Organization virtual data center (VDC) networks enable vApps\VMs to communicate with each other or with external networks outside the organization.
Depending on the connection of the organization VDC network, there are several different types of organization VDC networks:
An isolated (internally connected) network is one that only VMs within the VDC network can connect to.
A routed network (externally connected) provides access to machines and networks outside the VDC via the edge gateway.
Step 1: Creating an Isolated VCD Network
In the top navigation bar, click Networking.
On the Networks tab, click New to Open New Organization VDC Network window.
On the Scope page, select Organization Virtual Data Center
Step 2: Creating a Routed VCD Network
In the top navigation bar, click Networking.
On the Networks tab, click New to Open New Organization VDC Network window.
Step 3: View the Available Organization VDC Networks
In the top navigation bar, click Networking.
In the Networks tab, you will see a list of the available networks that you can also edit, increase the scope, or delete the Organization VDC network
On the Select Network Type page, select Isolated >> Next.
Enter a Name and description (optional) for the network.
To enable dual-stack networking (enable the network to have both IPv4 & IPv6 subnet), turn on the Dual-Stack Mode toggle.
Enter the Classless Inter-Domain Routing (CIDR) settings for the network >>Next
Format: network_gateway_IP_address/ subnet_prefix_length like 192.168.100.254/24
In Static IP Pools, enter the ranges of IP addresses that you want to use, click Add >> Next
Configure the DNS settings (Optional).
You can put Primary DNS\Secondary DNS\DNS suffix >> Next
Review your settings and click Finish.
On the Scope page, select Organization Virtual Data Center or Data Center Group which to create the network, and click Next
On the Select Network Type page, select Routed >> Next.
Enter a Name and Description (optional) for the network.
To enable dual-stack networking (enable the network to have both IPv4 & IPv6 subnet), turn on the Dual-Stack Mode toggle.
Enter the Classless Inter-Domain Routing (CIDR) settings for the network >>Next
Format: network_gateway_IP_address/ subnet_prefix_length like 192.168.100.254/24
In Static IP Pools, enter the ranges of IP addresses that you want to use, click Add >> Next
Configure the DNS settings (Optional).
You can put Primary DNS\Secondary DNS\DNS suffix >> Next
Review your settings and click Finish.
Edge Gateway created by the HI GIO team
HI GIO uses a layered networking architecture with four categories of networks to provide a highly flexible and secure network infrastructure in a multipurpose cloud environment. The categories are external networks, organization virtual data center (VDC) networks, data center group networks, and vApp networks. Most types of networks require additional infrastructure objects, such as edge gateways and network pools.
Network address translation (NAT) allows the source or destination IP address to be changed to enable traffic to transition through a gateway or router.
HI GIO supports some NAT types:
A SNAT rule translates the source IP address of packets sent from an organization's VDC network out to an external network or another organization's VDC network.
A NO SNAT rule prevents the translation of the internal IP address of packets sent from an organization VDC out to an external network or another organization VDC network.
A DNAT rule translates the IP address and, optionally, the port of packets received by an organization VDC network that are coming from an external network or another organization VDC network.
A NO DNAT rule prevents the translation of the external IP address of packets received by an organization VDC from an external network or another organization VDC network.
Step 1: In the top navigation bar, click Networking and Edge Gateways.
Step 2: Select the edge gateway that you want to edit
Step 3: Under Security, click NAT
Step 4: Click New.
Step 5: Configure an DNAT
Name
Description: [optional]
Interface type: Select DNAT\No DNAT
External IP: Enter the public IP address of the edge gateway
External Port: [optional - Enter a port into which the DNAT rule is translating]
Internal IP: Enter IP or range IP to receive traffic from the external network
Application: [optional – select application profile with port]
Advanced Settings: (Optional)
- State: Enable or disable the NAT rule.
- Logging: Toggle the Logging button to enable logging
- Priority: A lower value means a higher priority. The default is 0. A No SNAT or No DNAT rule should have a higher priority than other rules.
