1 of 17

NETWORK

Information

This short manual guide is crafted to help HI GIO users navigate our network offerings, providing you with the knowledge and tools necessary to optimize your network infrastructure. In this guide, you will find step-by-step instructions for configuring and managing your network services, best practices for maintaining optimal performance, and tips for troubleshooting common issues.

Overview

We provide HI GIO Network & Security for all enterprises’ networks that need to address their particular protection and compliance requirements by fine-grained protections at host, network, and application levels such as Distributed Firewall, Edge Firewall, Web Application Firewall (WAF), Third Party Firewall (Checkpoint, Fortigate), Zero Trust Network Access (ZTNA).

Guideline

1. Working with Network

1. Working with Network

Overview

HI GIO uses a layered networking architecture with four categories of networks to provide a highly flexible and secure network infrastructure in a multipurpose cloud environment. The categories are external networks, organization virtual data center (VDC) networks, data center group networks, and vApp networks. Most types of networks require additional infrastructure objects, such as edge gateways and network pools.

Working with Organization VDC Networks

Overview

Organization virtual data center (VDC) networks enable vApps\VMs to communicate with each other or with external networks outside the organization.

Depending on the connection of the organization VDC network, there are several different types of organization VDC networks:

An isolated (internally connected) network is one that only VMs within the VDC network can connect to.
A routed network (externally connected) provides access to machines and networks outside the VDC via the edge gateway.

Procedure

Step 1: Creating an Isolated VCD Network

In the top navigation bar, click Networking.
On the Networks tab, click New to Open New Organization VDC Network window.
On the Scope page, select Organization Virtual Data Center

Step 2: Creating a Routed VCD Network

In the top navigation bar, click Networking.
On the Networks tab, click New to Open New Organization VDC Network window.

Step 3: View the Available Organization VDC Networks

In the top navigation bar, click Networking.
In the Networks tab, you will see a list of the available networks that you can also edit, increase the scope, or delete the Organization VDC network

How to create NAT rules on Edge Gateway

Overview

Network address translation (NAT) allows the source or destination IP address to be changed to enable traffic to transition through a gateway or router.

HI GIO supports some NAT types:

A SNAT rule translates the source IP address of packets sent from an organization's VDC network out to an external network or another organization's VDC network.
A NO SNAT rule prevents the translation of the internal IP address of packets sent from an organization VDC out to an external network or another organization VDC network.
A DNAT rule translates the IP address and, optionally, the port of packets received by an organization VDC network that are coming from an external network or another organization VDC network.
A NO DNAT rule prevents the translation of the external IP address of packets received by an organization VDC from an external network or another organization VDC network.

Step 1: In the top navigation bar, click Networking and Edge Gateways.

Step 2: Select the edge gateway that you want to edit

Step 3: Under Security, click NAT

Step 4: Click New.

Step 5: Configure an DNAT

Name

Using Distributed Firewall in a Data Center Group

Overview

HI GIO supports a distributed firewall service for data center groups. You create a single default security policy applied to the data center group.

It can inspect every packet and frame coming to and leaving the VM regardless of the network topology. Packet inspection is done at the VM virtual NIC (vNIC) level, which enables access-control lists (ACLs) to be applied closest to the source.

Procedure

To create distributed firewall rules and add them to a data center group, you need to define some things:

Name: Name for the rule.

Source: IP Sets\Dynamic Groups\Static Group (1.1, 1.2, 1.3, 1.4)

Destination: IP Sets\Dynamic Groups\Static Group (1.1, 1.2, 1.3, 1.4)

Application: Select applications with port to apply rule (1.5)

Action: Allow\Reject\Drop

IP Protocol: IPv4/IPv6 or both

Add an IP Set to the Data Center Group:

IP sets are groups of IP addresses and networks to which the distributed firewall rules apply (as Source and Destination). Combining multiple objects into IP sets helps you reduce the total number of distributed firewall rules to be created

Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab

Step 2: Click the data center group name

Step 3: Under Security, click IP Sets

Step 4: Click New.

Step 5: Enter a meaningful Name, a Description for IP Sets

Step 6: Enter an IPv4 address, IPv6 address, or an address range in a CIDR format, and click Add.

Step 7: To modify an existing IP address or range, click Modify and edit the value.

Step 8: To confirm, click Save.

Create a Static Security Group:

Static security groups are data center group networks to which distributed firewall rules apply (as Source and Destination). Grouping networks helps you reduce the total number of distributed firewall rules that need to be created.

Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab

Step 2: Click the data center group name

Step 3: Under Security, click Static Groups.

Step 4: Click New.

Step 5: Enter a Name, a Description for the static group, and click Save.

The static security group will appear in the list.

Step 6: Select the newly created static security group and click Manage Members.

Step 7: Select the data center group networks that you want to add to the static security group >> Save

Assign Security Tags to VM:

Security tags you create and assign to virtual machines help you define edge gateway and distributed firewall rules.

