Firewall

• 1: Overview
• 2: How-to guides
• 2.1: Firewall Logging
• 2.2: Migration Rules
• 3: API Reference
• 4: CLI Reference
• 5: Release Note

1 - Overview

Service Overview

A firewall is a virtual logical firewall service that controls traffic occurring in the VPC and Load Balancer of Samsung Cloud Platform.

The resources that can be applied in the firewall are Internet Gateway, Direct Connect, and Load Balancer, and you can set rules for communication between the VPC and the Internet, and between the VPC and the customer network, enabling secure network management.

When a firewall is first created, it blocks all inbound and outbound traffic according to the default rule (Any Deny).

Users can specify an IP address, port, and protocol to create inbound/outbound rules, and only traffic permitted by the created rules can communicate.

Component

The components that make up a firewall are as follows.

Constraints

The Firewall of Samsung Cloud Platform has a rule quota (limit) that can be created per size. When creating a Firewall, it is created by default as Extra Small, and you can change the Firewall size on the Firewall Details page of the Samsung Cloud Platform Console.

Preceding Service

This is a list of services that must be pre-configured before creating a Firewall service. Please refer to the user guide (reference link) provided below for details and prepare in advance.

2 - How-to guides

Users can create the Firewall service by entering the required information and selecting detailed options through the Samsung Cloud Platform Console.

Create Firewall

You can create and use a Firewall service in the Samsung Cloud Platform Console.

To enable the firewall, follow these steps.

1. Click the All Services > Networking > Firewall menu. Navigate to the Firewall’s Service Home page.

2. On the Service Home page, click the service you want to create. You will be redirected to the service creation page.

   • VPC Creation: Configure the VPC service’s Internet Gateway and Transit Gateway firewall.
     • When creating a VPC’s Internet Gateway service, set the Use Firewall option to Enabled. For detailed instructions, refer to Create Internet Gateway.
     • Create a Transit Gateway service for the VPC and apply for the associated service of the Uplink Firewall. For detailed instructions, refer to Create Transit Gateway.
   • Direct Connet Creation: When creating a Direct Connect service, set the Firewall Use option to Enabled. For detailed instructions, refer to Direct Connect 생성하기.
   • Load Balancer Creation: When creating a Load Balancer service, set the Firewall Use option to Enabled. For detailed instructions, see Load Balancer Creation.

3. After the prerequisite service creation is complete, verify that the corresponding Firewall resource appears in the Firewall list.

Check firewall detailed information

The Firewall service can view and edit the full resource list and detailed information in the resource management menu.

To view detailed information about the firewall, follow these steps.

1. Click the All Services > Networking > Firewall menu. Go to the Firewall’s Service Home page.
2. On the Service Home page, click Firewall List. You will be taken to the Firewall List page.
   • The Firewall List page shows the information below.

     Category	Detailed description
     Firewall name	Automatically generated in the Firewall pre-service type_Firewall format
     Firewall classification	Firewall pre-service type (Internet Gateway, Direct Connect, Load Balancer)
     Size	User-selected Firewall size
     VPC name	VPC name connected to the firewall
     Connection name	Automatically generate in the format preceding service name_Firewall for services using Firewall.
     Number of rules	Number of rules used on this firewall
     Whether to use	Whether the firewall is used (enabled) or not used (disabled) If not used, the Any Allow rule is applied and no charges are incurred for the firewall
     status	Firewall status display More button can be clicked to set On/Off

     Table. Firewall resource list items
3. On the Firewall List page, click the resource to view detailed information. It navigates to the Firewall Details page.
   • Firewall Details page displays status information and additional feature information, and consists of Details, Rules, Tags, Activity Log tabs.

     Category	Detailed description
     Service status	Firewall status display Creating: In progress Active: Operational Editing: In progress Deploying: Completed Deleting: In progress Error: Occurred

     Table. Firewall status information

Detailed Information

On the Firewall List page, you can view detailed information of the selected resource and, if necessary, edit the information.

Rule

On the Firewall List page, you can view the rule list of the selected resource and add, modify, or delete rules.

tag

Firewall List page lets you view the tag information of the selected resource, and add, modify, or delete it.

Job History

On the Firewall List page, you can view the operation history of the selected resource.

Firewall Rule Management

You can add, modify, or delete firewall rules.

Create Rule

In the Rules tab, you can directly input firewall rule information to add it.

To add a firewall rule, follow the steps below.

