> ## Documentation Index > Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt > Use this file to discover all available pages before exploring further. # Network Firewall > Network Firewall APIs with Cloud Adapter. This page describes how Network Firewall maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior. ## Supported environments * Azure * Google Cloud * OCI Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available. ## How the backends compare Each row compares a capability of Network Firewall with its adaptation on each backend. A dash means this profile does not state the capability for that backend. ### Cloud Adapter | Capability | Network Firewall | Azure | Google Cloud | OCI | | - | - | - | - | - | | 5-tuple stateful rules · protocol / CIDR / port allow-deny | Yes | Partial - network rule collections; Allow evaluated before Deny | Partial - INGRESS policy rules with L4 match | Partial - security rules over address lists + TCP services; no protocol | | Domain allowlists · TLS SNI / HTTP Host | Yes | Yes - application\_rule\_collection destination\_fqdns | Yes - match dest\_fqdns (Cloud NGFW FQDN objects) | Yes - url\_list + a security rule condition | | Suricata rule strings · IDS/IPS signatures | Yes | No - not translated; re-create in Azure Firewall Premium IDPS yourself | No - not translated; configure Cloud NGFW security profiles yourself | No - not translated; configure OCI intrusion detection yourself | | TLS inspection · decrypt + inspect | Yes | Partial - Azure Firewall Premium TLS inspection, a separate surface | Partial - Cloud NGFW TLS inspection policy, a separate surface | Partial - OCI decryption profiles / rules, a separate surface | | Flow / alert logging | Yes | Partial - Azure Firewall diagnostic logs, not a translated rule | Partial - rule enable\_logging + Cloud Logging, not a translated rule | Partial - OCI Network Firewall logging, not a translated rule | | VPC inspection routing · endpoint + route tables | Yes | Partial - AzureFirewallSubnet + route tables wired by the operator | - | - | | API coverage | full | partial | partial | partial | | VPC inspection routing · policy association + endpoint | Yes | - | Partial - policy-to-network association wired by the operator | - | | VPC inspection routing · subnet + route tables | Yes | - | - | Partial - firewall subnet + route tables wired by the operator | ## On Azure ### Azure Firewall | Operation | Area | Support | Depth | Notes | | - | - | - | - | - | | Suricata rule strings | Advanced rules | Out of scope | Most usage | Suricata rule strings (rules\_source.rules\_string) are not supported. The build creates no Azure rule for them and warns. Azure Firewall Premium IDPS is the closest feature; you re-create the detections there yourself. | | TLS inspection | Advanced rules | Out of scope | Full surface | TLS inspection is not supported. The build does not recreate aws\_networkfirewall\_tls\_inspection\_configuration and warns; Azure Firewall Premium TLS inspection is the closest feature, which you enable yourself. | | Flow / alert logging | Observability | Out of scope | Full surface | aws\_networkfirewall\_logging\_configuration is replaced by Azure Firewall's own diagnostic-log surface, not a translated rule | | 5-tuple stateful rules | Rule translation | Partial | Common | Each stateful\_rule becomes a rule in a network\_rule\_collection with the same protocol, source and destination addresses and destination port. Azure sets allow or deny per collection, so the build splits rules into an Allow and a Deny collection, and Azure evaluates Allow rules before Deny rules whatever their AWS order. Alert becomes Allow, reject becomes Deny, and a source-port match is dropped. | | Domain allowlists / denylists | Rule translation | Supported | Most usage | a rules\_source\_list (TLS\_SNI / HTTP\_HOST targets) maps onto an application\_rule\_collection rule with destination\_fqdns; a leading-dot AWS wildcard becomes an Azure \*.domain wildcard | | Stateless 5-tuple rules | Rule translation | Out of scope | Most usage | Stateless rules are not supported. A stateless rule group, including custom actions such as publishMetricAction, creates no Azure rule, and the traffic it handled falls to Azure Firewall's own default. The build warns; re-create those rules on Azure. | | VPC inspection routing | Traffic steering | Partial | Common | the firewall + policy + rules emit; the inspection subnet (AzureFirewallSubnet) + route-table steering is deployment-specific and wired by the operator (surfaced, never assumed) | #### How it works Your Network Firewall setup (the firewall, its policy and the rule groups the policy references) is translated when the stack is built. The build creates an Azure Firewall, an Azure Firewall Policy and a rule collection group that holds the translated rules. Your workloads and their routes do not change; only the firewall that inspects the traffic is different. Azure Firewall is a managed, stateful firewall, like Network Firewall. Microsoft runs it, so once it is deployed it inspects traffic itself and Tensor9 is not in the path. Stateful 5-tuple rules and domain lists become Azure rules. Suricata signatures, TLS inspection and flow logging have no Azure rule form; you set them up on Azure Firewall Premium and Azure Monitor, as described below. ![On AWS, a workload subnet routes traffic through a Network Firewall endpoint, which inspects it before it reaches the internet. On Azure, the same subnet routes through an Azure Firewall that the build creates. Azure Firewall inspects the traffic itself; Tensor9 is not in the path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIGEgd29ya2xvYWQgc3VibmV0IHJvdXRlcyB0cmFmZmljIHRocm91Z2ggYSBOZXR3b3JrIEZpcmV3YWxsIGVuZHBvaW50LCB3aGljaCBpbnNwZWN0cyBpdCBiZWZvcmUgaXQgcmVhY2hlcyB0aGUgaW50ZXJuZXQuIE9uIEF6dXJlLCB0aGUgc2FtZSBzdWJuZXQgcm91dGVzIHRocm91Z2ggYW4gQXp1cmUgRmlyZXdhbGwgdGhhdCB0aGUgYnVpbGQgY3JlYXRlcy4gQXp1cmUgRmlyZXdhbGwgaW5zcGVjdHMgdGhlIHRyYWZmaWMgaXRzZWxmOyBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcGF0aC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHJlY3QgeD0iMTYiIHk9IjQ2IiB3aWR0aD0iMzkyIiBoZWlnaHQ9IjEzNCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjgiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9Ijg4IiB3aWR0aD0iMTEwIiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijg1IiB5PSIxMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+V29ya2xvYWQ8L3RleHQ+Cjx0ZXh0IHg9Ijg1IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5zdWJuZXQ8L3RleHQ+CjxsaW5lIHgxPSIxNDAiIHkxPSIxMjEiIHgyPSIxOTYiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mYTEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMTY4IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPnJvdXRlPC90ZXh0Pgo8cmVjdCB4PSIyMDAiIHk9Ijg4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjI3NSIgeT0iMTE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+TmV0d29yayBGaXJld2FsbDwvdGV4dD4KPHRleHQgeD0iMjc1IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5lbmRwb2ludCwgaW5zcGVjdHM8L3RleHQ+CjxsaW5lIHgxPSIzNTAiIHkxPSIxMjEiIHgyPSIzOTYiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mYTEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMzc0IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPndlYjwvdGV4dD4KPHJlY3QgeD0iNDI4IiB5PSI0NiIgd2lkdGg9IjM5MiIgaGVpZ2h0PSIxMzQiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NDIiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBBWlVSRTwvdGV4dD4KPHJlY3QgeD0iNDQyIiB5PSI4OCIgd2lkdGg9IjExMCIgaGVpZ2h0PSI2NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0OTciIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5Xb3JrbG9hZDwvdGV4dD4KPHRleHQgeD0iNDk3IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5zdWJuZXQ8L3RleHQ+CjxsaW5lIHgxPSI1NTIiIHkxPSIxMjEiIHgyPSI2MDgiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mYTEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNTgwIiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPnJvdXRlPC90ZXh0Pgo8cmVjdCB4PSI2MTIiIHk9Ijg0IiB3aWR0aD0iMTUwIiBoZWlnaHQ9Ijc0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjY4NyIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPkF6dXJlIEZpcmV3YWxsPC90ZXh0Pgo8dGV4dCB4PSI2ODciIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+KyBwb2xpY3ksIGluc3BlY3RzPC90ZXh0Pgo8bGluZSB4MT0iNzYyIiB5MT0iMTIxIiB4Mj0iODA4IiB5Mj0iMTIxIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZmExKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9Ijc4NiIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij53ZWI8L3RleHQ+CjxkZWZzPjxtYXJrZXIgaWQ9Im5mYTEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+Cjwvc3ZnPg==) ![On AWS, a workload subnet routes traffic through a Network Firewall endpoint, which inspects it before it reaches the internet. On Azure, the same subnet routes through an Azure Firewall that the build creates. Azure Firewall inspects the traffic itself; Tensor9 is not in the path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIGEgd29ya2xvYWQgc3VibmV0IHJvdXRlcyB0cmFmZmljIHRocm91Z2ggYSBOZXR3b3JrIEZpcmV3YWxsIGVuZHBvaW50LCB3aGljaCBpbnNwZWN0cyBpdCBiZWZvcmUgaXQgcmVhY2hlcyB0aGUgaW50ZXJuZXQuIE9uIEF6dXJlLCB0aGUgc2FtZSBzdWJuZXQgcm91dGVzIHRocm91Z2ggYW4gQXp1cmUgRmlyZXdhbGwgdGhhdCB0aGUgYnVpbGQgY3JlYXRlcy4gQXp1cmUgRmlyZXdhbGwgaW5zcGVjdHMgdGhlIHRyYWZmaWMgaXRzZWxmOyBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcGF0aC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHJlY3QgeD0iMTYiIHk9IjQ2IiB3aWR0aD0iMzkyIiBoZWlnaHQ9IjEzNCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGIiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9Ijg4IiB3aWR0aD0iMTEwIiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijg1IiB5PSIxMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+V29ya2xvYWQ8L3RleHQ+Cjx0ZXh0IHg9Ijg1IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5zdWJuZXQ8L3RleHQ+CjxsaW5lIHgxPSIxNDAiIHkxPSIxMjEiIHgyPSIxOTYiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mYTEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMTY4IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPnJvdXRlPC90ZXh0Pgo8cmVjdCB4PSIyMDAiIHk9Ijg4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjI3NSIgeT0iMTE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+TmV0d29yayBGaXJld2FsbDwvdGV4dD4KPHRleHQgeD0iMjc1IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5lbmRwb2ludCwgaW5zcGVjdHM8L3RleHQ+CjxsaW5lIHgxPSIzNTAiIHkxPSIxMjEiIHgyPSIzOTYiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mYTEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMzc0IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPndlYjwvdGV4dD4KPHJlY3QgeD0iNDI4IiB5PSI0NiIgd2lkdGg9IjM5MiIgaGVpZ2h0PSIxMzQiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NDIiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBBWlVSRTwvdGV4dD4KPHJlY3QgeD0iNDQyIiB5PSI4OCIgd2lkdGg9IjExMCIgaGVpZ2h0PSI2NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0OTciIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5Xb3JrbG9hZDwvdGV4dD4KPHRleHQgeD0iNDk3IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5zdWJuZXQ8L3RleHQ+CjxsaW5lIHgxPSI1NTIiIHkxPSIxMjEiIHgyPSI2MDgiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mYTEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNTgwIiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPnJvdXRlPC90ZXh0Pgo8cmVjdCB4PSI2MTIiIHk9Ijg0IiB3aWR0aD0iMTUwIiBoZWlnaHQ9Ijc0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjY4NyIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPkF6dXJlIEZpcmV3YWxsPC90ZXh0Pgo8dGV4dCB4PSI2ODciIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+KyBwb2xpY3ksIGluc3BlY3RzPC90ZXh0Pgo8bGluZSB4MT0iNzYyIiB5MT0iMTIxIiB4Mj0iODA4IiB5Mj0iMTIxIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZmExKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9Ijc4NiIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij53ZWI8L3RleHQ+CjxkZWZzPjxtYXJrZXIgaWQ9Im5mYTEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+Cjwvc3ZnPg==) Your