Apply Security Policy to the VM-Series Firewall on NSX-T

Log in to Panorama.
Create security policy rules.
By default, the firewall creates a rule that allows Bidirectional Forwarding Detection (BFD). Do not create a rule that blocks BFD. If BFD is blocked, NSX-T thinks that the firewall is unavailable.
Select
Policies
Security
Prerules
.
Select the
Device Group
that you created for managing the VM-Series firewalls on NSX-T in Create Template Stacks and Device Groups on Panorama.
Click
Add
and enter a
Name
and a
Description
for the rule. In this example, the security rule allows all traffic between the WebFrontEnd servers and the Application servers.
Select the
Source Zone
and
Destination Zone
.
For the
Source Address
and
Destination Address
, select or type in an address, static address group, or region.
The VM-Series firewall on NSX-T does not support dynamic address groups for North-South traffic.
Select the
Application
to allow. In this example, we create an
Application Group
that includes a static group of specific applications that are grouped together.
Click
Add
and select
New Application Group
.
Click
Add
to select the application to include in the group.
Click
OK
to create the application group.
Specify the action—
Allow
or
Deny
—for the traffic, and optionally attach the default security profiles for antivirus, anti-spyware, and vulnerability protection, under Profiles.
Click
Commit
, select
Commit to Panorama
. Click
OK
.
Apply the policies to the VM-Series firewalls on NSX-T.
Click

Commit

Push to Devices

Edit Selections

.

Select the device group and click

OK

.

Select

Force Template Values

. By default, Panorama does not override objects on the firewall with objects on Panorama that share a name. You must select Force Template Values to push policy to the managed firewalls.

Click

Yes

to confirm force template values.

Click

OK

.

Verify that the commit is successful.


(
Optional
) Use template to push a base configuration for network and device configuration such as DNS server, NTP server, Syslog server, and login banner.
Refer to the Panorama Administrator’s Guide for information on using templates.