1. Click the All Services > Networking > Firewall menu. Navigate to the Firewall’s Service Home page.
2. On the Service Home page, click Firewall List. You will be taken to the Firewall List page.
3. On the Firewall List page, click the resource to which you want to add a rule. You will be taken to the Firewall Details page.
4. On the Firewall Details page, click the Rules tab. You will be taken to the Rules tab page.
5. Click the Add Rule button on the Rules tab. You will be taken to the Add Rule page.
6. Enter the required information on the Manual Input tab page.
7. After checking the added rules, click the Complete button.

| Destination | Required | Destination address type to add to the rule

• Select IP or FQDN

• You can input multiple addresses at once, up to a maximum of 128, using CIDR (IP/Subnet Mask) format with commas (,) and ranges (-)

• Domain names can be entered in bulk using Comma(,) for up to 128 addresses at once

Batch create rules

To add multiple Firewall rules at once, follow these steps.

1. Click the All Services > Networking > Firewall menu. Navigate to the Firewall’s Service Home page.
2. On the Service Home page, click Firewall List. You will be taken to the Firewall List page.
3. On the Firewall List page, click the resource to which you want to add a rule. You will be taken to the Firewall Details page.
4. On the Firewall Details page, click the Rules tab. You will be taken to the Rules tab page.
5. Click the Add Rule button on the Rule tab. You will be taken to the Add Rule page.
6. Add Rule on the Batch Rule Input tab, click it.
7. Please select the rule location. If you do not select a location, it will be added at the very last order of the rule.
8. From File Selection, click the Download Form button. The bulk rule entry Excel file will be downloaded.
9. Enter the rule information into the batch rule input Excel file, then save it.
10. From File Selection, click Attach File to attach the Excel file you created, and click Add.
    • You cannot upload if the attached Excel file format differs from the registration form or if the file is encrypted.
    • You can upload up to 100 batch registration rules at a time. Uploads are not allowed if you exceed the maximum number of registration rules.
    • If the number of rules set for the firewall size is exceeded, you cannot upload the file.
11. Added rule Check that the rule you entered appears in the list and adjust its order.
12. After checking the added rules, click the Complete button.

Modify Rules

You can select a firewall rule to view and edit its information.

To modify firewall rules, follow the steps below.

1. Click the All Services > Networking > Firewall menu. Go to the Service Home page of Firewall.

2. On the Service Home page, click Firewall List. You will be taken to the Firewall List page.

3. Firewall List page, click the resource to edit the rule. You will be taken to the Firewall Details page.

4. On the Firewall Details page, click the Rules tab. You will be taken to the Rules tab page.

5. Click the Edit Rule button on the Rules tab. You will be taken to the Edit Rule page.

   • On the rule edit page, you can configure the items below.
     • Enable: Enables the selected rule.
     • Disabled: Disables the selected rule. Disabled rules are not applied to preceding services.
     • Delete: Delete the selected rule. Clicking Delete will mark the change as Pending Deletion.
     • Cancel Deletion: If it is in a pending deletion state, you can cancel the rule deletion.

6. On the Edit Rule page, click the Edit button for the item you want to modify. The Edit Rule popup will open.

7. Rule Edit Enter the item you want to modify in the popup window and click the Confirm button.

   Category	Required?	Detailed description
   Order	-	The order of rules can be changed by clicking Move Up/Move Down in the added rule list.
   Rule ID	-	Cannot be changed to a unique ID value for the rule
   Rule Index	-	Unique index value for the rule, usable in log analysis
   Source address	Required	Source addresses registered in the rule in CIDR (IP/Subnet Mask) format, using commas (,) and ranges (-), can be entered and modified up to a maximum of 128 at once
   Destination address	Required	Destination address to add to the rule in CIDR (IP/Subnet Mask) format, using commas (,) and ranges (-) to input multiple addresses at once, up to a maximum of 128, for modification
   type	Required	Set the protocol type according to the selected destination address entry
   Operation	Required	Traffic Allow/Deny classification can be changed by rules Allow: Allow traffic when it matches the rule Deny: Block traffic when it matches the rule
   direction	Required	The access direction of traffic defined by the firewall rule can be changed Inbound: external → internal Outbound: internal → external
   Rule location	Required	Rule position can be changed
   Active status	Required	Whether the rule is active; if it is disabled, the rule does not operate.
   status	-	State value for the rule
   description	Select	User-provided additional description

   Table. Detailed items for firewall rule modification

8. After reviewing the updated rules, click the Complete button.

Delete rule

To delete a firewall rule, follow the steps below.

