Configuring firewall policies
The existing policy package on the Hubs do not account for inter-regional communication. Two rules are expanded and one new rule is defined.
We must also update the Hub firewall policy.
Following is a summary of how to configure the firewall policy:
- Create three normalized interfaces for the two BGP loopback interfaces and the hub to hub zone. See Creating interfaces.
These loopback interfaces are used for eBGP peering.
- Edit 2 rules to include the inter-regional zone. See Editing rules.
This allows communication between the zones.
- Define a new rule to permit the inter-regional BGP sessions using the normalized bgp loopback interfaces. See Defining a new rule.
BGP session traffic must be explicitly permitted since it uses different interfaces than other traffic.
- Deploy the updated policy package. See Deploying updated policy package.
Creating interfaces
- Navigate to Policy & Objects > Object Configurations, and add the new Normalized Interfaces mapped to the newly created loopback interfaces (lo-BGP_INET, lo-BGP_MPLS), as well as for the zone hub2hub-overlay:
Editing rules
To edit rules:
- Edit the Edge-Edge and Edge-Hub firewall rules in the Hub policy package, adding the new inter-regional zone to them, in order to permit inter-regional communication:
Name
From
To
Src
Dst
Service
NAT
Action
Edge- Edge
overlay hub2hub - overlay
overlay hub2hub - overlay
CORP_LAN
CORP_LAN
ALL
No
Accept Edge-hub lan overlay hub2hub - overlay
lan overlay hub2hub - overlay
CORP_LAN
CORP_LAN
ALL
No
Accept
Defining a new rule
To define a new rule:
- Add a new firewall rule, in order to permit inter-regional BGP sessions.
Use the following options for the multi-region firewall rule:
Option
Setting
From lo-BGP_INET lo-BGP_MPLS hub2hub-overlay To lo-BGP_INET lo-BGP_MPLS hub2hub-overlay Src
all
Dst
all
Service
PING
BGP
NAT
No
Action
Accept
Deploying updated policy package
To deploy the updated policy package:
- Reinstall policy on all the Hubs.