workloads and routes stay as they are; an Azure Firewall inspects the traffic instead of Network Firewall. #### What the build creates The build creates an Azure Firewall at the Standard tier (`AZFW_VNet`) with a public IP, attached to an Azure Firewall Policy. The policy holds one rule collection group. Stateful 5-tuple rules go into network rule collections, and domain lists go into application rule collections. The firewall is placed in the `AzureFirewallSubnet` of your virtual network, which is a deployment input. Azure sets allow or deny on a whole rule collection, not on each rule. The build therefore splits each kind of rule by action into an allow collection and a deny collection. The allow collection gets the lower priority number, so Azure evaluates allow rules before deny rules, whatever their order in the AWS rule group. ![The build creates an Azure Firewall in the AzureFirewallSubnet with a public IP. It is attached to an Azure Firewall Policy, which holds one rule collection group with network rule collections and application rule collections.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI2IiB2aWV3Qm94PSIwIDAgODM2IDIyNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYnVpbGQgY3JlYXRlcyBhbiBBenVyZSBGaXJld2FsbCBpbiB0aGUgQXp1cmVGaXJld2FsbFN1Ym5ldCB3aXRoIGEgcHVibGljIElQLiBJdCBpcyBhdHRhY2hlZCB0byBhbiBBenVyZSBGaXJld2FsbCBQb2xpY3ksIHdoaWNoIGhvbGRzIG9uZSBydWxlIGNvbGxlY3Rpb24gZ3JvdXAgd2l0aCBuZXR3b3JrIHJ1bGUgY29sbGVjdGlvbnMgYW5kIGFwcGxpY2F0aW9uIHJ1bGUgY29sbGVjdGlvbnMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxyZWN0IHg9IjE2IiB5PSIzNCIgd2lkdGg9IjgwNCIgaGVpZ2h0PSIxNzYiIHJ4PSIxNiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkFaVVJFIFZORVQ8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI3NCIgd2lkdGg9IjE5NiIgaGVpZ2h0PSIxMTgiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMTMyIiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTIuNXB4Ij5BenVyZSBGaXJld2FsbDwvdGV4dD4KPHRleHQgeD0iMTMyIiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPkFaRldfVk5ldCwgU3RhbmRhcmQ8L3RleHQ+Cjx0ZXh0IHg9IjEzMiIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+QXp1cmVGaXJld2FsbFN1Ym5ldDwvdGV4dD4KPHRleHQgeD0iMTMyIiB5PSIxNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj4rIHB1YmxpYyBJUDwvdGV4dD4KPGxpbmUgeDE9IjIzMCIgeTE9IjEzMyIgeDI9IjI4NiIgeTI9IjEzMyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZhMikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIyNTgiIHk9IjEyNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+cG9saWN5PC90ZXh0Pgo8cmVjdCB4PSIyOTAiIHk9Ijc0IiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjExOCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzODAiIHk9IjExOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5GaXJld2FsbCBQb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjM4MCIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+aG9sZHMgdGhlIHJ1bGVzPC90ZXh0Pgo8bGluZSB4MT0iNDcwIiB5MT0iMTMzIiB4Mj0iNTI2IiB5Mj0iMTMzIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZmEyKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjQ5OCIgeT0iMTI0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5ydWxlczwvdGV4dD4KPHJlY3QgeD0iNTMwIiB5PSI3NCIgd2lkdGg9IjI3MiIgaGVpZ2h0PSIxMTgiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNjY2IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5SdWxlIGNvbGxlY3Rpb24gZ3JvdXA8L3RleHQ+CjxyZWN0IHg9IjU0NiIgeT0iMTEyIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2NjYiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTUiPm5ldHdvcmsgcnVsZSBjb2xsZWN0aW9uczwvdGV4dD4KPHJlY3QgeD0iNTQ2IiB5PSIxNTAiIHdpZHRoPSIyNDAiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjY2NiIgeT0iMTY5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NSI+YXBwbGljYXRpb24gcnVsZSBjb2xsZWN0aW9uczwvdGV4dD4KPGRlZnM+PG1hcmtlciBpZD0ibmZhMiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNi41IiBtYXJrZXJIZWlnaHQ9IjYuNSIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPC9zdmc+) ![The build creates an Azure Firewall in the AzureFirewallSubnet with a public IP. It is attached to an Azure Firewall Policy, which holds one rule collection group with network rule collections and application rule collections.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI2IiB2aWV3Qm94PSIwIDAgODM2IDIyNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYnVpbGQgY3JlYXRlcyBhbiBBenVyZSBGaXJld2FsbCBpbiB0aGUgQXp1cmVGaXJld2FsbFN1Ym5ldCB3aXRoIGEgcHVibGljIElQLiBJdCBpcyBhdHRhY2hlZCB0byBhbiBBenVyZSBGaXJld2FsbCBQb2xpY3ksIHdoaWNoIGhvbGRzIG9uZSBydWxlIGNvbGxlY3Rpb24gZ3JvdXAgd2l0aCBuZXR3b3JrIHJ1bGUgY29sbGVjdGlvbnMgYW5kIGFwcGxpY2F0aW9uIHJ1bGUgY29sbGVjdGlvbnMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxyZWN0IHg9IjE2IiB5PSIzNCIgd2lkdGg9IjgwNCIgaGVpZ2h0PSIxNzYiIHJ4PSIxNiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkFaVVJFIFZORVQ8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI3NCIgd2lkdGg9IjE5NiIgaGVpZ2h0PSIxMTgiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMTMyIiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTIuNXB4Ij5BenVyZSBGaXJld2FsbDwvdGV4dD4KPHRleHQgeD0iMTMyIiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPkFaRldfVk5ldCwgU3RhbmRhcmQ8L3RleHQ+Cjx0ZXh0IHg9IjEzMiIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+QXp1cmVGaXJld2FsbFN1Ym5ldDwvdGV4dD4KPHRleHQgeD0iMTMyIiB5PSIxNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij4rIHB1YmxpYyBJUDwvdGV4dD4KPGxpbmUgeDE9IjIzMCIgeTE9IjEzMyIgeDI9IjI4NiIgeTI9IjEzMyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZhMikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIyNTgiIHk9IjEyNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+cG9saWN5PC90ZXh0Pgo8cmVjdCB4PSIyOTAiIHk9Ijc0IiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjExOCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzODAiIHk9IjExOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5GaXJld2FsbCBQb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjM4MCIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+aG9sZHMgdGhlIHJ1bGVzPC90ZXh0Pgo8bGluZSB4MT0iNDcwIiB5MT0iMTMzIiB4Mj0iNTI2IiB5Mj0iMTMzIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZmEyKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjQ5OCIgeT0iMTI0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5ydWxlczwvdGV4dD4KPHJlY3QgeD0iNTMwIiB5PSI3NCIgd2lkdGg9IjI3MiIgaGVpZ2h0PSIxMTgiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNjY2IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5SdWxlIGNvbGxlY3Rpb24gZ3JvdXA8L3RleHQ+CjxyZWN0IHg9IjU0NiIgeT0iMTEyIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2NjYiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTEiPm5ldHdvcmsgcnVsZSBjb2xsZWN0aW9uczwvdGV4dD4KPHJlY3QgeD0iNTQ2IiB5PSIxNTAiIHdpZHRoPSIyNDAiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjY2NiIgeT0iMTY5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMSI+YXBwbGljYXRpb24gcnVsZSBjb2xsZWN0aW9uczwvdGV4dD4KPGRlZnM+PG1hcmtlciBpZD0ibmZhMiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNi41IiBtYXJrZXJIZWlnaHQ9IjYuNSIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPC9zdmc+) One firewall, one policy, and one rule collection group that holds the translated rules. #### How the rules translate **Stateful 5-tuple rules.** Each rule keeps its protocol, source and destination addresses and destination port. TCP, UDP and ICMP stay as they are, and an `IP` or `ANY` protocol becomes `Any`. An `ANY` or `0.0.0.0/0` address, and an `ANY` port, become `*`. Pass and alert rules become allow rules; drop and reject rules become deny rules. **Domain lists.** Each domain list becomes an application rule whose destination FQDNs are the list's domains: an allow rule for an allowlist, a deny rule for a denylist. A list that matches on TLS SNI becomes an HTTPS rule on port 443; a list that matches only on the HTTP Host header becomes an HTTP rule on port 80. A leading-dot entry such as `.example.com` becomes `*.example.com`. ![Stateful 5-tuple rules become network rules, and a domain allowlist becomes application rules. A group of Suricata rules is not translated; the closest Azure feature is Premium intrusion detection, which you enable yourself.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJTdGF0ZWZ1bCA1LXR1cGxlIHJ1bGVzIGJlY29tZSBuZXR3b3JrIHJ1bGVzLCBhbmQgYSBkb21haW4gYWxsb3dsaXN0IGJlY29tZXMgYXBwbGljYXRpb24gcnVsZXMuIEEgZ3JvdXAgb2YgU3VyaWNhdGEgcnVsZXMgaXMgbm90IHRyYW5zbGF0ZWQ7IHRoZSBjbG9zZXN0IEF6dXJlIGZlYXR1cmUgaXMgUHJlbWl1bSBpbnRydXNpb24gZGV0ZWN0aW9uLCB3aGljaCB5b3UgZW5hYmxlIHlvdXJzZWxmLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8dGV4dCB4PSIzMCIgeT0iMzIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPkFXUyBSVUxFIEdST1VQUzwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9IjQ0IiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ2IiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPnN0YXRlZnVsIDUtdHVwbGUgcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjQ2IiB5PSI4MiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnRjcCAxMC4wLjAuMC8xNiDihpIgYW55OjQ0MyBwYXNzPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iMTAyIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ2IiB5PSIxMjQiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5kb21haW4gYWxsb3dsaXN0PC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iMTQwIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+LmV4YW1wbGUuY29tICAoVExTX1NOSSk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSIxNjAiIHdpZHRoPSIzMDAiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNmZWNhY2EiLz4KPHRleHQgeD0iNDYiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPlN1cmljYXRhIHJ1bGUgc3RyaW5nPC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iMTk4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+YWxlcnQgdGNwIGFueSBhbnkgLSZndDsgLi4uPC90ZXh0Pgo8bGluZSB4MT0iMzM2IiB5MT0iNjciIHgyPSI0NzAiIHkyPSI2NyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZhMykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8bGluZSB4MT0iMzM2IiB5MT0iMTI1IiB4Mj0iNDcwIiB5Mj0iMTI1IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZmEzKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxsaW5lIHgxPSIzMzYiIHkxPSIxODMiIHgyPSI0NzAiIHkyPSIxODMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHJva2UtZGFzaGFycmF5PSI0IDMiIG1hcmtlci1lbmQ9InVybCgjbmZhM3IpIiBzdHlsZT0ic3Ryb2tlOiNkYzI2MjYiLz4KPHRleHQgeD0iNDAzIiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHg7ZmlsbDojZGMyNjI2Ij5ub3QgdHJhbnNsYXRlZDwvdGV4dD4KPHRleHQgeD0iNDc2IiB5PSIzMiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+QVpVUkUgUE9MSUNZPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9IjQ0IiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5MiIgeT0iNjYiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5uZXR3b3JrIHJ1bGUgY29sbGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSI4MiIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+VENQICAxMC4wLjAuMC8xNiDihpIgKiAgcG9ydHMgNDQzPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9IjEwMiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0OTIiIHk9IjEyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPmFwcGxpY2F0aW9uIHJ1bGUgY29sbGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSIxNDAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPkh0dHBzICBmcWRuICouZXhhbXBsZS5jb208L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iMTYwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ5MiIgeT0iMTgyIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+UHJlbWl1bSBJRFBTPC90ZXh0Pgo8dGV4dCB4PSI0OTIiIHk9IjE5OCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnlvdSBlbmFibGUgaXQgb24gUHJlbWl1bTwvdGV4dD4KPGRlZnM+CjxtYXJrZXIgaWQ9Im5mYTMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj4KPG1hcmtlciBpZD0ibmZhM3IiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNkYzI2MjYiLz48L21hcmtlcj4KPC9kZWZzPgo8L3N2Zz4=) ![Stateful 5-tuple rules become network rules, and a domain allowlist becomes application rules. A group of Suricata rules is not translated; the closest Azure feature is Premium intrusion detection, which you enable yourself.