- Firewall Match: The available settings are
Match External Address - The firewall will be applied to external address of a NAT rule.
For SNAT, the external address is the translated source address after NAT is done.
For DNAT, the external address is the original destination address before NAT is done.
Match Internal Address - Indicates the firewall will be applied to internal address of a NAT rule.
For SNAT, the internal address is the original source address before NAT is done.
For DNAT, the internal address is the translated destination address after NAT is done.
Bypass - The packet bypasses firewall rules
Step 6: Click Save
Step 1: In the top navigation bar, click Networking and Edge Gateways.
Step 2: Select the edge gateway that you want to edit
Step 3: Under Security, click NAT
Step 4: Click New.
Step 5: Configure an SNAT
Name: [Name of rule]
Description: [optional]
Interface type: Select SNAT\No SNAT
External IP: Enter the public IP address of the edge gateway
Internal IP: Enter IP or range IP to receive traffic from the external network
Destination IP: [Optional]
Advanced Settings: (Optional)
- State: Enable or disable the NAT rule.
- Logging: Toggle the Logging button to enable logging
- Priority: A lower value means a higher priority. The default is 0. A No SNAT or No DNAT rule should have a higher priority than other rules.
- Firewall Match: The available settings are
Match External Address - The firewall will be applied to external address of a NAT rule.
For SNAT, the external address is the translated source address after NAT is done.
For DNAT, the external address is the original destination address before NAT is done.
Match Internal Address - Indicates the firewall will be applied to internal address of a NAT rule.
For SNAT, the internal address is the original source address before NAT is done.
For DNAT, the internal address is the translated destination address after NAT is done.
Bypass - The packet bypasses firewall rules
Step 6: Click Save
Note: Please do not remove SNAT/DNAT rules name starting with HIGIO- (if any)
Step 7: Add Edge Firewall rules for SNAT/DNAT after completing NAT rules.
The public IP addresses must have been added to the edge gateway interface where you want to add the NAT rule.
Firewall rule will be applied to the local IP address by default configuration. If you want to specify a firewall rule for the Public IP address, please change the "Firewall Match" configuration to "Match External Address" on the Advanced option
An edge gateway firewall monitors North-South traffic to provide perimeter security functionality, including firewall, Network Address Translation (NAT), and site-to-site IPSec and SSL VPN functionality.
Firewall rules to apply to an edge gateway firewall to protect the virtual machines in an organization's virtual data center from outside network traffic
To create firewall rules and add them to an edge gateway, you need to define some things:
Name: Name for the rule.
Source: IP Sets\Dynamic Groups\Static Group (1.1, 1.2, 1.3, 1.4)
Destination: IP Sets\Dynamic Groups\Static Group (1.1, 1.2, 1.3, 1.4)
Application: Select applications with port to apply rule (1.5)
Action: Allow\Reject\Drop
IP Protocol: IPv4/IPv6 or both
Add an IP Set:
Step 1: IP sets are groups of IP addresses and networks to which the firewall rules apply (as Source and Destination).
Step 2: In the top navigation bar, click Networking and click Edge Gateways.
Step 3: Select the edge gateway that you want to edit
Step 4: Under Security, click IP Sets
Step 5: Click New.
Step 6: Enter a meaningful Name, and a Description for IP Sets
Step 7: Enter an IPv4 address, IPv6 address, or an address range in a CIDR format, and click Add.
Step 8: To modify an existing IP address or range, click Modify and edit the value.
Step 9: To confirm, click Save.
Create a Static Security Group:
Static security groups are data center group networks to which distributed firewall rules apply (as Source and Destination). Grouping networks helps you reduce the number of distributed firewall rules that need to be created.
Step 1: In the top navigation bar, click Networking and click Edge Gateways.
Step 2: Select the edge gateway that you want to edit
Step 3: Under Security, click Static Groups.
Step 4: click New.
Step 5: Enter a Name and a Description for the static group, and click Save.
The static security group will appear in the list.
