5.1

Planning App Firewall Rule Enforcement
Using App Firewall, you can configure allow and block rules based on your network policy.
The following examples represent two common firewall policies:
Allow all traffic by
default
You keep the default allow all rules and add block rules based on Flow
Monitoring data or manual App Firewall rule configuration. In this scenario,
if a session does not match any of the block rules, vShield App allows the traffic
to pass.
Block all traffic by
default
You can change the Action status of the default rules from Allow to Block, and
add allow rules explicitly for specific systems and applications. In this scenario,
if a session does not match any of the allow rules, vShield App drops the session
before it reaches its destination. If you change all of the default rules to block
any traffic, vShield App drops all incoming and outgoing traffic.
Working with Firewall Rules
You can configure and publish L3 and L2 firewall rules before or after installing an application. Once an
application is installed, the last published firewall rules are applied.
Add a Firewall Rule
You can add a firewall rule at various container (datacenter, virtual wire, port group with independent
namespace) levels. Adding multiple objects per rule at the source and destination levels helps you reduce the
total number of firewall rules to be created.
Procedure
1 In the vSphere Client, select a datacenter, virtual wire, or port group with an independent namespace.
Firewall Rule Level Method
Datacenter
a Go to Inventory > Hosts and Clusters.
b Select a datacenter.
c Click the vShield tab.
Virtual wire
a Go to Inventory > Hosts and Clusters and select the Network
Virtualization tab.
b Click the Networks tab.
c In the Name column, click the virtual wire for which you want to add a
rule.
d Click the Security tab.
Port group with an independent
namespace
a Go to Inventory > Networking.
b Select a Port group with an independent namespace.
c Click the vShield tab.
Chapter 13 vShield App Firewall Management
VMware, Inc. 163