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJTdGF0ZWZ1bCA1LXR1cGxlIHJ1bGVzIGJlY29tZSBuZXR3b3JrIHJ1bGVzLCBhbmQgYSBkb21haW4gYWxsb3dsaXN0IGJlY29tZXMgYXBwbGljYXRpb24gcnVsZXMuIEEgZ3JvdXAgb2YgU3VyaWNhdGEgcnVsZXMgaXMgbm90IHRyYW5zbGF0ZWQ7IHRoZSBjbG9zZXN0IEF6dXJlIGZlYXR1cmUgaXMgUHJlbWl1bSBpbnRydXNpb24gZGV0ZWN0aW9uLCB3aGljaCB5b3UgZW5hYmxlIHlvdXJzZWxmLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8dGV4dCB4PSIzMCIgeT0iMzIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPkFXUyBSVUxFIEdST1VQUzwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9IjQ0IiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ2IiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPnN0YXRlZnVsIDUtdHVwbGUgcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjQ2IiB5PSI4MiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnRjcCAxMC4wLjAuMC8xNiDihpIgYW55OjQ0MyBwYXNzPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iMTAyIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ2IiB5PSIxMjQiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5kb21haW4gYWxsb3dsaXN0PC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iMTQwIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+LmV4YW1wbGUuY29tICAoVExTX1NOSSk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSIxNjAiIHdpZHRoPSIzMDAiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM3ZjFkMWQiLz4KPHRleHQgeD0iNDYiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPlN1cmljYXRhIHJ1bGUgc3RyaW5nPC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iMTk4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+YWxlcnQgdGNwIGFueSBhbnkgLSZndDsgLi4uPC90ZXh0Pgo8bGluZSB4MT0iMzM2IiB5MT0iNjciIHgyPSI0NzAiIHkyPSI2NyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZhMykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8bGluZSB4MT0iMzM2IiB5MT0iMTI1IiB4Mj0iNDcwIiB5Mj0iMTI1IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZmEzKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxsaW5lIHgxPSIzMzYiIHkxPSIxODMiIHgyPSI0NzAiIHkyPSIxODMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHJva2UtZGFzaGFycmF5PSI0IDMiIG1hcmtlci1lbmQ9InVybCgjbmZhM3IpIiBzdHlsZT0ic3Ryb2tlOiNmODcxNzEiLz4KPHRleHQgeD0iNDAzIiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHg7ZmlsbDojZjg3MTcxIj5ub3QgdHJhbnNsYXRlZDwvdGV4dD4KPHRleHQgeD0iNDc2IiB5PSIzMiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+QVpVUkUgUE9MSUNZPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9IjQ0IiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQ5MiIgeT0iNjYiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5uZXR3b3JrIHJ1bGUgY29sbGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSI4MiIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+VENQICAxMC4wLjAuMC8xNiDihpIgKiAgcG9ydHMgNDQzPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9IjEwMiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0OTIiIHk9IjEyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPmFwcGxpY2F0aW9uIHJ1bGUgY29sbGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSIxNDAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPkh0dHBzICBmcWRuICouZXhhbXBsZS5jb208L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iMTYwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ5MiIgeT0iMTgyIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+UHJlbWl1bSBJRFBTPC90ZXh0Pgo8dGV4dCB4PSI0OTIiIHk9IjE5OCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnlvdSBlbmFibGUgaXQgb24gUHJlbWl1bTwvdGV4dD4KPGRlZnM+CjxtYXJrZXIgaWQ9Im5mYTMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj4KPG1hcmtlciBpZD0ibmZhM3IiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNmODcxNzEiLz48L21hcmtlcj4KPC9kZWZzPgo8L3N2Zz4=) Stateful rules and domain lists become Azure rules; Suricata signatures do not translate. #### Limitations Where Network Firewall and Azure Firewall differ * **Suricata signatures are not supported.** A rule group of raw Suricata IDS/IPS rules creates no Azure rule. Azure Firewall Premium IDPS is the closest feature; if you rely on custom Suricata detections, plan to re-create them there. * **TLS inspection behaves differently: you configure it on Premium.** The build does not recreate the TLS inspection configuration. Outbound TLS decryption and inspection is a Premium policy feature that you enable after the build. * **Logging behaves differently: you enable Azure diagnostic logs.** The Network Firewall logging configuration is not recreated. Azure Firewall writes flow and rule logs through Azure Monitor diagnostic settings, which you enable on the firewall. * **Alert and reject actions behave differently: they become allow and deny.** Azure sets one action per rule collection and has no alert-only or reject-with-reset action. Alert rules become allow rules, reject rules become deny rules, and allow rules are evaluated first. * **You must route traffic through the firewall.** The build creates the firewall and its rules, not the routes. Point your virtual network's route tables at the firewall's private IP so the workload subnets' traffic passes through it, as the VPC route tables did on AWS. * **Stateless rules are not supported.** The build translates stateful rules and domain lists only. A stateless rule group, including custom actions such as publish-metric, creates no rule on Azure Firewall, so the traffic it handled falls to Azure Firewall's own default. Re-create those rules directly on Azure Firewall. * **Policy default actions behave differently: they are not kept.** The AWS policy's stateless and stateful default actions and its stream exception policy have no equivalent setting. Traffic that matches no rule follows Azure Firewall's own default, so confirm that default matches your AWS policy. * **Source-port matching is not supported.** Rules on Azure Firewall match the destination port only. A rule that also restricts the source port becomes broader than it was on AWS, and the build warns about it. * **Several firewall policies behave differently: they merge into one.** If the stack defines more than one firewall policy, all of their rule groups go into one policy on Azure Firewall, and the build warns about the merge. * **Rules the build cannot read behave differently: they become deny rules.** A stateful rule whose action, protocol, address or port comes from a variable or a `dynamic` block, or whose protocol is an application protocol such as HTTP, TLS or DNS, is created as a deny rule, with the unread parts matching anything. A domain list whose type comes from a variable becomes a deny list. A domain list whose domains come from a variable creates no rule at all. #### Other considerations * **Microsoft runs the firewall.** Azure Firewall is a managed service: Microsoft handles its availability, scaling and patching, and Tensor9 is not in the packet path. * **Choose the tier.** The build creates a Standard-tier firewall, which covers allow and deny rules. IDPS and TLS inspection need the Premium tier, which you choose and which has its own cost. * **Before going live.** Supply the `AzureFirewallSubnet`, add the routes, and confirm that Azure Firewall's handling of unmatched traffic is what you expect. * **Nothing to migrate.** A firewall holds no data. The build creates the resources on Azure Firewall, and there is no traffic history or state to copy. * **Read the build warnings.** Each rule or setting that did not translate exactly, as listed under Limitations, appears as a warning in the build output with what to re-create. * **References to the firewall's ARN or ID.** A firewall has no endpoint for applications to call, so these have no equivalent on Azure Firewall. An output that reads one is removed, with a warning; any other reference stops the build with an error naming the attribute. ## On Google Cloud ### Cloud NGFW | Operation | Area | Support | Depth | Notes | | - | - | - | - | - | | Suricata rule strings | Advanced rules | Out of scope | Most usage | Suricata rule strings are not supported. The build creates no policy rule for them and warns. Cloud NGFW security profiles (intrusion prevention, set at the organization level on the Enterprise tier) are the closest feature; you configure them yourself. | | TLS inspection | Advanced rules | Out of scope | Full surface | TLS inspection is not supported. The build does not recreate aws\_networkfirewall\_tls\_inspection\_configuration and warns; Cloud NGFW TLS inspection policies on the Enterprise tier are the closest feature, which you configure yourself. | | Flow / alert logging | Observability | Out of scope | Full surface | aws\_networkfirewall\_logging\_configuration is replaced by the rule's own enable\_logging + Cloud Logging, not a translated rule | | 5-tuple stateful rules | Rule translation | Partial | Common | Each stateful\_rule becomes a google\_compute\_network\_firewall\_policy\_rule with direction INGRESS, matching src\_ip\_ranges, dest\_ip\_ranges, ip\_protocol and ports. Rules that filtered outbound traffic on AWS are also created as INGRESS. Rule groups are flattened, all 5-tuple rules take priority over domain rules, and a source-port match is dropped. | | Domain allowlists / denylists | Rule translation | Supported | Most usage | A rules\_source\_list becomes an EGRESS rule matching dest\_fqdns on TCP 443 (TLS SNI) or 80 (HTTP Host); ALLOWLIST → allow, DENYLIST → deny. FQDN rules run at the Cloud NGFW Standard tier. | | Stateless 5-tuple rules | Rule translation | Out of scope | Most usage | Stateless rules are not supported. A stateless rule group, including custom actions such as publishMetricAction, creates no Cloud NGFW rule, and the traffic it handled falls to the network's own firewall default. The build warns; re-create those rules on Google Cloud. | | VPC