Page History

...

NetworkACLs can be added to or removed from the container using APIs createNetworkACL and removeNetworkACL APIs.

API changes

Existing API

...

createNetworkAcl

• New parameters** action (required) - allow/deny** number (required) - rule number. ACL rules are ordered by this number** container_id (optional) - id of the network ACL container
• network_id parameter is not required when container_id is specified.

...

• New parameters** container_id (optional) - id of the network ACL container. Default NetworkACLContainer will be used when not specified. 

new API

updateNetworkACL

• Parameters:**  id (required) - Id of the network ACL** trafficType (optional) - can be ingress/egress (defaulted to ingress if not specified)** cidrlist (optional) - List of the coma separated CIDRs for the rule. If not specified, defaulted to 0.0.0.0/0** startPort (optional)** endPort (optional)** protocol (optional). TCP/UDP/ICMP protocol types are supported** icmpType (optional) - type of the icmp message being sent
  • icmpCode (optional) - error code for this icmp message
  • action (optional) - allow/deny
  • number (optional) - rule number 

...

• success -  True when container is successfully assigned to network, false otherwise

DB

New Tables

1. network_acl_container

• New Columns
  • id (long): auto-generated id
  • uuid (string): auto-generated uuid
  • name: name of the network acl container
  • description: network acl container description

Changes to existing tables

1. firewall_rules

• New Columns
  • action (String) - Action allow/deny
  • number (long) - Rule priority
  • container_id (long) - Id of the container, this ACL is part of

action, number, container_id are mandatory for rule with purpose NetworkACL.

2. networks

• New Columns
  • container_id (long) - network acl container associated with this Tier

Upgrade

For each tier, a new network acl container is created during the upgrade, All ACLs that were assigned to this tier, will be part of the newly created network acl container. If there are no ACLs for any tier, it'll be associated with the default container.

...