Step 6: Select the newly created static security group and click Manage Members.
Step 7: Select the data center group networks that you want to add to the static security group >> Save
Assign Security Tags to VM:
Security tags you create and assign to virtual machines help you define edge gateway and distributed firewall rules.
Step 1: In the top navigation bar, click Networking.
Step 2: Click Security Tags.
Step 3: Click Add Tag.
Step 4: Enter a tag name.
Step 5: From the list of virtual machines in the organization, select the ones to assign the newly created tag.
Step 6: Click Save.
Create a Dynamic Security Group:
You can define dynamic security groups of virtual machines based on specific criteria (VM Name or Tag Name) to which firewall rules should be applied.
Step 1: In the top navigation bar, click Networking and Edge Gateways.
Step 2: Select the edge gateway that you want to edit
Step 3: Under Security, click Dynamic Groups.
Step 4: Click New.
Step 5: Enter a Name and a Description for the dynamic security group.
Step 6: To create a Criterion for inclusion in the group, add up to four rules that apply to a VM Name or a VM security tag.
VM Name: a rule that applies to VM names containing or starting with a term you specify.
VM tag: a rule that applies to VM tags that equal, contain, start with, or end with a term you specify.
As figured out, I created 02 rules
VM Name: Start With “demo”
VM Tag: Equals “non-prd” (That you created in 1.3)
Step 7: Click Save.
Add a Custom Application Port Profile:
You can use preconfigured and custom application port profiles to create firewall rules.
Application port profiles include a combination of a protocol and a port or a group of ports used for firewall services.
Step 1: In the top navigation bar, click Networking and click Edge Gateways.
Step 2: Select the edge gateway that you want to edit
Step 3: Under Security, click Application Port Profiles
Step 4: In the Custom Applications pane, click New.
Step 5: Enter a Name and a Description for the application port profile.
Step 6: From the Protocol drop-down menu, select the protocol: TCP, UDP, ICMPv4, ICMPv6
Step 7: Enter a port or a range of ports, separated by a comma, and click Save.
We have predefined Objects in the previous. We will create the edge gateway firewall rule as below:
Step 1: In the top navigation bar, click Networking and click Edge Gateways
Step 2: Select the edge gateway.
Step 3: Select Firewall under Services on the left.
Step 4: Click Edit Rules.
Step 5: To add a firewall rule, click New on Top.
HI GIO supports a distributed firewall service for data center groups. You create a single default security policy applied to the data center group.
It can inspect every packet and frame coming to and leaving the VM regardless of the network topology. Packet inspection is done at the VM virtual NIC (vNIC) level, which enables access-control lists (ACLs) to be applied closest to the source.
To create distributed firewall rules and add them to a data center group, you need to define some things:
Name: Name for the rule.
Source: IP Sets\Dynamic Groups\Static Group (1.1, 1.2, 1.3, 1.4)
Name: [Name of rule]
State: [Enable or disable rule by toggle]
Applications: Select default profiles or custom profiles that created in 1.5
Source: Select Any or Object created in 1.1, 1.2, 1.3, 1.4
Destination: Select Any or Object created in 1.1, 1.2, 1.3, 1.4
Action: Allow\Reject\Drop
IP Protocol: IPv4/IPv6 or both
Logging: [Enable or disable by toggle] enable to have the address translation performed by this rule logged
Step 7: Click Save.
After creating the firewall rules, they appear in the Edge Gateway Firewall Rules list. You can move up, down, edit, or delete the rules as needed.
Please do not remove IP Sets name starting with HIGIO- (if any)
Each traffic session is checked against the top rule in the firewall table before moving down the subsequent rules in the table. The first rule in the table that matches the traffic parameters is enforced.