inspection routing | Traffic steering | Partial | Common | The build creates the policy and its rules but no network association. The policy has no effect until you associate it with your VPC networks; for intrusion prevention at the Enterprise tier you also attach a firewall endpoint. | #### How it works Your Network Firewall setup (the firewall, its policy and the rule groups the policy references) is translated when the stack is built. The build creates a Cloud NGFW network firewall policy with one policy rule for each translated rule. Cloud NGFW works differently from a routed firewall. There is no firewall instance and no firewall subnet: Google enforces the policy inside the VPC network, on the networks the policy is associated with. Once it is deployed, Google filters the traffic and Tensor9 is not in the path. Stateful 5-tuple rules and domain lists become policy rules. Suricata signatures and TLS inspection have no policy-rule form; you set them up with Cloud NGFW security profiles and a TLS inspection policy, as described below. ![On AWS, a workload subnet routes traffic through a Network Firewall endpoint, which inspects it before it reaches the internet. On Google Cloud, the Cloud NGFW policy that the build creates is applied inside the VPC network, so there is no separate firewall to route through. Tensor9 is not in the path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIGEgd29ya2xvYWQgc3VibmV0IHJvdXRlcyB0cmFmZmljIHRocm91Z2ggYSBOZXR3b3JrIEZpcmV3YWxsIGVuZHBvaW50LCB3aGljaCBpbnNwZWN0cyBpdCBiZWZvcmUgaXQgcmVhY2hlcyB0aGUgaW50ZXJuZXQuIE9uIEdvb2dsZSBDbG91ZCwgdGhlIENsb3VkIE5HRlcgcG9saWN5IHRoYXQgdGhlIGJ1aWxkIGNyZWF0ZXMgaXMgYXBwbGllZCBpbnNpZGUgdGhlIFZQQyBuZXR3b3JrLCBzbyB0aGVyZSBpcyBubyBzZXBhcmF0ZSBmaXJld2FsbCB0byByb3V0ZSB0aHJvdWdoLiBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcGF0aC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHJlY3QgeD0iMTYiIHk9IjQ2IiB3aWR0aD0iMzkyIiBoZWlnaHQ9IjEzNCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjgiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9Ijg4IiB3aWR0aD0iMTEwIiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijg1IiB5PSIxMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+V29ya2xvYWQ8L3RleHQ+Cjx0ZXh0IHg9Ijg1IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5zdWJuZXQ8L3RleHQ+CjxsaW5lIHgxPSIxNDAiIHkxPSIxMjEiIHgyPSIxOTYiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mZzEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMTY4IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPnJvdXRlPC90ZXh0Pgo8cmVjdCB4PSIyMDAiIHk9Ijg4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjI3NSIgeT0iMTE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+TmV0d29yayBGaXJld2FsbDwvdGV4dD4KPHRleHQgeD0iMjc1IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5lbmRwb2ludCwgaW5zcGVjdHM8L3RleHQ+CjxsaW5lIHgxPSIzNTAiIHkxPSIxMjEiIHgyPSIzOTYiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mZzEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMzc0IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPndlYjwvdGV4dD4KPHJlY3QgeD0iNDI4IiB5PSI0NiIgd2lkdGg9IjM5MiIgaGVpZ2h0PSIxMzQiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NDIiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBHQ1A8L3RleHQ+CjxyZWN0IHg9IjQ3MCIgeT0iODQiIHdpZHRoPSIxNjQiIGhlaWdodD0iNzQiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNTUyIiB5PSIxMTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+V29ya2xvYWQgc3VibmV0PC90ZXh0Pgo8dGV4dCB4PSI1NTIiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+Q2xvdWQgTkdGVyBwb2xpY3kgYXBwbGllZDwvdGV4dD4KPGxpbmUgeDE9IjYzNCIgeTE9IjEyMSIgeDI9IjgwNiIgeTI9IjEyMSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZnMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI3MjAiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+d2ViLCBmaWx0ZXJlZCBieSB0aGUgVlBDPC90ZXh0Pgo8ZGVmcz48bWFya2VyIGlkPSJuZmcxIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8L3N2Zz4=) ![On AWS, a workload subnet routes traffic through a Network Firewall endpoint, which inspects it before it reaches the internet. On Google Cloud, the Cloud NGFW policy that the build creates is applied inside the VPC network, so there is no separate firewall to route through. Tensor9 is not in the path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIGEgd29ya2xvYWQgc3VibmV0IHJvdXRlcyB0cmFmZmljIHRocm91Z2ggYSBOZXR3b3JrIEZpcmV3YWxsIGVuZHBvaW50LCB3aGljaCBpbnNwZWN0cyBpdCBiZWZvcmUgaXQgcmVhY2hlcyB0aGUgaW50ZXJuZXQuIE9uIEdvb2dsZSBDbG91ZCwgdGhlIENsb3VkIE5HRlcgcG9saWN5IHRoYXQgdGhlIGJ1aWxkIGNyZWF0ZXMgaXMgYXBwbGllZCBpbnNpZGUgdGhlIFZQQyBuZXR3b3JrLCBzbyB0aGVyZSBpcyBubyBzZXBhcmF0ZSBmaXJld2FsbCB0byByb3V0ZSB0aHJvdWdoLiBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcGF0aC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHJlY3QgeD0iMTYiIHk9IjQ2IiB3aWR0aD0iMzkyIiBoZWlnaHQ9IjEzNCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGIiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9Ijg4IiB3aWR0aD0iMTEwIiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijg1IiB5PSIxMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+V29ya2xvYWQ8L3RleHQ+Cjx0ZXh0IHg9Ijg1IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5zdWJuZXQ8L3RleHQ+CjxsaW5lIHgxPSIxNDAiIHkxPSIxMjEiIHgyPSIxOTYiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mZzEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMTY4IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPnJvdXRlPC90ZXh0Pgo8cmVjdCB4PSIyMDAiIHk9Ijg4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjI3NSIgeT0iMTE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+TmV0d29yayBGaXJld2FsbDwvdGV4dD4KPHRleHQgeD0iMjc1IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5lbmRwb2ludCwgaW5zcGVjdHM8L3RleHQ+CjxsaW5lIHgxPSIzNTAiIHkxPSIxMjEiIHgyPSIzOTYiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mZzEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMzc0IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPndlYjwvdGV4dD4KPHJlY3QgeD0iNDI4IiB5PSI0NiIgd2lkdGg9IjM5MiIgaGVpZ2h0PSIxMzQiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NDIiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBHQ1A8L3RleHQ+CjxyZWN0IHg9IjQ3MCIgeT0iODQiIHdpZHRoPSIxNjQiIGhlaWdodD0iNzQiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNTUyIiB5PSIxMTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+V29ya2xvYWQgc3VibmV0PC90ZXh0Pgo8dGV4dCB4PSI1NTIiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+Q2xvdWQgTkdGVyBwb2xpY3kgYXBwbGllZDwvdGV4dD4KPGxpbmUgeDE9IjYzNCIgeTE9IjEyMSIgeDI9IjgwNiIgeTI9IjEyMSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZnMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI3MjAiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+d2ViLCBmaWx0ZXJlZCBieSB0aGUgVlBDPC90ZXh0Pgo8ZGVmcz48bWFya2VyIGlkPSJuZmcxIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8L3N2Zz4=) Your workloads stay as they are; Google applies the Cloud NGFW policy inside the VPC network, with no separate firewall to route through. #### What the build creates Cloud NGFW has no rule groups or rule collections. The build creates one network firewall policy and one policy rule per AWS rule, so a rule group of ten rules becomes ten policy rules. Each rule has a priority, an action (allow or deny), a direction (ingress or egress) and a match. Priorities start at 1001 and follow the AWS rule order, with all 5-tuple rules first and then the domain rules, so the order stays the same on every build. The build does not associate the policy with any network. You choose which VPC networks it governs and create that association. All Network Firewall resources must be in the stack's root module; otherwise the build stops with an error. ![The build creates one network firewall policy holding a flat list of policy rules in priority order: 5-tuple rules first, then domain rules. Each AWS rule becomes one policy rule. The policy applies to the VPC networks you associate it with.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgODM2IDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYnVpbGQgY3JlYXRlcyBvbmUgbmV0d29yayBmaXJld2FsbCBwb2xpY3kgaG9sZGluZyBhIGZsYXQgbGlzdCBvZiBwb2xpY3kgcnVsZXMgaW4gcHJpb3JpdHkgb3JkZXI6IDUtdHVwbGUgcnVsZXMgZmlyc3QsIHRoZW4gZG9tYWluIHJ1bGVzLiBFYWNoIEFXUyBydWxlIGJlY29tZXMgb25lIHBvbGljeSBydWxlLiBUaGUgcG9saWN5IGFwcGxpZXMgdG8gdGhlIFZQQyBuZXR3b3JrcyB5b3UgYXNzb2NpYXRlIGl0IHdpdGguIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxyZWN0IHg9IjE2IiB5PSIzNCIgd2lkdGg9IjgwNCIgaGVpZ2h0PSIxODYiIHJ4PSIxNiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkdDUCBQUk9KRUNUPC90ZXh0Pgo8cmVjdCB4PSIzNCIgeT0iNzQiIHdpZHRoPSI0NzAiIGhlaWdodD0iMTMyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjI2OSIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTIuNXB4Ij5OZXR3b3JrIGZpcmV3YWxsIHBvbGljeTwvdGV4dD4KPHJlY3QgeD0iNTAiIHk9IjExMiIgd2lkdGg9IjQzOCIgaGVpZ2h0PSIyNiIgcng9IjciIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNhN2YzZDAiLz4KPHRleHQgeD0iNjYiIHk9IjEyOSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTUiPjEwMDEgIGFsbG93ICBJTkdSRVNTICB0Y3AgMTAuMC4wLjAvMTYg4oaSIDQ0MzwvdGV4dD4KPHJlY3QgeD0iNTAiIHk9IjE0NCIgd2lkdGg9IjQzOCIgaGVpZ2h0PSIyNiIgcng9IjciIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNhN2YzZDAiLz4KPHRleHQgeD0iNjYiIHk9IjE2MSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTUiPjEwMDIgIGRlbnkgICBJTkdSRVNTICB1ZHAgMC4wLjAuMC8wIOKGkiA1MzwvdGV4dD4KPHJlY3QgeD0iNTAiIHk9IjE3NiIgd2lkdGg9IjQzOCIgaGVpZ2h0PSIyNiIgcng9IjciIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNhN2YzZDAiLz4KPHRleHQgeD0iNjYiIHk9IjE5MyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTUiPjEwMDMgIGFsbG93ICBFR1JFU1MgICBmcWRuICouZXhhbXBsZS5jb208L3RleHQ+CjxsaW5lIHgxPSI1MDQiIHkxPSIxNDAiIHgyPSI1NjAiIHkyPSIxNDAiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mZzIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNTMyIiB5PSIxMzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPmFwcGxpZXM8L3RleHQ+CjxyZWN0IHg9IjU2NCIgeT0iMTAyIiB3aWR0aD0iMjM4IiBoZWlnaHQ9Ijc2IiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjY4MyIgeT0iMTM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPlZQQyBuZXR3b3JrczwvdGV4dD4KPHRleHQgeD0iNjgzIiB5PSIxNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj50aGUgcG9saWN5IGdvdmVybnM8L3RleHQ+CjxkZWZzPjxtYXJrZXIgaWQ9Im5mZzIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+Cjwvc3ZnPg==) ![The build creates one network firewall policy holding a flat list of policy rules in priority order: 5-tuple rules first, then domain rules. Each AWS rule becomes one policy rule. The policy applies to the VPC networks you associate it with.