PowerScale OneFS 9.8.0.0 Web Administration Guide

PDF

Firewall policies

The firewall consists of policies that you apply to specified subnets or network pools.

A policy is a collection of rules that filters inbound packets. A rule can filter packets on the protocol, source address, source port, and destination port. Each rule defines an action to take when a packet matches the rule. Each policy also has a defined default action. The available actions are:

allow—Accept the packet.
deny—Silently drop the packet.
reject—Drop the packet and send an error code to the sender.

To make a policy take effect, you associate the policy to one or more network pools or subnets. Use either the Web UI or the isi network firewall policies modify command with the --add-pools or --add-subnets option.

Global policies

The firewall comes with predefined global policies. You can modify the global policies. You can reset the global policies back to their original installed state.

The following table describes the global policies that are installed with OneFS.

Table 1. Global PoliciesThe following table describes each global policy.
Policy	Summary
default_pools_policy	Rules for the inbound default ports for TCP and UDP services in OneFS. For a list of default ports, see the "Network exposure" section in the "Product and Subsystem Security" chapter of the OneFS Security Configuration Guide.
default_subnets_policy	Rules for: DNS port 53 Rule for ICMP Rule for ICMP6

Custom policies

You can create custom policies. As a convenience, you can clone any policy and edit the clone to create a custom policy. You have complete control over the rules in custom policies.