Firewall

• 1: Overview
• 2: How-to guides
• 2.1: Firewall Logging
• 3: API Reference
• 4: CLI Reference
• 5: Release Note

1 - Overview

Service Overview

Firewall is a virtual logical firewall service that controls traffic occurring from VPC and Load Balancer of Samsung Cloud Platform.

The target resources that can be applied in the Firewall are Internet Gateway, Direct Connect, Load Balancer, and it is possible to manage a safe network by setting rules for communication between VPC and the internet, and VPC and customer network.

When the Firewall is first created, it blocks all Inbound/Outbound traffic according to the default rule (Any Deny).

Users can create Inbound/Outbound rules by specifying IP addresses, ports, and protocols, and only allowed traffic can communicate with the created rules.

Component

The components that make up the Firewall are as follows.

Constraints

The Samsung Cloud Platform’s Firewall has a quota (limit) for the maximum number of rules that can be created by size. When creating a Firewall, it is created with Extra Small by default, and the Firewall size can be changed on the Firewall details page in the Samsung Cloud Platform Console.

Preceding Service

This is a list of services that must be pre-configured before creating the Firewall service. Please refer to the user guide (reference link) below for more information and prepare in advance.

2 - How-to guides

Users can create a Firewall service by entering required information and selecting detailed options through the Samsung Cloud Platform Console.

Creating a Firewall

You can create and use a Firewall service through the Samsung Cloud Platform Console.

To set up Firewall use, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Firewall Service Home page.

2. On the Service Home page, click the prerequisite service to create. You will be redirected to the service creation page.

   • Create VPC: Set up Firewall use for Internet Gateway and Transit Gateway of VPC service.
     • When creating VPC’s Internet Gateway service, set the Use Firewall item to Use. For detailed instructions, refer to Creating Internet Gateway.
     • Create VPC’s Transit Gateway service and apply for the Uplink Firewall associated service. For detailed instructions, refer to Creating Transit Gateway.
   • Create Direct Connet: Set the Use Firewall item to Use when creating the Direct Connet service. For detailed instructions, refer to Creating Direct Connect.
   • Create Load Balancer: Set the Use Firewall item to Use when creating the Load Balancer service. For detailed instructions, refer to Creating Load Balancer.

3. When the prerequisite service creation is complete, check whether the Firewall resource is displayed on the Firewall List.

Checking Firewall Detailed Information

For the Firewall service, you can view and modify the entire resource list and detailed information from the resource management menu.

To check Firewall detailed information, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Firewall Service Home page.
2. On the Service Home page, click Firewall List. You will be redirected to the Firewall List page.
   • On the Firewall List page, you can check the following information.

     Division	Description
     Firewall Name	Automatically created in Firewall prerequisite service type_Firewall format
     Firewall Division	Firewall prerequisite service type (Internet Gateway, Direct Connect, Load Balancer)
     Size	Firewall size selected by user
     VPC Name	VPC name connected to Firewall
     Connection Name	Automatically created in prerequisite service name using Firewall_Firewall format
     Number of Rules	Number of rules in use in the Firewall
     Use Status	Whether Firewall is used (activated) or not used (deactivated) If not used, Any Allow rule is applied and no billing is charged for Firewall
     Status	Displays Firewall status Click the More button to set Use/Not Use

     Table. Firewall resource list items
3. On the Firewall List page, click the resource for which you want to check detailed information. You will be redirected to the Firewall Details page.
   • The Firewall Details page displays status information and additional feature information, and consists of tabs for Detailed Information, Rules, Tags, Operation History.

     Division	Description
     Service Status	Displays Firewall status Creating: Creating Active: Operating Editing: Changing Deploying: Deployment complete Deleting: Deleting Error: Error occurred

     Table. Firewall status information

Detailed Information

On the Firewall List page, you can check the detailed information of the selected resource and modify the information if necessary.

Rules

On the Firewall List page, you can check the rule list of the selected resource and add, modify, or delete rules.

Tags

On the Firewall List page, you can check the tag information of the selected resource, and add, change, or delete tags.

Operation History

On the Firewall List page, you can check the operation history of the selected resource.

Managing Firewall Rules

You can add, modify, or delete Firewall rules.

Creating Rules

You can add Firewall rule information by directly entering it on the Rules tab.

To add a Firewall rule, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Firewall Service Home page.
2. On the Service Home page, click Firewall List. You will be redirected to the Firewall List page.
3. On the Firewall List page, click the resource to which you want to add rules. You will be redirected to the Firewall Details page.
4. On the Firewall Details page, click the Rules tab. You will be redirected to the Rules tab page.
5. On the Rules tab, click the Add Rule button. You will be redirected to the Add Rule page.
6. Enter the required information on the Direct Input tab page.
7. Check the added rule and click the Complete button.

