FirewallRule

FirewallRule
FirewallRule

Describes a Firewall rule.

JSON Example 
{
    "id": "string",
    "name": "string",
    "description": "string",
    "sourceFirewallGroups": [
        {
            "name": "string",
            "id": "string"
        }
    ],
    "sourceFirewallIpAddresses": [
        "string"
    ],
    "destinationFirewallGroups": [
        {
            "name": "string",
            "id": "string"
        }
    ],
    "destinationFirewallIpAddresses": [
        "string"
    ],
    "applicationPortProfiles": [
        {
            "name": "string",
            "id": "string"
        }
    ],
    "ipProtocol": {},
    "action": {},
    "actionValue": "string",
    "direction": {},
    "logging": false,
    "networkContextProfiles": [
        {
            "name": "string",
            "id": "string"
        }
    ],
    "enabled": false,
    "version": {
        "version": 0
    },
    "comments": "string",
    "appliedTo": {
        "name": "string",
        "id": "string"
    },
    "loggingId": "string",
    "relativePosition": {
        "adjacentRuleId": "string",
        "rulePosition": "string"
    }
}
string
id
Optional

The unique id of this firewall rule. If a rule with the ruleId is not already present, a new rule will be created. If it already exists, the rule will be updated.

string
name
Required

Name for the rule.

string
description
Optional

description

array of EntityReference
sourceFirewallGroups
Optional

List of source groups for firewall rule. It specifies the sources of network traffic for the firewall rule. Null values in both this property and sourceFirewallIpAddresses will be treated as "ANY" For Distributed Firewall rules, an entry with an id of urn:vcloud:firewallGroup:internal can be used to specify all internal vDC Group network traffic.

array of string
sourceFirewallIpAddresses
Optional

List of source IP addresses, IP Ranges, or CIDRs. This specifies the source of the traffic which the firewall rule will be applied to Null values in both this property and sourceFirewallGroups will be treated as "ANY"

array of EntityReference
destinationFirewallGroups
Optional

List of destination groups for firewall rule. It specifies the destinations of network traffic for the firewall rule. Null values in both this property and destinationFirewallIpAddresses will be treated as "ANY" For Distributed Firewall rules, an entry with an id of urn:vcloud:firewallGroup:internal can be used to specify all internal vDC Group network traffic.

array of string
destinationFirewallIpAddresses
Optional

List of destination IP addresses, IP ranges, or CIDRs. This specifies the destination of the traffic which the firewall rule will be applied to Null values in both this property and destinationFirewallGroups will be treated as "ANY"

array of EntityReference
applicationPortProfiles
Optional

The list of application ports where this firewall rule is applicable. Null value or an empty list will be treated as "ANY" which means rule applies to all ports.

FirewallRuleIpProtocol
ipProtocol
Optional

Specifies the IP protocol for the network packet that should be matched while enforcing the rule. IPV4_IPV6 means both IPV4 and IPV6 packet type.

Possible values are : IPV4, IPV6, IPV4_IPV6,
FirewallRuleAction
action
Optional

Defines the firewall rule action to be applied.

Possible values are : ALLOW, DROP,
string
actionValue
Optional

The action to be applied to all the traffic that meets the firewall rule criteria. It determines if the rule permits or blocks traffic. Property is required if action is not set. Below are valid values.

  • ALLOW permits traffic to go through the firewall.
  • DROP blocks the traffic at the firewall. No response is sent back to the source.
  • REJECT blocks the traffic at the firewall. A response is sent back to the source.
FirewallRuleDirection
direction
Optional

Defines direction of traffic for firewall rule.

Possible values are : IN, OUT, IN_OUT,
boolean
logging
Optional

Whether packet logging is enabled for firewall rule.

array of EntityReference
networkContextProfiles
Optional

The list of layer 7 network context profiles where this firewall rule is applicable. Null value or an empty list will be treated as "ANY" which means rule applies to all applications and domains.

boolean
enabled
Optional

Whether the firewall rule is enabled.

ObjectVersion
version
Optional

This property describes the current version of the entity. To prevent clients from overwriting each other's changes, update operations must include the version which can be obtained by issuing a GET operation. If the version number on an update call is missing, the operation will be rejected. This is only needed on update calls.

string
comments
Optional

Text for user entered comments on the firewall rule. Length cannot exceed 2048 characters.

EntityReference
appliedTo
Optional

Entity reference used to describe VCD entities

string
loggingId
Optional

Unique ID assigned by the backing NSX-T network provider. Passed all the way down to the datapath, and is used for logging by NSX-T. Only applies to NSX-T.

FirewallRuleRelativePosition
relativePosition
Optional

Defines a relative position to place a firewall rule.

Availability
Added in 34.0
Used By