Please do not remove the rules name starting with HIGIO- (if any)
Destination: IP Sets\Dynamic Groups\Static Group (1.1, 1.2, 1.3, 1.4)
Application: Select applications with port to apply rule (1.5)
Action: Allow\Reject\Drop
IP Protocol: IPv4/IPv6 or both
Add an IP Set to the Data Center Group:
IP sets are groups of IP addresses and networks to which the distributed firewall rules apply (as Source and Destination). Combining multiple objects into IP sets helps you reduce the total number of distributed firewall rules to be created
Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab
Step 2: Click the data center group name
Step 3: Under Security, click IP Sets
Step 4: Click New.
Step 5: Enter a meaningful Name, a Description for IP Sets
Step 6: Enter an IPv4 address, IPv6 address, or an address range in a CIDR format, and click Add.
Step 7: To modify an existing IP address or range, click Modify and edit the value.
Step 8: To confirm, click Save.
Create a Static Security Group:
Static security groups are data center group networks to which distributed firewall rules apply (as Source and Destination). Grouping networks helps you reduce the total number of distributed firewall rules that need to be created.
Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab
Step 2: Click the data center group name
Step 3: Under Security, click Static Groups.
Step 4: Click New.
Step 5: Enter a Name, a Description for the static group, and click Save.
The static security group will appear in the list.
Step 6: Select the newly created static security group and click Manage Members.
Step 7: Select the data center group networks that you want to add to the static security group >> Save
Assign Security Tags to VM:
Security tags you create and assign to virtual machines help you define edge gateway and distributed firewall rules.
Step 1: In the top navigation bar, click Networking.
Step 2: Click Security Tags.
Step 3: Click Add Tag.
Step 4: Enter a tag name.
Step 5: From the list of virtual machines in the organization, select the ones to assign the newly created tag.
Step 6: Click Save.
Create a Dynamic Security Group:
You can define dynamic security groups of virtual machines based on specific criteria (VM Name or Tag Name) to which to apply distributed firewall rules.
Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab
Step 2: Click the data center group name
Step 3: Under Security, click Dynamic Groups.
Step 4: Click New.
Step 5: Enter a Name and a Description for the dynamic security group.
Step 6: To create a Criterion for inclusion in the group, add up to four rules that apply to a VM Name or a VM security tag.
VM Name: a rule that applies to VM names containing or starting with a term you specify.
VM tag: a rule that applies to VM tags that equal, contain, start with, or end with a term you specify.
As figured out, I created 02 rules
VM Name: Start With “demo”
VM Tag: Equals “non-prd” (That you created in 1.3)
Step 7: Click Save.
Add a Custom Application Port Profile:
You can use preconfigured and custom application port profiles to create distributed firewall rules.
Application port profiles include a combination of a protocol and a port or a group of ports, used for firewall services.
Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab
Step 2: Click the data center group name
Step 3: Under Security, click Application Port Profiles
Step 4: In the Custom Applications pane, click New.
Step 5: Enter a Name and, a Description for the application port profile.
Step 6: From the Protocol drop-down menu, select the protocol: TCP, UDP, ICMPv4, ICMPv6
Step 7: Enter a port, or a range of ports, separated by a comma, and click Save.
We have predefined Objects in the previous. We will create the distributed firewall rules as below:
In the top navigation bar, click Networking and then click the Data Center Groups tab
Click the data center group name
3. Click the Distributed Firewall tab on the left.
4. Click Edit Rules.
5. To add a firewall rule, click New on Top.
NOTE: Each traffic session is checked against the top rule in the firewall table before moving down the subsequent rules in the table. The first rule in the table that matches the traffic parameters is enforced
6. Configure the rule
Name: [Name of rule]
State: [Enable or disable rule by toggle]
Applications: Select default profiles or custom profiles that created in 1.5
Context: (Optional) Select context profile for the rule.
Source: Select Any or Object created in 1.1, 1.2, 1.3, 1.4
Destination: Select Any or Object created in 1.1, 1.2, 1.3, 1.4
Action: Allow\Reject\Drop
IP Protocol: IPv4/IPv6 or both
Logging: [Enable or disable by toggle] enable to have the address translation performed by this rule logged
7. Click Save.
Please do not remove the rules name starting with HIGIO (if any)