Creating Rules in Batch

To add multiple Firewall rules at once, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Firewall Service Home page.
2. On the Service Home page, click Firewall List. You will be redirected to the Firewall List page.
3. On the Firewall List page, click the resource to which you want to add rules. You will be redirected to the Firewall Details page.
4. On the Firewall Details page, click the Rules tab. You will be redirected to the Rules tab page.
5. On the Rules tab, click the Add Rule button. You will be redirected to the Add Rule page.
6. On the Add Rule page, click the Batch Input Rules tab.
7. Select Rule Position. If you do not select a position, it will be added to the last order of the rules.
8. On Select File, click the Download Form button. The batch input rule Excel file will be downloaded.
9. Enter rule information in the batch input rule Excel file and save it.
10. On Select File, click Attach File to attach the created Excel file and click Add.
    • If the attached Excel file format is different from the registration form or the file is encrypted, it cannot be uploaded.
    • The maximum number of batch registration rules that can be uploaded at once is 100. If the maximum registration rule count is exceeded, it cannot be uploaded.
    • If the maximum rule count set according to the firewall size is exceeded, the file cannot be uploaded.
11. Check whether the entered rules are displayed on the Added Rules list and adjust the order.
12. Check the added rules and click the Complete button.

Modifying Rules

You can select a Firewall rule to check and modify rule information.

To modify a Firewall rule, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Firewall Service Home page.

2. On the Service Home page, click Firewall List. You will be redirected to the Firewall List page.

3. On the Firewall List page, click the resource for which you want to modify rules. You will be redirected to the Firewall Details page.

4. On the Firewall Details page, click the Rules tab. You will be redirected to the Rules tab page.

5. On the Rules tab, click the Modify Rule button. You will be redirected to the Modify Rule page.

   • On the rule modification page, you can set the following items:
     • Activate: Activates the selected rule.
     • Deactivate: Deactivates the selected rule. Deactivated rules are not applied to the prerequisite service.
     • Delete: Deletes the selected rule. When you click delete, it is displayed as Delete Scheduled status in the changes.
     • Cancel Delete: If in delete scheduled status, you can cancel the rule deletion.

6. On the Modify Rule page, click the Edit button for the item to modify. The Modify Rule popup window will open.

7. In the Modify Rule popup window, enter the item to modify and click the Confirm button.

   Division	Required	Description
   Order	-	Order of the rule, order can be changed by clicking Move Up/Move Down in the added rule list
   Rule ID	-	Unique ID value for the rule, cannot be changed
   Rule Index	-	Unique Index value for the rule, can be used for log analysis
   Source Address	Required	Source address registered in the rule Can change by entering multiple addresses up to 128 at once using Comma (,), range (-) in CIDR (IP/Subnet Mask) format
   Destination Address	Required	Destination address to add to the rule Can change by entering multiple addresses up to 128 at once using Comma (,), range (-) in CIDR (IP/Subnet Mask) format
   Type	Required	Set protocol type according to the selected destination address item
   Action	Required	Can change traffic Allow/Deny distinction due to rule Allow: Allow traffic if matches rule Deny: Block traffic if matches rule
   Direction	Required	Can change access direction of traffic based on Firewall registered in the rule Inbound: External → Internal Outbound: Internal → External
   Rule Position	Required	Can change rule position
   Active Status	Required	Whether the rule is active, rule does not operate if in inactive state
   Status	-	Status value for the rule
   Description	Optional	Additional description written by the user

   Table. Firewall rule modification detailed items

8. Check the modified rule and click the Complete button.

Deleting Rules

To delete a Firewall rule, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Firewall Service Home page.
2. On the Service Home page, click Firewall List. You will be redirected to the Firewall List page.
3. On the Firewall List page, click the resource for which you want to modify rules. You will be redirected to the Firewall Details page.
4. On the Firewall Details page, click the Rules tab. You will be redirected to the Rules tab page.
5. On the Rules tab, click the Modify Rule button. You will be redirected to the Modify Rule page.
6. On the Modify Rule page, select the rule to delete and click the Delete button.
   • When the deletion request is completed, it is displayed as Delete Scheduled in the changes item.
   • You can cancel rule deletion by clicking Cancel Delete.
7. On the Modify Rule page, click the Complete button.

Managing Firewall Resources

You can modify the Firewall size and change the log use settings.

