Only ACL allow rules are supported as part of Network ACLs. Default is to block all incoming and all outgoing traffic between tiers and between tiers and various gateways (including Public).  ACL deny rules will be supported. New fields "number"  and "action"will be added to rules to resolve conflicting rules. After rule creation, its number can be modified.

Existing API:

createNetworkAcl: 

• New parameters
  • action (required) - allow/deny
  • number (required) - rule number. ACL rules are ordered by this number
• handle the DB upgrade update order number for existing entries

new API :

replaceNetworkACL:

• Parameters:
  • id (required) - Id of the network ACL 
  • trafficType (optional) - can be ingress/egress (defaulted to ingress if not specified).
  • cidrlist (optional) - List of the coma separated CIDRs for the rule. If not specified, defaulted to 0.0.0.0/0
  • startPort (optional)
  • endPort (optional)
  • protocol (optional). TCP/UDP/ICMP protocol types are supported.
  • icmpType (optional) - type of the icmp message being sent
  • icmpCode (optional) - error code for this icmp message
  • action (optional) - allow/deny
  • number (optional) - rule number 

DB:

New columns in firewall_rules table:

• action (String)
• number (long)

action and number will be mandatory for rule type NetworkACL.

Upgrade:

All existing rules in firewall_rules table of type NetworkACL will have action "allow". Rule number will be sequentially assigned for all rules in each network.