Filter
Top Products
Enabling Security Groups
153
16.6.3. Enabling Security Groups
In order for security groups to function in a zone, the security groups feature must first be enabled for
the zone. The administrator can do this when creating a new zone, by selecting a network offering that
includes security groups. The procedure is described in Zone Configuration in the Installation Guide.
The administrator can not enable security groups for an existing zone, only when creating a new zone.
16.6.4. Adding a Security Group
A user or administrator can define a new security group.
1. Log in to the CloudPlatform UI as an administrator or end user.
2. In the left navigation, choose Network
3. In Select view, choose Security Groups.
4. Click Add Security Group.
5. Provide a name and description.
6. Click OK.
The new security group appears in the Security Groups Details tab.
7. To make the security group useful, continue to Adding Ingress and Egress Rules to a Security
Group.
16.6.5. Adding Ingress and Egress Rules to a Security Group
1. Log in to the CloudPlatform UI as an administrator or end user.
2. In the left navigation, choose Network
3. In Select view, choose Security Groups, then click the security group you want .
4. To add an ingress rule, click the Ingress Rules tab and fill out the following fields to specify what
network traffic is allowed into VM instances in this security group. If no ingress rules are specified,
then no traffic will be allowed in, except for responses to any traffic that has been allowed out
through an egress rule.
• Add by CIDR/Account. Indicate whether the source of the traffic will be defined by IP address
(CIDR) or an existing security group in a CloudPlatform account (Account). Choose Account if
you want to allow incoming traffic from all VMs in another security group
• Protocol. The networking protocol that sources will use to send traffic to the security group.
TCP and UDP are typically used for data exchange and end-user communications. ICMP is
typically used to send error messages or network monitoring data.
• Start Port, End Port. (TCP, UDP only) A range of listening ports that are the destination for the
incoming traffic. If you are opening a single port, use the same number in both fields.
• ICMP Type, ICMP Code. (ICMP only) The type of message and error code that will be
accepted.
• CIDR. (Add by CIDR only) To accept only traffic from IP addresses within a particular address
block, enter a CIDR or a comma-separated list of CIDRs. The CIDR is the base IP address of
the incoming traffic. For example, 192.168.0.0/22. To allow all CIDRs, set to 0.0.0.0/0.