Modifying Firewall Size

To modify the Firewall size, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Firewall Service Home page.
2. On the Service Home page, click Firewall List. You will be redirected to the Firewall List page.
3. On the Firewall List page, click the resource to modify. You will be redirected to the Firewall Details page.
4. On the Firewall Details page, click the Edit icon for Size. You will be redirected to the Modify Size popup window.
5. In the Modify Size popup window, select the size to modify and click the Confirm button.

Using Log Storage

To use Firewall log storage, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Service Home page.
2. On the Service Home page, click the Firewall menu. You will be redirected to the Firewall List page.
3. On the Firewall List page, click the resource (Firewall) to use log storage. You will be redirected to the Firewall Details page.
4. On the Firewall Details page, click the Edit icon for Log Storage Status. You will be redirected to the Modify Log Storage Status popup window.
5. In the Modify Log Storage Status popup window, select Use for log storage and click the Confirm button.

Setting Log Storage to Not Use

To set Firewall log storage to not use, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Service Home page.
2. On the Service Home page, click the Firewall menu. You will be redirected to the Firewall List page.
3. On the Firewall List page, click the resource (Firewall) to set log storage to not use. You will be redirected to the Firewall Details page.
4. Click the Modify Log Storage Status button. You will be redirected to the Modify Log Storage Status popup window.
5. In the Modify Log Storage Status popup window, deselect Use for log storage and click the Confirm button.
6. Check the message in the Notification popup window and click the Confirm button.

Setting Firewall to Not Use

The Firewall service cannot be deleted separately. When you delete the prerequisite service, the connected Firewall is also deleted. If you want to maintain the prerequisite service and not use the Firewall, you can change the Firewall to not use status on the Firewall list page.

To set Firewall to not use, follow these steps:

1. Click the All Services > Networking > Firewall menu. You will be redirected to the Service Home page.
2. On the Service Home page, click the Firewall menu. You will be redirected to the Firewall List page.
3. On the Firewall List page, click More > Not Use for the resource to switch to not use.
4. When the use status change is complete, check whether the resource’s use status has changed to not use on the Firewall List page.

2.1 - Firewall Logging

To store Firewall logs, you must first create a bucket in Object Storage to store the logs, set the bucket as the log storage in Firewall Logging, and then set log storage on the Firewall Details page to store Firewall logs in the Object Storage bucket.

To store Firewall logs, set up according to the following order:

1. To store firewall logs, you can create a bucket in Object Storage or use an already created bucket. To create a bucket, refer to Creating Object Storage.
2. To set the bucket as the log storage in Firewall Logging, refer to Using Firewall Logging Log Storage.
3. To set log storage status to Use in Firewall details, refer to Using Firewall Log Storage.

Setting Up Firewall Logging Log Storage

To set the Firewall log storage status to Use, you must first set the log storage in Firewall Logging.

To set up Firewall Logging log storage, follow these steps:

1. Click the All Services > Management > Network Logging > Firewall Logging menu. You will be redirected to the Firewall Logging List page.
2. On the Firewall Logging List page, click the Log Storage Settings button at the top. You will be redirected to the Log Storage Settings popup window.
3. In the Log Storage Settings popup window, select the Log Storage Bucket. When you select a bucket, the Log Storage Path is displayed.
4. In the Log Storage Settings popup window, check the Log Storage Bucket and Log Storage Path, and then click the Confirm button.
5. Check the message in the Notification popup window and click the Confirm button.

Viewing Firewall Logging List

When you set the Firewall Logging log storage bucket, you can view the Firewall Logging list.

To view the Firewall Logging list, follow these steps:

1. Click the All Services > Management > Network Logging > Firewall Logging menu. You will be redirected to the Firewall Logging List page.
2. On the Firewall Logging List page, check the resources in use and log storage targets.

   Division	Description
   Resource ID	Firewall ID
   Storage Target	Firewall name
   Storage Registration Date	Firewall log storage registration date

   Table. Firewall Logging list items

Checking Firewall Logging Detailed Content

Refer to the following content to check the detailed content of stored logs.

Setting Firewall Logging Log Storage to Not Use

You can set the log storage in Firewall Logging to not use.

To set Firewall Logging log storage to not use, follow these steps:

1. Click the All Services > Management > Network Logging > Firewall Logging menu. You will be redirected to the Firewall Logging List page.
2. On the Firewall Logging List page, click the Log Storage Settings button at the top. You will be redirected to the Log Storage Settings popup window.
3. In the Log Storage Settings popup window, select Not Use for the Log Storage Bucket and click the Confirm button.

3 - API Reference

4 - CLI Reference

5 - Release Note

Firewall