Step 1: In the top navigation bar, click Networking.

Step 2: Click Security Tags.

Step 3: Click Add Tag.

Step 4: Enter a tag name.

Step 5: From the list of virtual machines in the organization, select the ones to assign the newly created tag.

Step 6: Click Save.

Create a Dynamic Security Group:

You can define dynamic security groups of virtual machines based on specific criteria (VM Name or Tag Name) to which to apply distributed firewall rules.

Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab

Step 2: Click the data center group name

Step 3: Under Security, click Dynamic Groups.

Step 4: Click New.

Step 5: Enter a Name and a Description for the dynamic security group.

Step 6: To create a Criterion for inclusion in the group, add up to four rules that apply to a VM Name or a VM security tag.

VM Name: a rule that applies to VM names containing or starting with a term you specify.
VM tag: a rule that applies to VM tags that equal, contain, start with, or end with a term you specify.

As figured out, I created 02 rules

VM Name: Start With “demo”
VM Tag: Equals “non-prd” (That you created in 1.3)

Step 7: Click Save.

Add a Custom Application Port Profile:

You can use preconfigured and custom application port profiles to create distributed firewall rules.

Application port profiles include a combination of a protocol and a port or a group of ports, used for firewall services.

Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab

Step 2: Click the data center group name

Step 3: Under Security, click Application Port Profiles

Step 4: In the Custom Applications pane, click New.

Step 5: Enter a Name and, a Description for the application port profile.

Step 6: From the Protocol drop-down menu, select the protocol: TCP, UDP, ICMPv4, ICMPv6

Step 7: Enter a port, or a range of ports, separated by a comma, and click Save.

We have predefined Objects in the previous. We will create the distributed firewall rules as below:

In the top navigation bar, click Networking and then click the Data Center Groups tab
Click the data center group name

3. Click the Distributed Firewall tab on the left.

2. VPN

Please refer to the VPN usage guide in the list below.

IPSec parameters

Object Name

Customer's Device

HI GIO

HI GIO support

Description

IPSec VPN

IPsec VPN offers site-to-site connectivity between an HI GIO and remote sites with third-party hardware routers or VPN gateways that support IPSec.

On HI GIO, you can create VPN tunnels between:

Organization virtual data center networks in the same organization
Organization virtual data center networks in different organizations

3. Load Balancer

HI GIO CLOUD supports Layer-4 and Layer-7 Load balancer.

Configure load balancing for an application in HI GIO CLOUD. The main configuration steps need to be performed as follows:

Item

Description

Import SSL Certificate

Overview

The private key must be in PKCS8 encoded format.

You cannot import a certificate that already exists on the portal.

To renew SSL:

Delete the current SSL.
Import a new one.

Procedure

Step 1: Log in to the HI GIO Portal as an Organization Administrator and Navigate to

Administration > Certificate Management > Certificates Library.

Step 2: Press IMPORT to Import the Certificate and Private Key for application traffic encryption.

Friendly Name: type your Certificate Name (for example, IIJVN-Cert). Click NEXT

Step 3: Click SELECT CERTIFICATE FILE to upload your Certificate file

Step 4: Select your Certificate file (DER encoded or PEM format) and import it to HI GIO Portal. Click Open

Step 5: Review your Certificate information. Click NEXT

Step 6: Click SELECT PRIVATE KEY to import Private Key

Step 7: Select your Private Key import to HI GIO Portal. Click Open

Input Private Key Passphrase if your Private Key is protected by password. Click IMPORT
Input Private Key Passphrase if your Private Key is protected.

Create Pools on Load Balancing

Procedure

Step 1: Log in to the HI GIO PORTAL as an Organization Administrator and Navigate to

Networking > Edge Gateway > Load Balancer > Pool.

Step 2: Press ADD to create and configure a load balancer pool.

General Settings Tab:

Name: type Pool name (example IIS-Web-Pool)
Default Server Port: The destination server port used by the traffic sent to the member (example 80)
Load Balancer Algorithm: (example Round Robin)

NSX ALB supports various Load-balancing methods:

Consistent Hash

Core Affinity

Fastest Response

Fewest Servers

Least Connections

Least Load

Round Robin

Persistence: The persistence profile will ensure that the same user sticks to the same server for a desired duration of time (e.g. Client IP)

NSX ALB supports various Persistence types:

System-Persistence-App-Cookie

System-Persistence-Client-IP

System-Persistence-Custom-HTTP-Header

System-Persistence-HTTP-Cookie

System-Persistence-TLS

Active Health Monitor: (example HTTP - This will send periodic HTTP HEAD requests to each server in the Pool to check the availability)
Add two/or more entries in the Members tab and enter the IP Addresses and Port from the Virtual Machines running the application Servers.

Press SAVE to create a non-encrypted pool.

