Only ACL allow rules are supported as part of Network ACLs. Default is to block all incoming and all outgoing traffic between tiers and between tiers and various gateways (including Public).  ACL deny rules will be supported. New fields "number"  and "action"will be added to rules to resolve conflicting rules. After rule creation, its number can be modified. NetworkACLs will be evaluated in the order of its number.starting from lowest. Action of the matching rule is applied.  

NetworkACLContainer

NetworkACLContainer is a set of NetworkACLs that can be assigned to any vpc tier. Instead of adding NetworkACLs directly to the tier,  NetworkACLs will be added to the NetworkACLContainer. NetworkACLContainer can be assigned to multiple vpc tiers. Each tier can be associated with only one NetworkACLContainer. 

Default NetworkACLContainer

Each tier upon creation will be associated with default NetworkACLContainer.

Add/Remove networkACL to container

NetworkACLs can be added or removed from the container using APIs addACLtoContainer, removeACLfromContainer 

Existing API:

createNetworkAcl: 

• New parameters** action (required) - allow/deny
  • number (required) - rule number. ACL rules are ordered by this number

new API :

replaceNetworkACL:

• Parameters:
  • id (required) - Id of the network ACL 
  • trafficType (optional) - can be ingress/egress (defaulted to ingress if not specified)
  • cidrlist (optional) - List of the coma separated CIDRs for the rule. If not specified, defaulted to 0.0.0.0/0
  • startPort (optional)
  • endPort (optional)
  • protocol (optional). TCP/UDP/ICMP protocol types are supported
  • icmpType (optional) - type of the icmp message being sent
  • icmpCode (optional) - error code for this icmp message
  • action (optional) - allow/deny
  • number (optional) - rule number 

DB:

New columns in firewall_rules table:

• action (String)
• number (long)

action and number will be mandatory for rule type NetworkACL.

Upgrade:

All existing rules in firewall_rules table of type NetworkACL will have action "allow". Rule number will be sequentially assigned for all rules in each network.