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgODM2IDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYnVpbGQgY3JlYXRlcyBvbmUgbmV0d29yayBmaXJld2FsbCBwb2xpY3kgaG9sZGluZyBhIGZsYXQgbGlzdCBvZiBwb2xpY3kgcnVsZXMgaW4gcHJpb3JpdHkgb3JkZXI6IDUtdHVwbGUgcnVsZXMgZmlyc3QsIHRoZW4gZG9tYWluIHJ1bGVzLiBFYWNoIEFXUyBydWxlIGJlY29tZXMgb25lIHBvbGljeSBydWxlLiBUaGUgcG9saWN5IGFwcGxpZXMgdG8gdGhlIFZQQyBuZXR3b3JrcyB5b3UgYXNzb2NpYXRlIGl0IHdpdGguIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxyZWN0IHg9IjE2IiB5PSIzNCIgd2lkdGg9IjgwNCIgaGVpZ2h0PSIxODYiIHJ4PSIxNiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkdDUCBQUk9KRUNUPC90ZXh0Pgo8cmVjdCB4PSIzNCIgeT0iNzQiIHdpZHRoPSI0NzAiIGhlaWdodD0iMTMyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjI2OSIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTIuNXB4Ij5OZXR3b3JrIGZpcmV3YWxsIHBvbGljeTwvdGV4dD4KPHJlY3QgeD0iNTAiIHk9IjExMiIgd2lkdGg9IjQzOCIgaGVpZ2h0PSIyNiIgcng9IjciIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjYiIHk9IjEyOSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTEiPjEwMDEgIGFsbG93ICBJTkdSRVNTICB0Y3AgMTAuMC4wLjAvMTYg4oaSIDQ0MzwvdGV4dD4KPHJlY3QgeD0iNTAiIHk9IjE0NCIgd2lkdGg9IjQzOCIgaGVpZ2h0PSIyNiIgcng9IjciIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjYiIHk9IjE2MSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTEiPjEwMDIgIGRlbnkgICBJTkdSRVNTICB1ZHAgMC4wLjAuMC8wIOKGkiA1MzwvdGV4dD4KPHJlY3QgeD0iNTAiIHk9IjE3NiIgd2lkdGg9IjQzOCIgaGVpZ2h0PSIyNiIgcng9IjciIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjYiIHk9IjE5MyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTEiPjEwMDMgIGFsbG93ICBFR1JFU1MgICBmcWRuICouZXhhbXBsZS5jb208L3RleHQ+CjxsaW5lIHgxPSI1MDQiIHkxPSIxNDAiIHgyPSI1NjAiIHkyPSIxNDAiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mZzIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNTMyIiB5PSIxMzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPmFwcGxpZXM8L3RleHQ+CjxyZWN0IHg9IjU2NCIgeT0iMTAyIiB3aWR0aD0iMjM4IiBoZWlnaHQ9Ijc2IiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjY4MyIgeT0iMTM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPlZQQyBuZXR3b3JrczwvdGV4dD4KPHRleHQgeD0iNjgzIiB5PSIxNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij50aGUgcG9saWN5IGdvdmVybnM8L3RleHQ+CjxkZWZzPjxtYXJrZXIgaWQ9Im5mZzIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+Cjwvc3ZnPg==) One policy with a flat list of rules, evaluated in priority order, applied to the VPC networks you associate. #### How the rules translate **Stateful 5-tuple rules.** Each rule becomes an `INGRESS` policy rule that keeps its source and destination ranges, protocol and destination port. TCP, UDP and ICMP stay as they are, and an `IP` or `ANY` protocol becomes `all`. An `ANY` address becomes `0.0.0.0/0`, and an `ANY` port removes the port match. Pass rules become allow rules, drop and reject rules become deny rules, and alert rules become allow rules with rule logging turned on, so the traffic is recorded but not blocked. **Domain lists.** Each domain list becomes an `EGRESS` policy rule that matches the list's domains as destination FQDNs: allow for an allowlist, deny for a denylist. A list that matches on TLS SNI matches TCP port 443; a list that matches only on the HTTP Host header matches TCP port 80. A leading-dot entry such as `.example.com` becomes `*.example.com`. ![Stateful 5-tuple rules become ingress policy rules, and a domain allowlist becomes egress policy rules that match destination FQDNs. A group of Suricata rules is not translated; the closest Cloud NGFW feature is a security profile, which you configure yourself.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJTdGF0ZWZ1bCA1LXR1cGxlIHJ1bGVzIGJlY29tZSBpbmdyZXNzIHBvbGljeSBydWxlcywgYW5kIGEgZG9tYWluIGFsbG93bGlzdCBiZWNvbWVzIGVncmVzcyBwb2xpY3kgcnVsZXMgdGhhdCBtYXRjaCBkZXN0aW5hdGlvbiBGUUROcy4gQSBncm91cCBvZiBTdXJpY2F0YSBydWxlcyBpcyBub3QgdHJhbnNsYXRlZDsgdGhlIGNsb3Nlc3QgQ2xvdWQgTkdGVyBmZWF0dXJlIGlzIGEgc2VjdXJpdHkgcHJvZmlsZSwgd2hpY2ggeW91IGNvbmZpZ3VyZSB5b3Vyc2VsZi4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMzAiIHk9IjMyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5BV1MgUlVMRSBHUk9VUFM8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI0NCIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NiIgeT0iNjYiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5zdGF0ZWZ1bCA1LXR1cGxlIHJ1bGVzPC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iODIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj50Y3AgMTAuMC4wLjAvMTYg4oaSIGFueTo0NDMgcGFzczwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9IjEwMiIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NiIgeT0iMTI0IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+ZG9tYWluIGFsbG93bGlzdDwvdGV4dD4KPHRleHQgeD0iNDYiIHk9IjE0MCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPi5leGFtcGxlLmNvbSAgKFRMU19TTkkpPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iMTYwIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZmVjYWNhIi8+Cjx0ZXh0IHg9IjQ2IiB5PSIxODIiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5TdXJpY2F0YSBydWxlIHN0cmluZzwvdGV4dD4KPHRleHQgeD0iNDYiIHk9IjE5OCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmFsZXJ0IHRjcCBhbnkgYW55IC0mZ3Q7IC4uLjwvdGV4dD4KPGxpbmUgeDE9IjMzNiIgeTE9IjY3IiB4Mj0iNDcwIiB5Mj0iNjciIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mZzMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPGxpbmUgeDE9IjMzNiIgeTE9IjEyNSIgeDI9IjQ3MCIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZnMykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8bGluZSB4MT0iMzM2IiB5MT0iMTgzIiB4Mj0iNDcwIiB5Mj0iMTgzIiBzdHJva2Utd2lkdGg9IjEuNiIgc3Ryb2tlLWRhc2hhcnJheT0iNCAzIiBtYXJrZXItZW5kPSJ1cmwoI25mZzNyKSIgc3R5bGU9InN0cm9rZTojZGMyNjI2Ii8+Cjx0ZXh0IHg9IjQwMyIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4O2ZpbGw6I2RjMjYyNiI+bm90IHRyYW5zbGF0ZWQ8L3RleHQ+Cjx0ZXh0IHg9IjQ3NiIgeT0iMzIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkNMT1VEIE5HRlcgUE9MSUNZPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9IjQ0IiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5MiIgeT0iNjYiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5JTkdSRVNTIGFsbG93IHBvbGljeSBydWxlPC90ZXh0Pgo8dGV4dCB4PSI0OTIiIHk9IjgyIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij50Y3AgIHNyYyAxMC4wLjAuMC8xNiAgcG9ydHMgNDQzPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9IjEwMiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0OTIiIHk9IjEyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPkVHUkVTUyBhbGxvdyBwb2xpY3kgcnVsZTwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSIxNDAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPmZxZG4gKi5leGFtcGxlLmNvbSAgdGNwIDQ0MzwvdGV4dD4KPHJlY3QgeD0iNDc2IiB5PSIxNjAiIHdpZHRoPSIzMzAiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDkyIiB5PSIxODIiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5TZWN1cml0eSBwcm9maWxlIChJUFMpPC90ZXh0Pgo8dGV4dCB4PSI0OTIiIHk9IjE5OCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnlvdSBjb25maWd1cmUgaXQsIEVudGVycHJpc2U8L3RleHQ+CjxkZWZzPgo8bWFya2VyIGlkPSJuZmczIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+CjxtYXJrZXIgaWQ9Im5mZzNyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZGMyNjI2Ii8+PC9tYXJrZXI+CjwvZGVmcz4KPC9zdmc+) ![Stateful 5-tuple rules become ingress policy rules, and a domain allowlist becomes egress policy rules that match destination FQDNs. A group of Suricata rules is not translated; the closest Cloud NGFW feature is a security profile, which you configure yourself.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJTdGF0ZWZ1bCA1LXR1cGxlIHJ1bGVzIGJlY29tZSBpbmdyZXNzIHBvbGljeSBydWxlcywgYW5kIGEgZG9tYWluIGFsbG93bGlzdCBiZWNvbWVzIGVncmVzcyBwb2xpY3kgcnVsZXMgdGhhdCBtYXRjaCBkZXN0aW5hdGlvbiBGUUROcy4gQSBncm91cCBvZiBTdXJpY2F0YSBydWxlcyBpcyBub3QgdHJhbnNsYXRlZDsgdGhlIGNsb3Nlc3QgQ2xvdWQgTkdGVyBmZWF0dXJlIGlzIGEgc2VjdXJpdHkgcHJvZmlsZSwgd2hpY2ggeW91IGNvbmZpZ3VyZSB5b3Vyc2VsZi4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMzAiIHk9IjMyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5BV1MgUlVMRSBHUk9VUFM8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI0NCIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NiIgeT0iNjYiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5zdGF0ZWZ1bCA1LXR1cGxlIHJ1bGVzPC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iODIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij50Y3AgMTAuMC4wLjAvMTYg4oaSIGFueTo0NDMgcGFzczwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9IjEwMiIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NiIgeT0iMTI0IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+ZG9tYWluIGFsbG93bGlzdDwvdGV4dD4KPHRleHQgeD0iNDYiIHk9IjE0MCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPi5leGFtcGxlLmNvbSAgKFRMU19TTkkpPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iMTYwIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojN2YxZDFkIi8+Cjx0ZXh0IHg9IjQ2IiB5PSIxODIiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5TdXJpY2F0YSBydWxlIHN0cmluZzwvdGV4dD4KPHRleHQgeD0iNDYiIHk9IjE5OCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmFsZXJ0IHRjcCBhbnkgYW55IC0mZ3Q7IC4uLjwvdGV4dD4KPGxpbmUgeDE9IjMzNiIgeTE9IjY3IiB4Mj0iNDcwIiB5Mj0iNjciIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mZzMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPGxpbmUgeDE9IjMzNiIgeTE9IjEyNSIgeDI9IjQ3MCIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZnMykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8bGluZSB4MT0iMzM2IiB5MT0iMTgzIiB4Mj0iNDcwIiB5Mj0iMTgzIiBzdHJva2Utd2lkdGg9IjEuNiIgc3Ryb2tlLWRhc2hhcnJheT0iNCAzIiBtYXJrZXItZW5kPSJ1cmwoI25mZzNyKSIgc3R5bGU9InN0cm9rZTojZjg3MTcxIi8+Cjx0ZXh0IHg9IjQwMyIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4O2ZpbGw6I2Y4NzE3MSI+bm90IHRyYW5zbGF0ZWQ8L3RleHQ+Cjx0ZXh0IHg9IjQ3NiIgeT0iMzIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkNMT1VEIE5HRlcgUE9MSUNZPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9IjQ0IiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQ5MiIgeT0iNjYiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5JTkdSRVNTIGFsbG93IHBvbGljeSBydWxlPC90ZXh0Pgo8dGV4dCB4PSI0OTIiIHk9IjgyIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij50Y3AgIHNyYyAxMC4wLjAuMC8xNiAgcG9ydHMgNDQzPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9IjEwMiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0OTIiIHk9IjEyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPkVHUkVTUyBhbGxvdyBwb2xpY3kgcnVsZTwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSIxNDAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPmZxZG4gKi5leGFtcGxlLmNvbSAgdGNwIDQ0MzwvdGV4dD4KPHJlY3QgeD0iNDc2IiB5PSIxNjAiIHdpZHRoPSIzMzAiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDkyIiB5PSIxODIiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5TZWN1cml0eSBwcm9maWxlIChJUFMpPC90ZXh0Pgo8dGV4dCB4PSI0OTIiIHk9IjE5OCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnlvdSBjb25maWd1cmUgaXQsIEVudGVycHJpc2U8L3RleHQ+CjxkZWZzPgo8bWFya2VyIGlkPSJuZmczIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+CjxtYXJrZXIgaWQ9Im5mZzNyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZjg3MTcxIi8+PC9tYXJrZXI+CjwvZGVmcz4KPC9zdmc+) Stateful rules become ingress rules and domain lists become egress rules; Suricata signatures do not translate. #### Limitations Where Network Firewall and Cloud NGFW differ * **Suricata signatures are not supported.** A rule group of raw Suricata IDS/IPS rules creates no policy rule. Cloud NGFW security profiles are the closest feature; they are set at the organization level and need the Enterprise tier. * **TLS inspection behaves differently: you configure a TLS inspection policy.** The build does not recreate the TLS inspection configuration. You set up Cloud NGFW TLS inspection yourself after the build. * **Logging behaves differently: only former alert rules log.** The Network Firewall logging configuration is not recreated. Cloud NGFW logs rule hits to Cloud Logging for rules with logging on, and the build turns it on only for rules that were alert rules on AWS. * **Stateful rules behave differently: each becomes an ingress rule.