Apply Security Policies to the VM-Series
Firewall on NSX-T (East-West)
Now that you have defined the steering rules, you can now use Panorama for centrally administering policies on the VM-Series firewalls.
To manage centralized policy, attach the dynamic address group as a source or destination address in security policy and push it to the firewalls; the firewalls can dynamically retrieve the IP addresses of the virtual machines that are included in each security group to enforce compliance for traffic that originates from or is destined to the virtual machines in the specified group.
- Create security policy rules.
- Select theDevice Groupthat you created for managing the VM-Series firewalls on NSX-T in Create Template Stacks and Device Groups on Panorama.
- ClickAddand enter aNameand aDescriptionfor the rule. In this example, the security rule allows all traffic between the WebFrontEnd servers and the Application servers.
- Select theSource ZoneandDestination Zone. The zone name must be the same in both columns.
- For theSource AddressandDestination Address, select or type in an address, address group or region. In this example, we select an address group, the Dynamic address group you created previously.
- Select theApplicationto allow. In this example, we create anApplication Groupthat includes a static group of specific applications that are grouped together.
- ClickAddand selectNew Application Group.
- ClickAddto select the application to include in the group.
- ClickOKto create the application group.
- Specify the action—AlloworDeny—for the traffic, and optionally attach the default security profiles for antivirus, anti-spyware, and vulnerability protection, under Profiles.
- Repeats the steps above to create the pertinent policy rules.
- ClickCommit, select Commit Type asPanorama. ClickOK.
- Apply the policies to the VM-Series firewalls for NSX-T.
- ClickCommit, and select Commit TypeDevice Groups.
- Select the device group, NSX-T Device Group in this example and clickOK.
- Verify that the commit is successful.
- Validate that the members of the dynamic address group are populated on the VM-Series firewall.
- From Panorama, switch device context to launch the web interface of a firewall to which you pushed policies.
- On the VM-Series firewall, select, and select a rule.PoliciesSecurity
- Select the drop-down arrow next to the address group link, and selectInspect. You can also verify that the match criteria is accurate.
- Click themorelink and verify that the list of registered IP addresses is displayed.Policy will be enforced for all IP addresses that belong to this address group, and are displayed here.
- (Optional) Use template to push a base configuration for network and device configuration such as DNS server, NTP server, Syslog server, and login banner.
- Create a Zone Protection profile and attach it to a zone.A zone protection profile provides flood protection and has the ability to protect against port scanning, port sweeps and packet-based attacks. It allows you to secure intra-tier and inter-tier traffic between virtual machines within your data center and traffic from the Internet that is destined to the virtual machines (workloads) in your data center.
- Select yourTemplate.
- Selectto add and configure a new profile.NetworkNetwork ProfilesZone Protection
- Select, click the default-zone listed and select the profile in theNetworkZonesZone Protection Profiledrop down.
- Create a DoS Protection profile and attach it to DoS Protection policy rule.
- Select yourDevice Group.
- Selectto add and configure a new profile.ObjectsSecurity ProfilesDoS Protection
- A classified profile allows the creation of a threshold that applies to a single source IP. For example, you can configure a max session rate for an IP address that matched the policy, and then block that single IP address once the threshold is triggered.
- An aggregate profile allows the creation of a max session rate for all packets matching the policy. The threshold applies to new session rate for all IP addresses combined. Once the threshold is triggered it affects all traffic that matches the policy.
- Create a new DoS Protection policy rule inand attach the new profile to it.PolicyDoS Protection,
Recommended For You
Recommended videos not found.