Oracle Cloud Infrastructure Documentation

Managing a Network Firewall's Security Attributes

Add, update, and remove security attributes associated with a network firewall.

You can use Zero Trust Packet Routing (ZPR) along with or in place of network security groups to manage network access to OCI resources . To do this, define ZPR policies that govern how resources communicate with each other, and then add security attributes to those resources. For more information, see Zero Trust Packet Routing.

Prerequisites

You can apply security attributes to a network firewall when you create it, or apply them to an existing network firewall. For more information, see Create a Firewall.

ZPR security attributes added to a network firewall are always configured as the Enforce mode.

Caution

If an endpoint has a Zero Trust Packet Routing (ZPR) security attribute, traffic to the endpoint must satisfy ZPR policies and also all NSG and security list rules. For example, if you're already using NSGs and you add a security attribute to an endpoint, all traffic to the endpoint is blocked. From then onward, a ZPR policy must explicitly allow traffic to the endpoint.

  • Adding Security Attributes

    The following steps describe how to add security attributes to an existing network firewall in the Console. To add security attributes to a network firewall you're creating, see Create a Firewall.
    1. On the Network Firewall list page, select the network firewall that you want to work with. If you need help finding the list page or the network firewall, see List Firewalls.
    2. From the Actions menu for the firewall you want, select Manage security attributes.
    3. In the Manage security attributes panel, select Add security attributes.
    4. Enter the following information:
      • Namespace: Select a security attribute namespace from the list. A security attribute namespace is a container for a set of security attributes in Zero Trust Packet Routing (ZPR). This list contains those security attribute namespaces already configured. See Creating a Security Attribute Namespace for more information.
      • Key: Select a key from the list.
      • Value: Enter a value for the corresponding key. This is the value for a specific security attribute
    5. Select Add security attribute to add another attribute (to a maximum of three).
    6. Select Update. The security attributes appear on the Security tab of the network firewall's details page.

    Editing Security Attributes

    1. On the Network Firewall list page, select the network firewall that you want to work with. If you need help finding the list page or the network firewall, see List Firewalls.
    2. From the Actions menu for the firewall you want, select Manage security attributes.
    3. In the Manage security attributes panel, edit the security attributes.
    4. Select Update.

    Deleting Security Attributes

    1. On the Network Firewall list page, select the network firewall that you want to work with. If you need help finding the list page or the network firewall, see List Firewalls.
    2. From the Actions menu for the firewall you want, select Manage security attributes.
    3. In the Manage security attributes panel, select the Delete row button to remove the security attribute.
    4. Select Update.
      Note

      You can also manage security attributes for a network firewall from the Security tab on its details page.

  • Adding Security Attributes

    Use the security-attributes option and specify its values when running the network-firewall network-firewall create command to add ZPR security attributes to a network firewall.

    oci network-firewall network-firewall create ... --security-attributes security_attributes

    where security_attributes are ZPR security attributes for the firewall.

    For example:

    oci network-firewall network-firewall create ... --security-attributes {"oracle-zpr":{"td":{"value":"42","mode":"enforce"}}}

    For information about creating a network firewall using the CLI, see Create a Firewall.

    For a complete list of flags and variable options for CLI commands, see the Command Line Reference.

    Editing Security Attributes

    Use the security-attributes option and specify the updated values when running the network-firewall network-firewall update command to update existing ZPR security attributes.

    oci network-firewall network-firewall update ... --security-attributes security_attributes

    where security_attributes are ZPR security attributes for the network firewall.

    Deleting Security Attributes

    Use the security-attributes option with an empty map "{}" when running the network-firewall network-firewall update command to remove ZPR security attributes. For example:

    oci network-firewall network-firewall update ... --security-attributes {}

  • Adding Security Attributes

    Run the CreateNetworkFirewall operation to add security attributes to a network firewall. Include the securityAttributes attribute and specify its values.

    Editing Security Attributes

    Run the UpdateNetworkFirewall operation to update a network firewall. Include the securityAttributes attribute and update its existing values.

    Deleting Security Attributes

    Run the UpdateNetworkFirewall operation to update a network firewall. Include the securityAttributes attribute with an empty map.