** Every 5-tuple rule is created with direction `INGRESS`, including rules that filtered outbound traffic on AWS. Review those rules and add egress rules where you need them. * **Rule groups behave differently: they are flattened.** Each AWS rule becomes one policy rule, and the rule-group structure is not kept. Evaluation follows the assigned priorities: 5-tuple rules first, in AWS order, then domain rules. * **You must associate the policy with your VPC networks.** The policy has no effect until it is associated with a network. For intrusion prevention at the Enterprise tier, you also attach a firewall endpoint. * **You must keep the Network Firewall resources in the root module.** If any `aws_networkfirewall_*` resource is in a child module, the build stops with an error. * **Stateless rules are not supported.** The build translates stateful rules and domain lists only. A stateless rule group, including custom actions such as publish-metric, creates no rule on Cloud NGFW, so the traffic it handled falls to Cloud NGFW's own default. Re-create those rules directly on Cloud NGFW. * **Policy default actions behave differently: they are not kept.** The AWS policy's stateless and stateful default actions and its stream exception policy have no equivalent setting. Traffic that matches no rule follows Cloud NGFW's own default, so confirm that default matches your AWS policy. * **Source-port matching is not supported.** Rules on Cloud NGFW match the destination port only. A rule that also restricts the source port becomes broader than it was on AWS, and the build warns about it. * **Several firewall policies behave differently: they merge into one.** If the stack defines more than one firewall policy, all of their rule groups go into one policy on Cloud NGFW, and the build warns about the merge. * **Rules the build cannot read behave differently: they become deny rules.** A stateful rule whose action, protocol, address or port comes from a variable or a `dynamic` block, or whose protocol is an application protocol such as HTTP, TLS or DNS, is created as a deny rule, with the unread parts matching anything. A domain list whose type comes from a variable becomes a deny list. A domain list whose domains come from a variable creates no rule at all. #### Other considerations * **Google runs the enforcement.** Cloud NGFW is managed and enforced inside the VPC network: Google handles its availability and scaling, and Tensor9 is not in the packet path. * **Choose the tier.** Allow and deny rules run at the Standard tier. Security profiles and TLS inspection need the Enterprise tier and, for security profiles, organization-level configuration. * **Before going live.** Associate the policy with the right VPC networks, and check the direction of rules that were meant for outbound traffic. * **Nothing to migrate.** A firewall holds no data. The build creates the resources on Cloud NGFW, and there is no traffic history or state to copy. * **Read the build warnings.** Each rule or setting that did not translate exactly, as listed under Limitations, appears as a warning in the build output with what to re-create. * **References to the firewall's ARN or ID.** A firewall has no endpoint for applications to call, so these have no equivalent on Cloud NGFW. An output that reads one is removed, with a warning; any other reference stops the build with an error naming the attribute. ## On OCI ### OCI Network Firewall | Operation | Area | Support | Depth | Notes | | - | - | - | - | - | | Suricata rule strings | Advanced rules | Out of scope | Most usage | Suricata rule strings are not supported. The build creates no security rule for them and warns. The OCI Network Firewall's own intrusion detection is the closest feature; you configure it yourself. | | TLS inspection | Advanced rules | Out of scope | Full surface | TLS inspection is not supported. The build does not recreate aws\_networkfirewall\_tls\_inspection\_configuration and warns; OCI decryption profiles and rules are the closest feature, which you configure yourself. | | Flow / alert logging | Observability | Out of scope | Full surface | aws\_networkfirewall\_logging\_configuration is replaced by the OCI Network Firewall's own logging, not a translated rule | | 5-tuple stateful rules | Rule translation | Partial | Common | Each stateful\_rule becomes a security rule whose condition references address lists for the source and destination CIDRs and a service for the destination port. The rule has no protocol: every destination port becomes a TCP service, so a UDP rule with a port matches TCP on that port, and a rule without a port matches every protocol. Alert becomes ALLOW, and a source-port match is dropped. | | Domain allowlists / denylists | Rule translation | Supported | Most usage | a rules\_source\_list maps onto a url\_list + a security rule whose condition references it; ALLOWLIST → ALLOW, DENYLIST → DROP | | Stateless 5-tuple rules | Rule translation | Out of scope | Most usage | Stateless rules are not supported. A stateless rule group, including custom actions such as publishMetricAction, creates no OCI rule, and the traffic it handled falls to the OCI policy's own default. The build warns; re-create those rules on OCI. | | VPC inspection routing | Traffic steering | Partial | Common | the firewall + policy + rules emit; the firewall's subnet attachment + route-table steering is deployment-specific and wired by the operator (surfaced, never assumed) | #### How it works Your Network Firewall setup (the firewall, its policy and the rule groups the policy references) is translated when the stack is built. The build creates an OCI Network Firewall attached to an OCI Network Firewall policy whose security rules hold the translated rules. The OCI Network Firewall is a managed, stateful firewall, like Network Firewall. Oracle runs it, so once traffic is routed through it, it inspects that traffic itself and Tensor9 is not in the path. Stateful 5-tuple rules and domain lists become security rules. Suricata signatures, TLS inspection and flow logging have no security-rule form; you set them up on the firewall itself, as described below. ![On AWS, a workload subnet routes traffic through a Network Firewall endpoint, which inspects it before it reaches the internet. On OCI, the same subnet routes through an OCI Network Firewall that the build creates. The firewall inspects the traffic itself; Tensor9 is not in the path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIGEgd29ya2xvYWQgc3VibmV0IHJvdXRlcyB0cmFmZmljIHRocm91Z2ggYSBOZXR3b3JrIEZpcmV3YWxsIGVuZHBvaW50LCB3aGljaCBpbnNwZWN0cyBpdCBiZWZvcmUgaXQgcmVhY2hlcyB0aGUgaW50ZXJuZXQuIE9uIE9DSSwgdGhlIHNhbWUgc3VibmV0IHJvdXRlcyB0aHJvdWdoIGFuIE9DSSBOZXR3b3JrIEZpcmV3YWxsIHRoYXQgdGhlIGJ1aWxkIGNyZWF0ZXMuIFRoZSBmaXJld2FsbCBpbnNwZWN0cyB0aGUgdHJhZmZpYyBpdHNlbGY7IFRlbnNvcjkgaXMgbm90IGluIHRoZSBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8cmVjdCB4PSIxNiIgeT0iNDYiIHdpZHRoPSIzOTIiIGhlaWdodD0iMTM0IiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iODgiIHdpZHRoPSIxMTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iODUiIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5Xb3JrbG9hZDwvdGV4dD4KPHRleHQgeD0iODUiIHk9IjEzMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnN1Ym5ldDwvdGV4dD4KPGxpbmUgeDE9IjE0MCIgeTE9IjEyMSIgeDI9IjE5NiIgeTI9IjEyMSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIxNjgiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+cm91dGU8L3RleHQ+CjxyZWN0IHg9IjIwMCIgeT0iODgiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjc1IiB5PSIxMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5OZXR3b3JrIEZpcmV3YWxsPC90ZXh0Pgo8dGV4dCB4PSIyNzUiIHk9IjEzMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmVuZHBvaW50LCBpbnNwZWN0czwvdGV4dD4KPGxpbmUgeDE9IjM1MCIgeTE9IjEyMSIgeDI9IjM5NiIgeTI9IjEyMSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIzNzQiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+d2ViPC90ZXh0Pgo8cmVjdCB4PSI0MjgiIHk9IjQ2IiB3aWR0aD0iMzkyIiBoZWlnaHQ9IjEzNCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ0MiIgeT0iNjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPk9OIE9DSTwvdGV4dD4KPHJlY3QgeD0iNDQyIiB5PSI4OCIgd2lkdGg9IjExMCIgaGVpZ2h0PSI2NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0OTciIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5Xb3JrbG9hZDwvdGV4dD4KPHRleHQgeD0iNDk3IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5zdWJuZXQ8L3RleHQ+CjxsaW5lIHgxPSI1NTIiIHkxPSIxMjEiIHgyPSI2MDgiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mbzEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNTgwIiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPnJvdXRlPC90ZXh0Pgo8cmVjdCB4PSI2MTIiIHk9Ijg0IiB3aWR0aD0iMTUwIiBoZWlnaHQ9Ijc0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjY4NyIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExLjVweCI+TmV0d29yayBGaXJld2FsbDwvdGV4dD4KPHRleHQgeD0iNjg3IiB5PSIxMzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPisgcG9saWN5LCBpbnNwZWN0czwvdGV4dD4KPGxpbmUgeDE9Ijc2MiIgeTE9IjEyMSIgeDI9IjgwOCIgeTI9IjEyMSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI3ODYiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+d2ViPC90ZXh0Pgo8ZGVmcz48bWFya2VyIGlkPSJuZm8xIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8L3N2Zz4=) ![On AWS, a workload subnet routes traffic through a Network Firewall endpoint, which inspects it before it reaches the internet. On OCI, the same subnet routes through an OCI Network Firewall that the build creates. The firewall inspects the traffic itself; Tensor9 is not in the path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIGEgd29ya2xvYWQgc3VibmV0IHJvdXRlcyB0cmFmZmljIHRocm91Z2ggYSBOZXR3b3JrIEZpcmV3YWxsIGVuZHBvaW50LCB3aGljaCBpbnNwZWN0cyBpdCBiZWZvcmUgaXQgcmVhY2hlcyB0aGUgaW50ZXJuZXQuIE9uIE9DSSwgdGhlIHNhbWUgc3VibmV0IHJvdXRlcyB0aHJvdWdoIGFuIE9DSSBOZXR3b3JrIEZpcmV3YWxsIHRoYXQgdGhlIGJ1aWxkIGNyZWF0ZXMuIFRoZSBmaXJld2FsbCBpbnNwZWN0cyB0aGUgdHJhZmZpYyBpdHNlbGY7IFRlbnNvcjkgaXMgbm90IGluIHRoZSBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8cmVjdCB4PSIxNiIgeT0iNDYiIHdpZHRoPSIzOTIiIGhlaWdodD0iMTM0IiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iODgiIHdpZHRoPSIxMTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iODUiIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5Xb3JrbG9hZDwvdGV4dD4KPHRleHQgeD0iODUiIHk9IjEzMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnN1Ym5ldDwvdGV4dD4KPGxpbmUgeDE9IjE0MCIgeTE9IjEyMSIgeDI9IjE5NiIgeTI9IjEyMSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIxNjgiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+cm91dGU8L3RleHQ+CjxyZWN0IHg9IjIwMCIgeT0iODgiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjc1IiB5PSIxMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5OZXR3b3JrIEZpcmV3YWxsPC90ZXh0Pgo8dGV4dCB4PSIyNzUiIHk9IjEzMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmVuZHBvaW50LCBpbnNwZWN0czwvdGV4dD4KPGxpbmUgeDE9IjM1MCIgeTE9IjEyMSIgeDI9IjM5NiIgeTI9IjEyMSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIzNzQiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+d2ViPC90ZXh0Pgo8cmVjdCB4PSI0MjgiIHk9IjQ2IiB3aWR0aD0iMzkyIiBoZWlnaHQ9IjEzNCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ0MiIgeT0iNjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPk9OIE9DSTwvdGV4dD4KPHJlY3QgeD0iNDQyIiB5PSI4OCIgd2lkdGg9IjExMCIgaGVpZ2h0PSI2NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0OTciIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5Xb3JrbG9hZDwvdGV4dD4KPHRleHQgeD0iNDk3IiB5PSIxMzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5zdWJuZXQ8L3RleHQ+CjxsaW5lIHgxPSI1NTIiIHkxPSIxMjEiIHgyPSI2MDgiIHkyPSIxMjEiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI25mbzEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNTgwIiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPnJvdXRlPC90ZXh0Pgo8cmVjdCB4PSI2MTIiIHk9Ijg0IiB3aWR0aD0iMTUwIiBoZWlnaHQ9Ijc0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjY4NyIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExLjVweCI+TmV0d29yayBGaXJld2FsbDwvdGV4dD4KPHRleHQgeD0iNjg3IiB5PSIxMzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPisgcG9saWN5LCBpbnNwZWN0czwvdGV4dD4KPGxpbmUgeDE9Ijc2MiIgeTE9IjEyMSIgeDI9IjgwOCIgeTI9IjEyMSIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI3ODYiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+d2ViPC90ZXh0Pgo8ZGVmcz48bWFya2VyIGlkPSJuZm8xIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8L3N2Zz4=) Your