Create a defense rule

Prerequisites

You have created both a source network object and a destination network object. For more information, see Create a network object.

Procedure

1. Log on to the Security Center console.Log on to the Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Microsegmentation.

3. On the Container Microsegmentation page, click the Protection Management tab.

4. In the cluster list on the Protection Management tab, find the target cluster and click Rule Management in the Actions column.

5. In the Defense Rule panel, click Create Rule.

6. In the Create Rule panel, create a defense rule for the cluster.

   1. Configure the source network object.

      Configure the following parameters:

      • Rule Name: Enter a name for the defense rule.

      • Network Object: Select the source network object, which is the origin of the traffic.

   2. Click Next.

   3. Configure the destination network object.

      Configure the following parameters:

      Parameter	Description
      Network Object	Select the destination of the traffic.
      Port	Enter the destination port range. Note You can specify up to 8 non-overlapping port ranges. Separate multiple ranges with commas (,), for example: 20/30,80/90.
      Action	Select the action to take on matching traffic. Valid values: Block: Block the traffic. Alert: Allow the traffic and generate alerts. Allow: Allow the traffic without generating alerts.
      Status	The status of the defense rule. Valid values: Enable: The rule takes effect immediately after creation. Close: The rule is inactive after creation.
      Priority	Set the priority of the defense rule. Valid values: 1 to 1000. A lower value indicates a higher priority.

7. Click OK.

   The new rule appears in the defense rule list in descending order of priority (highest priority first). New rules are disabled by default. You must enable a rule for it to take effect. For more information, see Manage the defense status and defense rules of a cluster.

   After defense rules are enabled, the cluster's rules are evaluated in the priority order you specified when creating the rules.

   Important

   If the first rule in the list does not match, the system continues to check the next rule in sequence until a match is found, at which point the corresponding action is applied. If no rule matches, container microsegmentation allows the traffic by default.

Video tutorial

The following video demonstrates the complete process of using Container Microsegmentation, including how to create network objects, create defense rules, and test the effectiveness of the rules.