Protocol: Any

      • Action: Permit

      • Logging: On

    After you create additional rules you can move the Greenfield Rule where needed in your rule priority list.

    You can edit or delete the Greenfield Rule later, if desired.

    The Greenfield Rule is only enforced on gateways, and not on Security Groups in the cloud.

    • DefaultDenyAll Rule: This default rule blocks traffic to any CIDR covered in Distributed Cloud Firewall rules. This rule is not editable.

Creating Groups for Distributed Cloud Firewall

SmartGroups

A Distributed Cloud Firewall (DCF) SmartGroup contains one or more filters to identify cloud endpoints that map to an app domain. A filter specifies resource matching criteria. Matching criteria could be a cloud tag; a resource attribute (such as account name or region); a list of IP prefixes; or a Site2Cloud external connection. All conditions within the filter must be satisfied to be matched. A tag or resource attribute-based filter must be associated with a resource type (VPC/VNet, subnet, or VM).

Creating SmartGroups

WebGroups

A DCF WebGroup contains one or more domain names or URLs that assists in filtering (and providing security to) Internet-bound traffic.

Creating WebGroups

ThreatGroups

A DCF ThreatGroup prevents traffic from being sent to, or from, a set of threat IPs.

Currently there is only a Default (system defined) ThreatGroup.

Managing ThreatGroups

GeoGroups

A DCF GeoGroup (or country/countries) allows or prevents traffic from being sent to, or from, a country or a geographical area.

Creating Custom GeoGroups

Creating Distributed Cloud Firewall Rules

After creating your groups, you create Distributed Cloud Firewall (DCF) rules to define the access control to apply on the traffic between those groups.

If your SmartGroups contain Spoke Gateways, ensure that those Spoke Gateways have Egress enabled.

microseg policies

For example, in the workload isolation use case, all traffic (i.e., ports and protocols) between the ShoppingCart application and the Product Logging app must be blocked (Denied). You can decide which policies to enforce, and if you want to log the actions related to a rule. These rules are enforced (if enabled) on your Spoke gateways, and are executed against the Spoke gateways in the order that they are shown in the rule list.

Creating a rule for the workload isolation use case would resemble the following:

  • Source Group: Shopping Cart application

  • Destination Group: Product Logging app

  • Action: Deny

  • Protocol: Any

  • Ports: 0-65535 (Any)

  • Logging: Off

  • Enforcement: On

To create a new Distributed Cloud Firewall rule:

  1. In CoPilot, navigate to Security > Distributed Cloud Firewall.

  2. Click +Rule. The Create Rule dialog displays.

400

  1. Use the Distributed Cloud Firewall Field Reference to create your rule.