workloads and routes stay as they are; an OCI Network Firewall inspects the traffic instead of Network Firewall. #### What the build creates An OCI security rule does not hold a CIDR, a port or a domain directly. Its condition refers by name to separate policy objects: an address list for addresses, a service for a port, and a url list for domains. So for each AWS rule the build creates the objects the rule needs and a security rule that refers to them. A CIDR or port used by several rules becomes one object that they all share. The firewall and its policy are placed in the compartment and private subnet supplied with the deployment. Each security rule takes its own action: allow, drop or reject. ![The build creates an OCI Network Firewall attached to a firewall policy. Each security rule refers by name to objects the build also creates: an address list for CIDRs, a service for a port, and a url list for domains.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI2IiB2aWV3Qm94PSIwIDAgODM2IDIyNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYnVpbGQgY3JlYXRlcyBhbiBPQ0kgTmV0d29yayBGaXJld2FsbCBhdHRhY2hlZCB0byBhIGZpcmV3YWxsIHBvbGljeS4gRWFjaCBzZWN1cml0eSBydWxlIHJlZmVycyBieSBuYW1lIHRvIG9iamVjdHMgdGhlIGJ1aWxkIGFsc28gY3JlYXRlczogYW4gYWRkcmVzcyBsaXN0IGZvciBDSURScywgYSBzZXJ2aWNlIGZvciBhIHBvcnQsIGFuZCBhIHVybCBsaXN0IGZvciBkb21haW5zLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8cmVjdCB4PSIxNiIgeT0iMzQiIHdpZHRoPSI4MDQiIGhlaWdodD0iMTc2IiByeD0iMTYiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzQiIHk9IjU2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PQ0kgVkNOPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iODIiIHdpZHRoPSIxNTAiIGhlaWdodD0iMTA0IiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjEwNSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPk5ldHdvcmsgRmlyZXdhbGw8L3RleHQ+Cjx0ZXh0IHg9IjEwNSIgeT0iMTQ2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5vbiB5b3VyIHN1Ym5ldDwvdGV4dD4KPGxpbmUgeDE9IjE4MCIgeTE9IjEzNCIgeDI9IjIyOCIgeTI9IjEzNCIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIyMDQiIHk9IjEyNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+cG9saWN5PC90ZXh0Pgo8cmVjdCB4PSIyMzIiIHk9IjgyIiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjEwNCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzMjIiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5maXJld2FsbCBwb2xpY3k8L3RleHQ+CjxyZWN0IHg9IjI0OCIgeT0iMTE4IiB3aWR0aD0iMTQ4IiBoZWlnaHQ9IjI4IiByeD0iNyIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSIzMjIiIHk9IjEzNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTUiPnNlY3VyaXR5IHJ1bGU8L3RleHQ+Cjx0ZXh0IHg9IjMyMiIgeT0iMTcyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cmVmZXJlbmNlcyBieSBuYW1lPC90ZXh0Pgo8bGluZSB4MT0iNDEyIiB5MT0iMTM0IiB4Mj0iNDYwIiB5Mj0iMTM0IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZm8yKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjQzNiIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5ieSBuYW1lPC90ZXh0Pgo8cmVjdCB4PSI0NjQiIHk9IjgyIiB3aWR0aD0iMzQwIiBoZWlnaHQ9IjEwNCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2MzQiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5uYW1lZCBvYmplY3RzPC90ZXh0Pgo8cmVjdCB4PSI0NzgiIHk9IjExNCIgd2lkdGg9IjMxMiIgaGVpZ2h0PSIyMiIgcng9IjYiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDkwIiB5PSIxMjkiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1Ij5hZGRyZXNzIGxpc3QgICAxMC4wLjAuMC8xNjwvdGV4dD4KPHJlY3QgeD0iNDc4IiB5PSIxNDAiIHdpZHRoPSIzMTIiIGhlaWdodD0iMjIiIHJ4PSI2IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ5MCIgeT0iMTU1IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NSI+c2VydmljZSAgICAgICAgdGNwIDQ0MzwvdGV4dD4KPHJlY3QgeD0iNDc4IiB5PSIxNjYiIHdpZHRoPSIzMTIiIGhlaWdodD0iMjIiIHJ4PSI2IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ5MCIgeT0iMTgxIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NSI+dXJsIGxpc3QgICAgICAgKi5leGFtcGxlLmNvbTwvdGV4dD4KPGRlZnM+PG1hcmtlciBpZD0ibmZvMiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNi41IiBtYXJrZXJIZWlnaHQ9IjYuNSIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPC9zdmc+) ![The build creates an OCI Network Firewall attached to a firewall policy. Each security rule refers by name to objects the build also creates: an address list for CIDRs, a service for a port, and a url list for domains.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI2IiB2aWV3Qm94PSIwIDAgODM2IDIyNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYnVpbGQgY3JlYXRlcyBhbiBPQ0kgTmV0d29yayBGaXJld2FsbCBhdHRhY2hlZCB0byBhIGZpcmV3YWxsIHBvbGljeS4gRWFjaCBzZWN1cml0eSBydWxlIHJlZmVycyBieSBuYW1lIHRvIG9iamVjdHMgdGhlIGJ1aWxkIGFsc28gY3JlYXRlczogYW4gYWRkcmVzcyBsaXN0IGZvciBDSURScywgYSBzZXJ2aWNlIGZvciBhIHBvcnQsIGFuZCBhIHVybCBsaXN0IGZvciBkb21haW5zLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8cmVjdCB4PSIxNiIgeT0iMzQiIHdpZHRoPSI4MDQiIGhlaWdodD0iMTc2IiByeD0iMTYiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzQiIHk9IjU2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PQ0kgVkNOPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iODIiIHdpZHRoPSIxNTAiIGhlaWdodD0iMTA0IiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjEwNSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPk5ldHdvcmsgRmlyZXdhbGw8L3RleHQ+Cjx0ZXh0IHg9IjEwNSIgeT0iMTQ2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5vbiB5b3VyIHN1Ym5ldDwvdGV4dD4KPGxpbmUgeDE9IjE4MCIgeTE9IjEzNCIgeDI9IjIyOCIgeTI9IjEzNCIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIyMDQiIHk9IjEyNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+cG9saWN5PC90ZXh0Pgo8cmVjdCB4PSIyMzIiIHk9IjgyIiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjEwNCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzMjIiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5maXJld2FsbCBwb2xpY3k8L3RleHQ+CjxyZWN0IHg9IjI0OCIgeT0iMTE4IiB3aWR0aD0iMTQ4IiBoZWlnaHQ9IjI4IiByeD0iNyIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIzMjIiIHk9IjEzNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTEiPnNlY3VyaXR5IHJ1bGU8L3RleHQ+Cjx0ZXh0IHg9IjMyMiIgeT0iMTcyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cmVmZXJlbmNlcyBieSBuYW1lPC90ZXh0Pgo8bGluZSB4MT0iNDEyIiB5MT0iMTM0IiB4Mj0iNDYwIiB5Mj0iMTM0IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZm8yKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjQzNiIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5ieSBuYW1lPC90ZXh0Pgo8cmVjdCB4PSI0NjQiIHk9IjgyIiB3aWR0aD0iMzQwIiBoZWlnaHQ9IjEwNCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2MzQiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5uYW1lZCBvYmplY3RzPC90ZXh0Pgo8cmVjdCB4PSI0NzgiIHk9IjExNCIgd2lkdGg9IjMxMiIgaGVpZ2h0PSIyMiIgcng9IjYiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDkwIiB5PSIxMjkiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxIj5hZGRyZXNzIGxpc3QgICAxMC4wLjAuMC8xNjwvdGV4dD4KPHJlY3QgeD0iNDc4IiB5PSIxNDAiIHdpZHRoPSIzMTIiIGhlaWdodD0iMjIiIHJ4PSI2IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ5MCIgeT0iMTU1IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMSI+c2VydmljZSAgICAgICAgdGNwIDQ0MzwvdGV4dD4KPHJlY3QgeD0iNDc4IiB5PSIxNjYiIHdpZHRoPSIzMTIiIGhlaWdodD0iMjIiIHJ4PSI2IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ5MCIgeT0iMTgxIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMSI+dXJsIGxpc3QgICAgICAgKi5leGFtcGxlLmNvbTwvdGV4dD4KPGRlZnM+PG1hcmtlciBpZD0ibmZvMiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNi41IiBtYXJrZXJIZWlnaHQ9IjYuNSIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPC9zdmc+) A security rule holds no addresses or ports itself; it refers by name to address lists, services and url lists. #### How the rules translate **Stateful 5-tuple rules.** Each source or destination CIDR becomes an IP address list, and each destination port becomes a TCP service. The security rule's condition refers to them; an `ANY` address or port is left out of the condition, so it matches any value. Pass becomes `ALLOW`, drop becomes `DROP`, reject becomes `REJECT`, and alert becomes `ALLOW`. The rule itself has no protocol; see Limitations. **Domain lists.** Each domain list becomes a url list of simple patterns and a security rule that refers to it: `ALLOW` for an allowlist, `DROP` for a denylist. A leading-dot entry such as `.example.com` becomes `*.example.com`. ![Stateful 5-tuple rules become security rules that refer to an address list and a service. A domain allowlist becomes a url list and a security rule that refers to it. A group of Suricata rules is not translated; the closest OCI feature is the firewall's own intrusion detection, which you enable yourself.