Configure IP Prefix Sets

Objective

This document provides instructions on how to create IP prefix sets and apply them to service policies to control application traffic originating from or reaching the sets of IP addresses. To know more about service policies, see Service Policy.

Using the instructions provided in this guide, you can create IP prefix sets and configure a service policy to add the IP addresses to white list or black list so that the traffic is allowed or blocked respectively.


Prerequisites

The following prerequisites apply:


Configuration

Configuration Sequence

Configuring IP prefix sets and applying them in service policy requires performing the following sequence of actions:

Phase Description
Create IP Prefix Sets Create IP prefix sets from the security options in the Volterra console.
Create Service Policy Rules Create policy rules to permit traffic from one IP prefix set and drop traffic from another.
Create a Service Policy Create a policy with the configured rules.

Create IP Prefix Sets

Step 1: Log into the Volterra Console and select Security from the configuration menu and IP Prefix Sets from the options. Click Add IP prefix set.

Note: You can also change to your namespace and create the IP prefix set.

Step 2: Enter a name. Optionally, set labels as per your choice and add a description.

Step 3: Click add prefix in the Prefix field and enter the prefix from which you want to allow traffic.

IPPrefixSet1
Figure: IP Prefix Set Creation

Step 4: Click Add IP prefix set to complete creating the ASN set.

Step 5: Repeat Step 1 to Step 4 to create another IP Prefix set from which you want to block the traffic.


Create Service Policy Rules

Service policy rules are used in controlling the traffic based on various conditions. This example shows how to allow or reject traffic coming from specific IP addresses. For more information on service policies and rules, see Create Service Policy Rule.

Step 1: Select the namespace where you want to create your Service Policy. Select Security from the configuration menu and Network Security from the options pane. Select Service Policy Rules and click Add service policy rule. The policy rule creation form gets loaded.

Step 2: Enter a name and select Allow for the Action field.

Step 3: Click IP Prefix Matcher to open the form to apply IP Prefix set. Click Select prefix set and select the set you created in the Create IP Prefix Sets chapter.

PrefixMatcher
Figure: Service Policy Rule IP Prefix Matcher

Step 4: Click Select prefix set and Apply to apply the set to the service policy rule.

Step 5: Click Add service policy rule to complete creating service policy rule.

Step 6: Repeat Step 1 to Step 5 for creating a rule to block traffic from the second prefix set created in the Create IP Prefix Sets chapter. Ensure that you set the Action as Deny.

Create a Service Policy

Service policies apply rules in the order as per the specified configuration. For more information on service policies, see Configure Service Policy.

Step 1: Select the same namespace where you created your service policy rule. Select Security from the configuration menu and Network Security from the options pane. Select Service Policies and click Add service policy. The policy creation form gets loaded.

Step 2: Enter a name for the policy and set First Rule Match for the Rule Combining Algorithm field.

Step 3: Click Select rule and add the rules created in the Create Service Policy Rules chapter. Click Select rule.

Note: It is recommended to first add the rule that allows traffic from set of IP prefixes and then add the rule that drops traffic from the other set.

Step 4: Click Add service policy to complete service policy creation.

Note: You can use other fields of service policy creation such as Server Name Matcher for granular control. For more information, see Configure Service Policy.

You can use this policy in a service policy set and apply the IP Prefix sets to control your application traffic. For more information on service policy set configuration, see Configure Service Policy Set.


Concepts


API References