DocsKnowledge BaseAPI Explorer
Documentation›ZVF›ZStack ZSphere›User GuideZVF

Manage Security Groups

A security group is a collection of security rules that control ingress and egress traffic for VM NICs. A VM NIC can join multiple security groups, and the security group priority determines the rule matching order.

Rule Types

Security groups use security rules in the group to control traffic to and from NICs. A security group can contain system rules and custom rules.

  • System rules: After a security group is created, the system provides the following rules by default:
    • Intra-group communication rule: Allows NICs in the same security group to communicate with each other by default. This rule has a higher priority than all custom rules. It cannot be modified or deleted and can only be disabled.
    • Intra-/inter-group communication rule: Allows NICs in the security group to access NICs outside the security group by default. NICs outside the security group are not allowed to access NICs inside the security group by default. This rule supports modifying the default intra-group and inter-group access behavior for individual VM NICs.
  • Custom rules: Rules that users add to the security group.

Rule Elements

Element Description
Direction
  • Ingress rule: Controls traffic that enters the NIC from outside and mainly controls the traffic source.
  • Egress rule: Controls traffic sent out from the NIC and mainly controls the traffic destination.
Target
  • Source: Corresponds to ingress rules and supports IP addresses/ranges or security groups as sources. An ingress rule allows or denies traffic from the specified IP addresses/ranges or security groups.
  • Destination: Corresponds to egress rules and supports IP addresses/ranges or security groups as destinations. An egress rule allows or denies NICs in the current group from accessing the target IP addresses/ranges or NICs in the target security groups.
Action

The following actions can be applied to traffic that matches rule conditions:

  • Allow: Allows network request traffic to flow into or out of the NIC.
  • Deny: Does not allow network request traffic to flow into or out of the NIC.

By default, if traffic to or from the NIC does not match any custom rule, ingress traffic is denied and egress traffic is allowed.
Protocol and Port

The packet protocol and corresponding port targeted by a rule include the following types:

  • ALL: Covers all protocol types. Ports cannot be specified.
  • TCP: Supports ports 1-65535.
  • UDP: Supports ports 1-65535.
  • ICMP: Does not support specifying a port.
Priority The matching order of a security group rule relative to other rules. The supported priority range is 1-100. A larger value indicates a lower priority.

Create Security Groups and Rules

About this task

Before a virtual machine can use a security group, you need to create the security group, add rules to the security group, and associate the security group with VM NICs.

Procedure

  1. Create a security group.
    1. In the target data center, choose Network > Security Group > Create Security Group, and configure the following options.
      Option Description
      Name Enter a name for the security group.
      Description Enter a description for the security group.
    2. Click OK.
  2. Add rules to the security group.
    1. Click the security group name to enter its details page.
    2. On the security group Overview tab, select the Ingress Rule or Egress Rule tab based on the rule direction.
    3. Click Add Rule.
    4. In the Add Ingress Rule/Add Egress Rule dialog, configure the following options:
      Option Description
      Type The traffic direction controlled by the rule, displayed as ingress or egress.
      Priority The effective priority of the rule. The value automatically increases by 1 for each new rule. A larger value indicates a lower priority.
      Policy Specify a policy for the rule. Options include Allow and Reject.
      IP Address Type Specify IPv4 or IPv6.
      Protocol The communication protocol targeted by the rule. ALL, TCP, UDP, and ICMP are supported.
      Port

      When TCP or UDP is selected, specify the ports targeted by the rule.

      • Use the Start Port-End Port format for a port range.
      • Separate multiple ports or port ranges with commas. You can specify up to 10 ports or port ranges.
      Source

      Set this option when adding an ingress rule. It indicates whether to allow or deny access from the specified IP addresses/ranges or security groups.

      • When specifying IP addresses/ranges, you can enter an IP range in the Start IP-End IP format.
      • When specifying IP addresses/ranges, you can enter CIDR notation. If CIDR and other types of IP addresses are specified together, the CIDR mask must be 24 bits. If only CIDR is specified, there is no mask restriction.
      • Separate multiple IP addresses/ranges with commas.
      Destination

      Set this option when adding an egress rule. It indicates whether to allow or deny NICs in the group from accessing the specified IP addresses or security groups.

      • When specifying IP addresses/ranges, you can enter an IP range in the Start IP-End IP format.
      • When specifying IP addresses/ranges, you can enter CIDR notation. If CIDR and other types of IP addresses are specified together, the CIDR mask must be 24 bits. If only CIDR is specified, there is no mask restriction.
      • Separate multiple IP addresses/ranges with commas.
      State Specifies whether to enable the rule immediately after the security group is created. The rule is enabled by default. If it is disabled, NICs in the group do not match this rule until you manually enable it.
      Description Enter a description for the security group rule.
    5. Review the configuration and click OK.
  3. Import or export rules in batch as needed.
    • To add rules in batch, on the security group details page, click Actions > Import Rule and upload a CSV file. Imported rules do not affect existing rules. Their priorities are placed after existing rules by default, and the rules are disabled by default. After importing the rules, you can manually adjust their priorities and enable them. To ensure system compatibility, import files must be edited by using Microsoft Excel.
    • To reuse rules from one security group in another security group, export ingress rules, egress rules, or all rules, and then import them into the target security group.
  4. Associate the security group with VM NICs.
    • To associate the security group with VM NICs in batch, go to the security group VM NIC tab, select the target NICs in batch, and select the network scope to which the security group applies and the target NICs.
    • To associate VM NICs with security groups in batch, go to the target virtual machine Overview tab and use Modify Configuration to associate security groups with VM NICs in batch. The smaller the value corresponding to a security group bound to a virtual machine, the higher the effective priority of the security group.
    Note: If the VM NIC IP address is empty on the platform, the default security group rule, namely the intra-group communication rule, does not take effect for the NIC. Configure security groups properly to avoid rule conflicts between security groups.

Operate Security Groups and Rules

About this task

After creating security groups and rules and binding security groups to VM NICs, you can modify security group state, configuration, bindings, and rule priorities as needed.

  • Enable or disable a security group.
    To modify the enabled or disabled state of a security group, use the Enable or Disable operation.
  • Modify the name and description of a security group.
    In the operation column of the target security group, click Edit Name and Description, and then make changes as needed.
  • Disassociate VM NICs.
    • To disassociate VM NICs from a security group in batch, go to the security group VM NIC page, select the target NICs, and click Disassociate VM NIC.
    • To disassociate security groups from VM NICs in batch, go to the target virtual machine Overview page and use Modify Configuration to unbind security groups from VM NICs in batch.
  • Delete a security group.

    In the operation column of the target security group, click Delete.

    Note: Deleting a security group also deletes custom rules created for the security group. Proceed with caution.
  • Enable or disable a security group rule.
    Go to the target security group Overview page, select the Ingress Rule or Egress Rule tab, and then use the Enable or Disable operation to modify the rule state. The system-default intra-group communication rule can only be disabled.
  • Modify a security group rule.
    In the operation column of the target security group rule, click Edit Rule, and modify the priority, allow or deny policy, protocol and port, source or destination, state, and description as needed.
  • Adjust security group rule priorities.
    Click Adjust Priority, and drag rules to adjust their relative priority order. The priority range is 1-100. A larger value indicates a lower priority.
  • Delete a security group rule.
    Select the target rule and click Delete.
PreviousView Network TopologyNextOverview