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJTdGF0ZWZ1bCA1LXR1cGxlIHJ1bGVzIGJlY29tZSBzZWN1cml0eSBydWxlcyB0aGF0IHJlZmVyIHRvIGFuIGFkZHJlc3MgbGlzdCBhbmQgYSBzZXJ2aWNlLiBBIGRvbWFpbiBhbGxvd2xpc3QgYmVjb21lcyBhIHVybCBsaXN0IGFuZCBhIHNlY3VyaXR5IHJ1bGUgdGhhdCByZWZlcnMgdG8gaXQuIEEgZ3JvdXAgb2YgU3VyaWNhdGEgcnVsZXMgaXMgbm90IHRyYW5zbGF0ZWQ7IHRoZSBjbG9zZXN0IE9DSSBmZWF0dXJlIGlzIHRoZSBmaXJld2FsbCdzIG93biBpbnRydXNpb24gZGV0ZWN0aW9uLCB3aGljaCB5b3UgZW5hYmxlIHlvdXJzZWxmLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8dGV4dCB4PSIzMCIgeT0iMzIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPkFXUyBSVUxFIEdST1VQUzwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9IjQ0IiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ2IiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPnN0YXRlZnVsIDUtdHVwbGUgcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjQ2IiB5PSI4MiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnRjcCAxMC4wLjAuMC8xNiDihpIgYW55OjQ0MyBwYXNzPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iMTAyIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ2IiB5PSIxMjQiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5kb21haW4gYWxsb3dsaXN0PC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iMTQwIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+LmV4YW1wbGUuY29tICAoVExTX1NOSSk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSIxNjAiIHdpZHRoPSIzMDAiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNmZWNhY2EiLz4KPHRleHQgeD0iNDYiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPlN1cmljYXRhIHJ1bGUgc3RyaW5nPC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iMTk4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+YWxlcnQgdGNwIGFueSBhbnkgLSZndDsgLi4uPC90ZXh0Pgo8bGluZSB4MT0iMzM2IiB5MT0iNjciIHgyPSI0NzAiIHkyPSI2NyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8bGluZSB4MT0iMzM2IiB5MT0iMTI1IiB4Mj0iNDcwIiB5Mj0iMTI1IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZm8zKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxsaW5lIHgxPSIzMzYiIHkxPSIxODMiIHgyPSI0NzAiIHkyPSIxODMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHJva2UtZGFzaGFycmF5PSI0IDMiIG1hcmtlci1lbmQ9InVybCgjbmZvM3IpIiBzdHlsZT0ic3Ryb2tlOiNkYzI2MjYiLz4KPHRleHQgeD0iNDAzIiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHg7ZmlsbDojZGMyNjI2Ij5ub3QgdHJhbnNsYXRlZDwvdGV4dD4KPHRleHQgeD0iNDc2IiB5PSIzMiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+T0NJIEZJUkVXQUxMIFBPTElDWTwvdGV4dD4KPHJlY3QgeD0iNDc2IiB5PSI0NCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0OTIiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExLjVweCI+c2VjdXJpdHkgcnVsZSArIGFkZHJlc3MgbGlzdDwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSI4MiIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+QUxMT1cgIDEwLjAuMC4wLzE2ICBzZXJ2aWNlIHRjcCA0NDM8L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iMTAyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5MiIgeT0iMTI0IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExLjVweCI+dXJsIGxpc3QgKyBzZWN1cml0eSBydWxlPC90ZXh0Pgo8dGV4dCB4PSI0OTIiIHk9IjE0MCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+QUxMT1cgICouZXhhbXBsZS5jb208L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iMTYwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ5MiIgeT0iMTgyIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+RmlyZXdhbGwgaW50cnVzaW9uIGRldGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSIxOTgiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj55b3UgZW5hYmxlIGl0IG9uIHRoZSBmaXJld2FsbDwvdGV4dD4KPGRlZnM+CjxtYXJrZXIgaWQ9Im5mbzMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj4KPG1hcmtlciBpZD0ibmZvM3IiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNkYzI2MjYiLz48L21hcmtlcj4KPC9kZWZzPgo8L3N2Zz4=) ![Stateful 5-tuple rules become security rules that refer to an address list and a service. A domain allowlist becomes a url list and a security rule that refers to it. A group of Suricata rules is not translated; the closest OCI feature is the firewall's own intrusion detection, which you enable yourself.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJTdGF0ZWZ1bCA1LXR1cGxlIHJ1bGVzIGJlY29tZSBzZWN1cml0eSBydWxlcyB0aGF0IHJlZmVyIHRvIGFuIGFkZHJlc3MgbGlzdCBhbmQgYSBzZXJ2aWNlLiBBIGRvbWFpbiBhbGxvd2xpc3QgYmVjb21lcyBhIHVybCBsaXN0IGFuZCBhIHNlY3VyaXR5IHJ1bGUgdGhhdCByZWZlcnMgdG8gaXQuIEEgZ3JvdXAgb2YgU3VyaWNhdGEgcnVsZXMgaXMgbm90IHRyYW5zbGF0ZWQ7IHRoZSBjbG9zZXN0IE9DSSBmZWF0dXJlIGlzIHRoZSBmaXJld2FsbCdzIG93biBpbnRydXNpb24gZGV0ZWN0aW9uLCB3aGljaCB5b3UgZW5hYmxlIHlvdXJzZWxmLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8dGV4dCB4PSIzMCIgeT0iMzIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPkFXUyBSVUxFIEdST1VQUzwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9IjQ0IiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ2IiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPnN0YXRlZnVsIDUtdHVwbGUgcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjQ2IiB5PSI4MiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnRjcCAxMC4wLjAuMC8xNiDihpIgYW55OjQ0MyBwYXNzPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iMTAyIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ2IiB5PSIxMjQiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5kb21haW4gYWxsb3dsaXN0PC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iMTQwIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+LmV4YW1wbGUuY29tICAoVExTX1NOSSk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSIxNjAiIHdpZHRoPSIzMDAiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM3ZjFkMWQiLz4KPHRleHQgeD0iNDYiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPlN1cmljYXRhIHJ1bGUgc3RyaW5nPC90ZXh0Pgo8dGV4dCB4PSI0NiIgeT0iMTk4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+YWxlcnQgdGNwIGFueSBhbnkgLSZndDsgLi4uPC90ZXh0Pgo8bGluZSB4MT0iMzM2IiB5MT0iNjciIHgyPSI0NzAiIHkyPSI2NyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjbmZvMykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8bGluZSB4MT0iMzM2IiB5MT0iMTI1IiB4Mj0iNDcwIiB5Mj0iMTI1IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNuZm8zKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxsaW5lIHgxPSIzMzYiIHkxPSIxODMiIHgyPSI0NzAiIHkyPSIxODMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHJva2UtZGFzaGFycmF5PSI0IDMiIG1hcmtlci1lbmQ9InVybCgjbmZvM3IpIiBzdHlsZT0ic3Ryb2tlOiNmODcxNzEiLz4KPHRleHQgeD0iNDAzIiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHg7ZmlsbDojZjg3MTcxIj5ub3QgdHJhbnNsYXRlZDwvdGV4dD4KPHRleHQgeD0iNDc2IiB5PSIzMiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+T0NJIEZJUkVXQUxMIFBPTElDWTwvdGV4dD4KPHJlY3QgeD0iNDc2IiB5PSI0NCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0OTIiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExLjVweCI+c2VjdXJpdHkgcnVsZSArIGFkZHJlc3MgbGlzdDwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSI4MiIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+QUxMT1cgIDEwLjAuMC4wLzE2ICBzZXJ2aWNlIHRjcCA0NDM8L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iMTAyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQ5MiIgeT0iMTI0IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExLjVweCI+dXJsIGxpc3QgKyBzZWN1cml0eSBydWxlPC90ZXh0Pgo8dGV4dCB4PSI0OTIiIHk9IjE0MCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+QUxMT1cgICouZXhhbXBsZS5jb208L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iMTYwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ5MiIgeT0iMTgyIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+RmlyZXdhbGwgaW50cnVzaW9uIGRldGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iNDkyIiB5PSIxOTgiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij55b3UgZW5hYmxlIGl0IG9uIHRoZSBmaXJld2FsbDwvdGV4dD4KPGRlZnM+CjxtYXJrZXIgaWQ9Im5mbzMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj4KPG1hcmtlciBpZD0ibmZvM3IiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNmODcxNzEiLz48L21hcmtlcj4KPC9kZWZzPgo8L3N2Zz4=) Stateful rules and domain lists become security rules over named objects; Suricata signatures do not translate. #### Limitations Where Network Firewall and the OCI Network Firewall differ * **Suricata signatures are not supported.** A rule group of raw Suricata IDS/IPS rules creates no security rule. The firewall's own intrusion detection is the closest feature; if you rely on custom Suricata detections, plan to re-create them there. * **TLS inspection behaves differently: you attach decryption profiles and rules.** The build does not recreate the TLS inspection configuration. You configure decryption on the policy after the build. * **Logging behaves differently: you enable the firewall's own logs.** The Network Firewall logging configuration is not recreated. The OCI Network Firewall has its own traffic logging, which you enable. * **Protocols behave differently: rules match on port only.** The security rules have no protocol. A destination port becomes a TCP service, so a UDP rule with a port is matched as TCP, and a rule without a port matches any protocol. * **Domain matching behaves differently: TLS SNI and HTTP Host are not distinguished.** Each domain list becomes a url list of simple patterns, whether it matched on TLS SNI or on the HTTP Host header. * **Alert rules behave differently: they become ALLOW rules.** The rule lets the traffic through; no alert is configured for it. * **You must route traffic through the firewall.** The build creates the firewall and its rules, not the routes. Point your VCN route tables at the firewall's private IP so the workload subnets' traffic passes through it, as the VPC route tables did on AWS. * **Stateless rules are not supported.** The build translates stateful rules and domain lists only. A stateless rule group, including custom actions such as publish-metric, creates no rule on the OCI Network Firewall, so the traffic it handled falls to the OCI Network Firewall's own default. Re-create those rules directly on the OCI Network Firewall. * **Policy default actions behave differently: they are not kept.** The AWS policy's stateless and stateful default actions and its stream exception policy have no equivalent setting. Traffic that matches no rule follows the OCI Network Firewall's own default, so confirm that default matches your AWS policy. * **Source-port matching is not supported.** Rules on the OCI Network Firewall match the destination port only. A rule that also restricts the source port becomes broader than it was on AWS, and the build warns about it. * **Several firewall policies behave differently: they merge into one.** If the stack defines more than one firewall policy, all of their rule groups go into one policy on the OCI Network Firewall, and the build warns about the merge. * **Rules the build cannot read behave differently: they become deny rules.** A stateful rule whose action, protocol, address or port comes from a variable or a `dynamic` block, or whose protocol is an application protocol such as HTTP, TLS or DNS, is created as a deny rule, with the unread parts matching anything. A domain list whose type comes from a variable becomes a deny list. A domain list whose domains come from a variable creates no rule at all. #### Other considerations * **Oracle runs the firewall.** The OCI Network Firewall is a managed service: Oracle handles its availability, scaling and patching, and Tensor9 is not in the packet path. * **Reading the policy.** To audit the result, read each security rule together with the address lists, services and url lists it refers to. * **Before going live.** Add the routes, and check rules that used UDP or ICMP, since their protocol is not kept. * **Nothing to migrate.** A firewall holds no data. The build creates the resources on the OCI Network Firewall, and there is no traffic history or state to copy. * **Read the build warnings.** Each rule or setting that did not translate exactly, as listed under Limitations, appears as a warning in the build output with what to re-create. * **References to the firewall's ARN or ID.** A firewall has no endpoint for applications to call, so these have no equivalent on the OCI Network Firewall. An output that reads one is removed, with a warning; any other reference stops the build with an error naming the attribute. ## Install and run The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin: ```sh theme={null} tensor9 adapt svc list \ -origin aws::1.0.0::networkfirewall ``` The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request. Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction. ## Existing data and credentials Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target. ## Configure, tune and debug Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction. For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.