You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by ra...@apache.org on 2013/08/07 10:39:28 UTC
git commit: updated refs/heads/master to 7c1eed5
Updated Branches:
refs/heads/master 1d9465d75 -> 7c1eed51a
CLOUDSTACK-2685
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/7c1eed51
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/7c1eed51
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/7c1eed51
Branch: refs/heads/master
Commit: 7c1eed51a7fc589c15e53b82ae25d473c3b1cd86
Parents: 1d9465d
Author: Radhika PC <ra...@citrix.com>
Authored: Wed Aug 7 14:06:22 2013 +0530
Committer: Radhika PC <ra...@citrix.com>
Committed: Wed Aug 7 14:06:55 2013 +0530
----------------------------------------------------------------------
docs/en-US/egress-firewall-rule.xml | 58 ++++++++++++++++++--------------
1 file changed, 33 insertions(+), 25 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/7c1eed51/docs/en-US/egress-firewall-rule.xml
----------------------------------------------------------------------
diff --git a/docs/en-US/egress-firewall-rule.xml b/docs/en-US/egress-firewall-rule.xml
index 148b6d6..17bf15e 100644
--- a/docs/en-US/egress-firewall-rule.xml
+++ b/docs/en-US/egress-firewall-rule.xml
@@ -21,29 +21,39 @@
<section id="egress-firewall-rule">
<title>Egress Firewall Rules in an Advanced Zone</title>
<para>The egress traffic originates from a private network to a public network, such as the
- Internet. By default, the egress traffic is blocked, so no outgoing traffic is allowed from a
- guest network to the Internet. However, you can control the egress traffic in an Advanced zone
- by creating egress firewall rules. When an egress firewall rule is applied, the traffic specific
- to the rule is allowed and the remaining traffic is blocked. When all the firewall rules are
- removed the default policy, Block, is applied.</para>
- <para>Egress firewall rules are supported on Juniper SRX and virtual router.</para>
- <note>
- <para>The egress firewall rules are not supported on shared networks.</para>
- </note>
- <para>Consider the following scenarios to apply egress firewall rules:</para>
- <itemizedlist>
- <listitem>
- <para>Allow the egress traffic from specified source CIDR. The Source CIDR is part of guest
- network CIDR.</para>
- </listitem>
- <listitem>
- <para>Allow the egress traffic with destination protocol TCP,UDP,ICMP, or ALL.</para>
- </listitem>
- <listitem>
- <para>Allow the egress traffic with destination protocol and port range. The port range is
- specified for TCP, UDP or for ICMP type and code.</para>
- </listitem>
- </itemizedlist>
+ Internet. By default, the egress traffic is blocked in default network offerings, so no outgoing
+ traffic is allowed from a guest network to the Internet. However, you can control the egress
+ traffic in an Advanced zone by creating egress firewall rules. When an egress firewall rule is
+ applied, the traffic specific to the rule is allowed and the remaining traffic is blocked. When
+ all the firewall rules are removed the default policy, Block, is applied.</para>
+ <section id="prereq-egress">
+ <title>Prerequisites and Guidelines</title>
+ <para>Consider the following scenarios to apply egress firewall rules:</para>
+ <itemizedlist>
+ <listitem>
+ <para>Egress firewall rules are supported on Juniper SRX and virtual router.</para>
+ </listitem>
+ <listitem>
+ <para>The egress firewall rules are not supported on shared networks.</para>
+ </listitem>
+ <listitem>
+ <para>Allow the egress traffic from specified source CIDR. The Source CIDR is part of guest
+ network CIDR.</para>
+ </listitem>
+ <listitem>
+ <para>Allow the egress traffic with protocol TCP,UDP,ICMP, or ALL.</para>
+ </listitem>
+ <listitem>
+ <para>Allow the egress traffic with protocol and destination port range. The port range is
+ specified for TCP, UDP or for ICMP type and code.</para>
+ </listitem>
+ <listitem>
+ <para>The default policy is Allow for the new network offerings, whereas on upgrade existing
+ network offerings with firewall service providers will have the default egress policy
+ Deny.</para>
+ </listitem>
+ </itemizedlist>
+ </section>
<section>
<title>Configuring an Egress Firewall Rule</title>
<orderedlist>
@@ -154,7 +164,5 @@
allowed.</para>
</listitem>
</orderedlist>
- <para>On upgrade existing network offerings with firewall service providers will have the
- default egress policy DENY.</para>
</section>
</section>