General Settings Tab:

Name: type Pool name (example IIS-Web-Pool)
Default Server Port: The destination server port used by the traffic sent to the member (example 443)

HTTP/HTTPS:
- Send Interval: 10s
- Receive Timeout: 4s

Create Virtual Service (VS) on Load Balancing

Procedure

Networking > Edge Gateway > Load Balancer > Virtual Services.

Click ADD.

Step 1: Create a Layer 4 Virtual Service

Virtual Service can be created with the required properties:

· Name: Virtual Service name

· Service-Engine-Group: select SEG which assign for each Tenant

· Load Balancer Pool: select Loadbalancer Pool (example select App-587-Pool)

· Virtual IP: Select 01 public IP for VIP

· Service Type: L4

· Port: application port (example 587)

Virtual Service can be created with the required properties:

· Name: Virtual Service name

· Service-Engine-Group: select SEG which assigns to each Tenant

· Load Balancer Pool:

o If Server Pool is running port 80 non-encryption (example: select IIS-Web-Pool)

o If the Server Pool is running port 443 encryption (example select IIS-Web-443-Pool)

Open Firewall Rule To Public Service To Internet

The default Edge gateway firewall rule on Tenant is set to Deny all. We must create firewall rules for traffic to virtual services from the internet.

Step 1: Log in to the HI GIO PORTAL as an Organization Administrator and Navigate to

Step 2: Networking > Edge Gateway > Security > IP Sets.

Press NEW to define the IP Set for VIPs.

Monitor Traffic Analytics

Procedure

Step 1: Log in to the HI GIO PORTAL as an Organization Administrator and Navigate to

Networking > Edge Gateway > Load Balancer > Virtual Services.

Step 2: Click on the “ >>” icon beside the virtual service you want to monitor.

HI GIO LB support Statistics Chart:

By the time (Past 30 minutes, 6 Hours,….)
Application Metrics: End-to-End Timing, Throughput, Open Connection,…
Total time for End-to-End RTT.

Step 1: Log in to the HI GIO PORTAL as an Organization Administrator and Navigate to

Networking > Edge Gateway > Load Balancer > Pool.

Step 2: Click on “>>” icon beside Pool that you want to monitor.

HI GIO LB support Statistics Chart:

By the time (Past 30 minutes, 6 Hours,….)

How to Use WAF on HI GIO Portal

This document guides how to use WAF on the HI GIO Portal to protect your virtual services from attacks and proactively prevent threats.

Configure Allowlist Rules for a Virtual Service
Edit the WAF Signatures for a Virtual Service

Step 1: Log in to the HI GIO portal, select Networking

Using Distributed Firewall in a Data Center Group

Overview

HI GIO supports a distributed firewall service for data center groups. You create a single default security policy applied to the data center group.

Procedure

To create distributed firewall rules and add them to a data center group, you need to define some things:

Name: Name for the rule.

Source: IP Sets\Dynamic Groups\Static Group (1.1, 1.2, 1.3, 1.4)

Destination: IP Sets\Dynamic Groups\Static Group (1.1, 1.2, 1.3, 1.4)

Application: Select applications with port to apply rule (1.5)

Action: Allow\Reject\Drop

IP Protocol: IPv4/IPv6 or both

Add an IP Set to the Data Center Group:

Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab

Step 2: Click the data center group name

Step 3: Under Security, click IP Sets

Step 4: Click New.

Step 5: Enter a meaningful Name, a Description for IP Sets

Step 6: Enter an IPv4 address, IPv6 address, or an address range in a CIDR format, and click Add.

Step 7: To modify an existing IP address or range, click Modify and edit the value.

Step 8: To confirm, click Save.

Create a Static Security Group:

Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab

Step 2: Click the data center group name

Step 3: Under Security, click Static Groups.

Step 4: Click New.

Step 5: Enter a Name, a Description for the static group, and click Save.

The static security group will appear in the list.

Step 6: Select the newly created static security group and click Manage Members.

Step 7: Select the data center group networks that you want to add to the static security group >> Save

Assign Security Tags to VM:

Security tags you create and assign to virtual machines help you define edge gateway and distributed firewall rules.

Step 1: In the top navigation bar, click Networking.

Step 2: Click Security Tags.

Step 3: Click Add Tag.

Step 4: Enter a tag name.

Step 5: From the list of virtual machines in the organization, select the ones to assign the newly created tag.

Step 6: Click Save.

Create a Dynamic Security Group:

You can define dynamic security groups of virtual machines based on specific criteria (VM Name or Tag Name) to which to apply distributed firewall rules.

Step 1: In the top navigation bar, click Networking and then click the Data Center Groups tab

Step 2: Click the data center group name

Step 3: Under Security, click Dynamic Groups.

Step 4: Click New.

Step 5: Enter a Name and a Description for the dynamic security group.

Step 6: To create a Criterion for inclusion in the group, add up to four rules that apply to a VM Name or a VM security tag.

VM Name: a rule that applies to VM names containing or starting with a term you specify.
VM tag: a rule that applies to VM tags that equal, contain, start with, or end with a term you specify.

As figured out, I created 02 rules