1. Click the All Services > Networking > Firewall menu. Go to the Firewall’s Service Home page.
2. On the Service Home page, click Firewall List. You will be taken to the Firewall List page.
3. Click the resource to edit the rule on the Firewall List page. Navigate to the Firewall Details page.
4. On the Firewall Details page, click the Rules tab. You will be taken to the Rules tab page.
5. In the Rule tab, click the Edit Rule button. You will be taken to the Edit Rule page.
6. On the Edit Rule page, select the rule to delete and click the Delete button.
   • When the deletion request is completed, the change item will be marked as Scheduled for deletion.
   • Click Cancel Deletion to cancel the rule deletion.
7. On the Edit Rule page, click the Complete button.

Managing Firewall Resources

You can modify the firewall size and change the log usage settings.

Modify Firewall Size

To modify the size of the firewall, follow these steps.

1. Click the All Services > Networking > Firewall menu. Go to the Firewall’s Service Home page.
2. On the Service Home page, click Firewall List. You will be taken to the Firewall List page.
3. Click the resource to edit on the Firewall List page. Navigate to the Firewall Details page.
4. On the Firewall Details page, click the Size Edit icon. You will be taken to the Size Edit popup.
5. Resize In the popup window, select the size to adjust, and click the Confirm button.

Using Log Storage

To use firewall log storage, follow these steps.

1. Click the All Services > Networking > Firewall menu. Go to the Service Home page.
2. On the Service Home page, click the Firewall menu. You will be taken to the Firewall List page.
3. Firewall List page, click the resource (Firewall) for which you want to enable log storage. You will be taken to the Firewall Details page.
4. On the Firewall Details page, click the Edit icon of Log Save Setting. You will be taken to the Edit Log Save Setting popup.
5. Modify Log Saving Option In the popup window, select Use for the log repository, and click the Confirm button.

Disable log storage

To set firewall log storage to disabled, follow these steps.

1. Click the All Services > Networking > Firewall menu. You will be taken to the Service Home page.
2. On the Service Home page, click the Firewall menu. You will be taken to the Firewall List page.
3. Firewall List page, click the resource (Firewall) that does not use log storage. You will be taken to the Firewall Details page.
4. Click the Modify Log Save Setting button. You will be taken to the Modify Log Save Setting popup.
5. Modify Log Saving Option In the popup window, deselect Use for the log repository, and click the Confirm button.
6. Notification Check the message in the popup window and click the Confirm button.

Disable Firewall

The Firewall service cannot be deleted on its own. Deleting the preceding service will also delete the associated Firewall. When you choose not to use the firewall while retaining the preceding service, you can set the firewall to an unused state on the firewall list page.

To disable the firewall, follow these steps.

1. Click the All Services > Networking > Firewall menu. You will be taken to the Service Home page.
2. On the Service Home page, click the Firewall menu. You will be taken to the Firewall List page.
3. On the Firewall List page, click More > Unused for the resources you want to mark as unused.
4. After the usage change is completed, verify on the Firewall List page that the resource’s usage status has been changed to unused.

2.1 - Firewall Logging

To store firewall logs, first create a bucket in Object Storage for the logs and configure that bucket in the log repository of Firewall Logging. Then, on the Firewall Details page, set up log storage, and the firewall logs will be saved to the Object Storage bucket.

To save firewall logs, configure it according to the following steps.

1. To store firewall logs, you can create a bucket in Object Storage or use an existing bucket. To create a bucket, refer to Create Object Storage.
2. To set the bucket for the Firewall Logging log repository, refer to Firewall Logging 로그 저장소 사용하기.
3. To set the log storage option to Enabled in the detailed view of the Firewall, refer to Using Firewall Log Storage.

Firewall Logging Configure log storage usage

To set the firewall’s log storage to enabled, you must first configure the log repository in Firewall Logging.

To enable the Firewall Logging log repository, follow these steps.

1. Click the All Services > Management > Network Logging > Firewall Logging menu. Go to the Firewall Logging List page.
2. On the Firewall Logging List page, click the top Log Storage Settings button. You will be taken to the Log Storage Settings popup.
3. Log storage settings In the popup window, select the log storage bucket. When you select a bucket, the log storage path is displayed.
4. Log storage settings In the popup window, after verifying Log storage bucket and Log storage path, click the Confirm button.
5. Notification After reviewing the popup message, click the Confirm button.

View Firewall Logging List

If you configure the Firewall Logging log storage bucket, you can view the Firewall Logging list.

To view the Firewall Logging list, follow these steps.

1. Click the All Services > Management > Network Logging > Firewall Logging menu. You will be taken to the Firewall Logging List page.
2. On the Firewall Logging List page, verify the resources in use and the log storage targets.

   Category	Detailed description
   Resource ID	Firewall ID
   Save target	Firewall name
   Save registration date and time	Firewall log repository registration timestamp

   Table. Firewall Logging list items

Check detailed information of Firewall Logging

Refer to the information below to view the detailed contents of the stored log.

