Oracle Cloud Infrastructure Documentation

Add a Tunnel Inspection Rule to a Firewall Policy

Tunnel inspection rules contain a set of criteria against which a network packet is matched and then inspected.

Before you can create a tunnel inspection rule, you must create address lists.

The specified source and destination match condition for the traffic consists of lists that you configure in the policy before you construct the rule. You can create a maximum of 500 tunnel inspection rules for each policy.

When the specified source and destination match condition is met, the firewall applies a default Palo Alto Networks® tunnel inspection profile. The profile has the following characteristics, and isn't editable:

  • Protocol: VXLAN
  • Maximum Tunnel Inspection Levels: One level of encapsulation is inspected
  • Return scanned VXLAN tunnel to source: True. Returns the encapsulated packet to the originating VXLAN tunnel endpoint (VTEP).
    1. Open the navigation menu, and select Identity & Security. Under Firewalls, select Network Firewall policies.
    2. Select the compartment that contains the firewall policy that you want to add a tunnel inspection rule to.
    3. Select the policy.
    4. On the details page, select the Rules tab.
    5. From within the Tunnel inspection rules table, select Create tunnel inspection rule.
    6. In the Name field, enter a name for the tunnel inspection rule. Avoid entering confidential information.
    7. (Optional) In the Description field, enter a brief summary of the tunnel inspection rule.
      Use this field to provide details about the tunnel inspection rule to help other users understand its purpose or configuration. You can enter up to 1,000 characters and can edit this field at any time.
    8. Under Match condition, specify the source and destination addresses that must match for the tunnel inspection rule to apply.
      • Under Source addresses:
        • Select Any source address matches the rule if the rule applies to traffic from any source address.
        • Select Create or select a list of source addresses to match the rule to apply the rule only to traffic from specific source addresses, then select an existing address list or create a new one by selecting Create address list from the Actions menu. To learn how to create an address list, see Create an Address List.
      • Under Destination addresses:
        • Select Any destination address matches the rule if the rule applies to traffic from any destination address.
        • Select Create or select a list of destination addresses to match the rule to apply the rule only to traffic from specific destination addresses, then select an existing address list or create a new one by selecting Create address list from the Actions menu. To learn how to create an address list, see Create an Address List.
    9. Under Rule action, specify the action that you want to take if the match condition is met:
      • Inspect: Performs tunnel inspection on matching traffic.
      • Inspect and capture log: Performs tunnel inspection on matching traffic and generates logs for the tunnel session.
    10. Under Rule order, select the position of the rule in relation to other tunnel inspection rules in the policy. The firewall applies the tunnel inspection rules in the specified order from first to last.
      • Select First rule in list to evaluate this rule before the existing tunnel inspection rules.
      • Select Last rule in list to evaluate this rule after the existing tunnel inspection rules.
      Note

      Custom position is enabled only if you create more than one tunnel inspection rule. If you select it, specify whether you want this rule to come before an existing rule or after an existing rule. Then, specify the rule that you want the new rule to come before or after.
    11. Select Create.

  • Use the network-firewall tunnel-inspection-rule create command and required parameters to create a tunnel inspection rule:

    oci network-firewall tunnel-inspection-rule create --name my_tunnel-inspection_rule --network-firewall-policy-id network firewall policy OCID
--condition '[{"sourceAddress":"IP_address"},{"destinationAddress":"IP_address"}]' ...[OPTIONS]

    For a complete list of parameters and values for CLI commands, see the CLI Command Reference.

  • Run the <<<API LINK PLACEHOLDER>> operation to create a tunnel inspection rule.