East-West Security Policy Best Practice Guide

Setting up East-West access is not any more difficult than setting up North-South access. You work with Local Devices and Overlays.

Set up an East-West policy to allow devices cloaked by a Airwall Gateway to communicate with an uncloaked network resource. You may want to do this if you’re not ready or don’t want to put the network resource behind a Airwall Gateway, or if you’re unable to run an Airwall Server on it. When you set up the overlays following this guide, the East-West traffic is isolated to the appropriate overlay networks and clearly indicates which resources are available for East-West communication.

Before you begin

Check the following requirements before setting up an East-West security policy.

Supported Versions: v2.2.1 Conductors and Airwall Gateways

Supported Airwall Gateways: Physical and virtual Airwall Gateways
CAUTION: Do not attempt to set up an East-West security policy on any cloud Airwall Gateway deployments. It breaks the cloud access and cloud route insertion for the cloud Airwall Gateway.

Supported Roles: System administrator, or a network administrator with access to the Airwall Gateways and overlays involved in the configuration.

Set up an East-West security policy

Setting up East-West access is not any more difficult than setting up North-South access. You work with Local Devices and overlays.

Here is an overview of the steps:

Physically or virtually connect the underlay Port Group to the unprotected network, and the Overlay Port Group to the protected network.
Create an additional Overlay Port Group (called a Bypass Port Group) to access the unprotected network resource.
Add the network resources as local devices on the Airwall Gateway.
Create device groups to manage permissions.
Add a bypass overlay to connect and set trust between the protected and unprotected device groups.

These steps are outlined in more detail below.

Step 1: Connect the Networks to the Underlay and Overlay port groups

Connect the networks you want to use to the Underlay and Overlay port groups on the Airwall Gateway.

Step 2: Create a Bypass Port Group

Set up an additional Overlay Port Group (called the Bypass Port Group) to provide access to the unprotected resources.

On the page for the Airwall Gateway, open the Ports tab.
Select Edit Settings in the upper right.
Click the + that appears beside Port groups.
In the New Port Group, select Overlay group from the dropdown box.
Click the down arrow by the new port group to open its settings.
Change the name from Port Group x to Bypass Port Group.
Assign the appropriate interface to the Overlay (usually Port 3).
By IP addresses, click the +.
Enter an available IP address for this Overlay in the unprotected subnet.

Note: Make sure this is an available IP address and includes the appropriate Subnet Mask.
Enter the IP of the gateway of the unprotected network resource.

Note: If you are working with unprotected resources that are not in the same VLAN/Subnet, also check the Enable source NAT box.
At the top of the Ports tab, click Update Settings.

You’ve finished creating the Bypass Port Group and are ready to add the network resources as devices.

Step 3: Add the Network Resources as Devices on the Airwall Gateway

The Network Resources that the protected devices need to reach must be listed as Local Devices to the Airwall Gateway, just like the protected devices are.

Add protected network resources as Local devices

Repeat these steps for all Protected Network Resources you want to include.

In the Conductor, go to the Airwall Gateway that has the devices for which you want to create an East-West security policy.
Go to Local Devices > Configuration and under Local devices, select + Add device.
On the Add Device page:
1. In Overlay device IP, enter the IP Address for the protected network resource.
2. In Name, enter a name for the network device.
Select Create.

Add unprotected network resources as Local devices

Repeat these steps for all Unprotected Network Resources you want to include.

Go to Local Devices > Configuration and under Local devices, select + Add.
On the Add Device page:
1. In Overlay device IP, enter the IP Address for the protected network resource.
2. In Name, enter a name for the network device.
Set the Port Group affinity to the Bypass Port Group you created earlier, and then click Create.

You’ve now finished adding the network resources as devices on the Airwall Gateway and are ready to create device groups.

Step 4: Create Device Groups to Manage Permissions

To make management easier, and the permissions more explicit, you now organize the network resources using Device Groups.

Create a Device Group for protected devices

Go to Devices > Device groups.
Select + New Group.
Give the group a name, such as “Protected Devices," add a description and tags, if desired, and then select Create.
On the device group page, next to Add devices, enter text to search on or select the +, and add the protected devices to the group.

Create a Device Group for unprotected resources

Go to Devices > Device groups.
Select + New Group.
Give the group a name, such as “Network resources," add a description and tags, if desired, and then select Create.
On the device group page, next to Add devices, enter text to search on or select the +, and add the unprotected resources to the group.

Step 5: Add a Bypass Overlay to Connect the Protected and Unprotected device groups

The last step is to add an Overlay (also called Bypass) to establish trust between the two device groups.

Go to Overlays, select + New overlay network, and then select Next for manual configuration.
Name the overlay “Bypass”, fill in description and network editors, if desired, and then select Finish.
On the Bypass overlay page, open the Devices tab on the right, and next to Add devices, select the +.
On the Add Devices page, select Device groups, check the Protected Devices and the Network Resources device groups you created earlier, and then select Add devices.
On the Bypass overlay page, on the trust graph, select Edit trust and drag a line between the two device groups to set trust between them.
If you are seeing the overlay page Advanced view, under Trust, fill in the Trust button for both device names to set trust between the groups.
For more help in setting device trust, see Add and remove device trust.

You’ve completed setting up an East-West security policy.

Additional Considerations

Review these considerations if you are connecting to the Internet, or if you’re setting this up on VMware.

Using East-West over the Internet

Important: If you are going to have the East-West connect to the Internet, and set up a 0.0.0.0/0 local device, this can collide with your local DHCP settings if there are any on the unprotected network.

Setting up East-West Security Policy over VMware

If you are setting this up in VMware, you’ll need to set up VMware Port groups as well as Airwall Gateway Port groups with settings of Allow Promiscuous and Forged Transmit on the VMware port groups. For more details, see Set up a virtual Airwall Gateway in VMware ESX/ESXi.