5.1

About Services and Service Groups
A service is a protocol-port combination and a service group is a combination of two or more services. You
can define firewall rules for services and service groups
For information on creating applications, see “Working with Services and Service Groups,” on page 21.
Designing Security Groups
When creating App Firewall rules, you can create rules based on traffic to or from a specific container that
encompasses all of the resources within that container. For example, you can create a rule to block any traffic
from inside of a cluster that targets a specific destination outside of the cluster. You can create a rule to block
any incoming traffic that is not tagged with a VLAN ID. When you specify a container as the source or
destination, all IP addresses within that container are included in the rule.
A security group is a trust zone that you create and assign resources to for App Firewall protection. Security
groups are containers, like a vApp or a cluster. Security groups enables you to create a container by assigning
resources arbitrarily, such as virtual machines and network adapters. After the security group is defined, you
add the group as a container in the source or destination field of an App Firewall rule. For more information,
see “Grouping Objects,” on page 24.
The security group scope is limited to the resource level at which it is created. For example, if you create a
security group at a datacenter level, the security group is available to be added as a source or destination only
when you create a firewall rule at the datacenter level. If you create a rule for a port group with an independent
namespace within that datacenter, the security group is not available.
About System Defined Rules in App Firewall
The default App Firewall rule allows all traffic to pass through all vShield App instances. The default rule for
L3 traffic appears in the firewall table in the General tab, and the default rule for L2 traffic appears in the
firewall table in the Ethernet tab. The default rule is always at the bottom of the rules table and cannot be
deleted or added to. However, you can change the Action element of each rule from Allow to Block, comments
for the rule, and whether traffic for that rule should be logged.
About General and Ethernet Rules
The App Firewall tab offers multiple sets of configurable rules: Layer 3 (L3) rules (General tab) and Layer 2
(L2) rules (Ethernet tab).
By default, all general and ethernet traffic is allowed to pass. You can configure rules at the datacenter, virtual
wire, and port group with independent namespace levels.
Firewall Rules Precedence
Each vShield App enforces App Firewall rules in top-to-bottom ordering. A vShield App checks each traffic
session against the top rule in the App Firewall table before moving down the subsequent rules in the table.
The first rule in the table that matches the traffic parameters is enforced.
Ethernet rules are enforced before general rules.
vShield Administration Guide
162 VMware, Inc.