Firewall Logging Configure to not use log storage

In Firewall Logging, you can set the log repository to unused.

Firewall Logging To disable the log repository, follow the steps below.

1. Click the All Services > Management > Network Logging > Firewall Logging menu. You will be taken to the Firewall Logging List page.
2. Firewall Logging List page, click the top Log Storage Settings button. You will be taken to the Log Storage Settings popup.
3. Log storage settings In the popup window, select Log storage bucket as Not used, and click the Confirm button.

2.2 - Migration Rules

Users can retrieve rules created in the V1 environment of the Samsung Cloud Platform Console and apply them to the V2 service.

Get firewall rules

You can import rules created in the V1 environment of the Samsung Cloud Platform Console and migrate them to the V2 service for use.

To retrieve the V1 firewall rules, follow these steps.

1. All Services > Networking > Firewall Click the menu. 1. Navigate to the Service Home page of the Firewall.

2. On the Service Home page, click the Migration Rules menu. 2. Go to the Migration Rules page.

3. Select the rule information to retrieve from the Migration Rules page and click Done.

   Category	Detailed description
   Original rule environment	SCP v1 (Vmware) Auto-select
   Applicable target	Select the Firewall list in the account to which the transferred rule will be applied
   Get rules	Click the File Attachment button to upload the decrypted Firewall rule file After decrypting and saving the rule file extracted from the original environment, upload
   Rule List	View uploaded Firewall rule file details Move Up: Move the selected rule up in the list Move Down: Move the selected rule down in the list Delete: Delete the selected rule Edit: Modify the selected rule information; see Edit Transferable Firewall Rule for details
   Rule location	Set the position of the selected firewall rule After the last rule: Move the selected rule after the last rule Set before the specified rule / Set after the specified rule: Enter the rule ID to move the selected rule before or after the specified rule

   Table. Migration Rules detailed items

4. After the firewall rule transfer request is completed, verify that the transferred item has been added to the firewall list.

Modify the Firewall rule to be transferred

You can edit each item when retrieving rules created in the V1 environment of the Samsung Cloud Platform Console.

To edit the Firewall rules to be imported from V1, follow these steps.

1. Click the All Services > Networking > Firewall menu. 1. Navigate to the Service Home page of the Firewall.

2. On the Service Home page, click the Migration Rules menu. 2. Go to the Migration Rules page.

3. Click Attach file in the rule import item to upload the Firewall rule file.

4. In the rule list, click Edit for the rule item you want to modify.

   Category	Required or not	Detailed description
   origin address	Essential	Source addresses to add to the rule in CIDR (IP/Subnet Mask) format, using commas (,), ranges (-) to input multiple addresses, up to a maximum of 128 at once
   Destination address	Essential	Select the type of destination address to add to the rule IP: In CIDR (IP/Subnet Mask) format, you can enter multiple addresses at once using commas (,) and ranges (-), up to a maximum of 128. Domain: In FQDN format, you can enter up to 128 full domain names at once using commas (,). The type items vary depending on the selected destination address format.
   type	Required	Select protocol type to which the rule will be applied Select destination port/Type: Select protocol type Internet Protocol: Enter protocol numbers, up to 128 entries allowed All: Select destination port/Type and protocol for the entire range, meaning all ports for all protocols
   Type > Protocol	Required	Select detailed protocol for the type Select the desired protocol among TCP, UDP, and ICMP; input fields vary depending on the selected protocol When ICMP is selected in the protocol, you can set the ICMP Type Select a commonly used Type, such as Echo, from the values defined for ICMP Type Click the Add button to add an input value When TCP/UDP is selected in the protocol, you can select allowed ports such as SSH, HTTP, TELNET, etc. When entering manually, you can input values from 1 to 65535, and you can enter up to 128 entries at once using commas (,) or ranges (-) Click the Add button to add an input value When Internet Protocol is selected in the type 1 - 254Enter the protocol number within the range
   Operation	Required	Traffic allow/block classification by rule Allow: Allow traffic when it matches the rule Deny: Block traffic when it matches the rule
   Direction	Essential	Firewall standard traffic direction Inbound: external → internal Outbound: internal → external
   Active status	Required	Set rule activation status If disabled, the rule does not execute
   Explanation	Selection	Additional description written by the user

   Table. Detailed items of the Firewall rule edit window

5. When the rule information edit is complete, click Confirm in the edit window.

6. Review the modified rule information and click Done.

3 - API Reference

4 - CLI Reference

5 - Release Note

Firewall