This article means to show a simple way to create custom Firewall Tags for the new Contrail Security concept, apply them to an element (Virtual Network or Virtual Machine Interface == Neutron Port), create a Firewall rule that uses them, attach that rule to a Firewall Policy.
A few theoretical steps:
- create custom tag + value
- attach custom tag + value to port (VMI/Neutron Port)
- read default policy management ID
- create firewall rule attached to parent = default policy management ID
- update firewall policy with the previously created firewall rule
This assumes that later we will map (not present in this article) the firewall policy to the Default Application Policy. To eliminate a bit the confusion, Juniper’s Contrail Security has the following structure:
- Application policy
- Default Application Policy = applies everywhere -> we map here 1 or More Firewall Policies
- Custom Application Policy = applies mentioned Firewall Policies just to the elements (VNs/VMIs/Project/etc) where we put the matching application tags
- Firewall policy List of firewall rules that apply.
- Firewall rules