Creating Security Group Rules

Security groups and security group rules control what traffic can access the instances. Use the Horizon dashboard GUI or the OpenStack CLI to create security rules or security groups.  Refer to OpenStack documentation or the documentation provided by your OpenStack vendor for more information. 

Prior to instantiating the SBC SWe Cloud on OpenStack, consider adding a rule that enables the ICMP protocol to enable the instance to respond to ping message. In addition to such basic rules, the following tables provide a summary of all the ports used by the SBC SWe Cloud application. Allow access through these ports by adding security rules in the default security group or in another security group you create and associate with the instance. 

Continue to add, delete, or modify security rules after the instance is deployed. 

The fields in the following tables are:

• Direction (initial) - for UDP, this will be BOTH. For TCP, this will be OUTBOUND for clients and INBOUND for servers (to match the direction of the initial connection). 

  These definitions match the way firewall rules are typically defined.

• Ether Type - It is either IPv4 or IPv6. Separate rules are supplied when both IPv4 and IPv6 are supported.
• IP Protocol - UDP or TCP.
• Local Port - an exact port number, or a wildcard. Note that TCP clients usually use an ephemeral local port which is wildcarded.
• Local IP/interface - the local interface or internal object (such as SIP SP)
• Remote Port - an exact port number, or a wildcard. Note that TCP clients usually use an ephemeral local port which is wildcarded.
• Remote Peers - peer type. Use this to set the most constrained remote network prefix. 

The following three tables provide input for security rules grouped by port type.