Security Group
In traditional data centers, networks divide into trusted zones, DMZ zones, and untrusted zones. Perimeter firewalls enforce traffic control to ensure network security. In virtualized data centers, perimeter firewalls may struggle to handle scenarios such as network isolation between different tenants and access control between different services within the same tenant flexibly. Therefore, ZSphere introduces a new component: security group. A security group is a distributed firewall focused on controlling east-west traffic and supports inbound and outbound traffic control at the virtual machine NIC level.
- The set of security group rules: supports the addition, deletion, and modification of rules to control rule actions.
- The set of associated NICs: supports associating VM NICs with the security group so that its rules apply to those NICs.
- Default policies: If no rules are added, except communication between group members, the security group denies all inbound traffic by default, and allows all outbound traffic.
- Rule flexibility: Rules support on-demand modification, including source IP, destination IP, destination port, protocol type, and priority.
- Dynamic priority adjustment: When adding a rule, you can insert it at a specific priority. When removing a rule, priorities automatically adjust to remain consecutive.
- Multiple security groups per NIC: A VM NIC can be associated with multiple security groups. You can dynamically adjust the priority of these groups. By default, rules in the security group associated first take effect first.
How It Works
- Composition of a security group:
- Source: Supports source data (for inbound direction) and destination data (for outbound direction).
- Address Type: Supports IPv4 and IPv6.
- Protocol Type and Port: Supports ICMP, TCP, UDP, and more.
- Action: Deny or allow.
- Priority of security group rules:
- Rule priority is a consecutive and unique (priority 0 indicates the highest priority by default). Lower priority numbers indicate higher precedence.
- By default, newly added rules have the lowest priority. When inserting a rule at a specified priority, subsequent rule priorities adjust automatically to ensure uniqueness.
- When traffic passes through a virtual machine NIC, matching starts from the rule with the highest priority. If a match succeeds, the rule action executes. Otherwise, matching continues with the next rule.
- Import and export of security group rules:
- Existing rules support one-click export.
- Exported rules supports re-importing into other security groups with rule validation provided during import.
- Associating multiple security groups to a NIC:
- A VM NIC can be associated with multiple security groups. The associated groups support priority ordering. A lower number indicates a higher group priority.
- When traffic passes through the virtual machine NIC, matching starts from the security group with the highest priority. If a rule within that group match succeeds, the rule action executes. Otherwise, matching proceeds to the next security group.
- NIC default policy:
- By default, the NIC's default inbound policy is Allow, and the default outbound policy is Deny. These default policies support modification.
- When traffic does not match any security group rule, the NIC's default policy executes.
Applications
- Access control among different businesses.Take a typical web application as an example.
- Allow any IP address to access TCP ports 80 and 443 on the Web virtual machines.
- Allow the Web virtual machines to access TCP port 8080 on the App virtual machines.
- Allow the App virtual machines to access TCP port 3306 on the DB virtual machines.
Create separate security groups for the three service tiers (Web, App, and DB) and configure the corresponding rules to control access between the tiers.
See Figure 1 for an illustration.Figure 1. Access Control for Different Businesses 
- Coexistence of multiple services. In addition to application traffic, the VMs in the preceding example must allow administrative access over SSH. You can implement this access in either of the following ways:
- Option 1: Add a new rule to each of the three security groups.
- Option 2: Create a new security group and associate it to the NICs of all the above business virtual machines.
Because a VM NIC can be associated with multiple security groups, the second option provides more flexible control. Each service VM NIC can use one security group for application traffic and another for administrative access, with group priorities and default rules adjusted as needed.
- Disabling communication within a security group.
By default, VMs in the same security group can communicate without being restricted by security group rules. To isolate VMs within the same group, disable the Allow Intra-Group Traffic default rule. This rule cannot be deleted.