Service Border

Updated on 2022-03-04 GMT+08:00

View PDF

The production environment needs to provide services for the public network and interconnect with other IDCs. Therefore, set up virtual private network (VPN) channels between the production environment and enterprise intranets (IDCs). Configure access control policies between the cloud and the on-premises system and between the cloud and the Internet.

Take border protection measures in the DMZ, internal network application, and management zones because they can be accessed from external networks.

VPN

Static connections are usually used by enterprise intranets. When security and latency are taken into consideration, the recommended priority is as follows: Direct Connect > Internet Protocol security virtual private network (IPsec VPN) > virtual private network over Secure Sockets Layer (SSL VPN).

NOTE:

Currently, the HUAWEI CLOUD VPN service supports only Direct Connect and IPsec VPN. If you need to use SSL VPN, you can deploy it using a third-party image.

Security Policies

The production environment needs to communicate with enterprise intranets and allow access from the Internet. Therefore, networks ACLs are used for access control.

Network ACL NACL-DMZ-SAP-Router is associated with the subnet for the DEV&PRD SAP router in the production environment. Configure inbound rules of network ACL NACL-DMZ-SAP-Router to strictly control access from the Internet, allowing access from only specified external network segments to specified IP addresses and ports.

NOTE:

IP addresses and ports in this section are only used as examples. If the public IP address is not fixed, you can create an ACL rule to allow access from a specified public source IP address to meet your service requirements (such as technical support) and then delete the rule when it is not required. If there are other services, you can add ACL rules as required.

**Table 1** Outbound rules of network ACL **NACL-DMZ-SAP-Router**
Rule	Destination IP Address	Protocol	Destination Port	Allow or Deny	Description
*	0.0.0.0/0	Any	Any	Deny	Denies all inbound traffic that is not processed based on preset rules.

**Table 2** Inbound rules of network ACL **NACL-DMZ-SAP-Router**
Rule	Source IP Address	Protocol	Destination Port	Allow or Deny	Description
For SAP technical support personnel (SAP GUI or software server)	123.123.123.0/24	TCP	3299	Allow	Allows Internet SAP technical support personnel (SAP GUI or software server) from specified source IP addresses to access the DEV&PRD SAP router and then access backend services.
*	0.0.0.0/0	Any	Any	Deny	Denies all inbound traffic that is not processed based on preset rules.

Network ACL NACL-PRD-DMZ is associated with the subnet for the PRD-DMZ zone in the production environment. Configure inbound rules of network ACL NACL-PRD-DMZ to strictly control access from the Internet and IDCs, allowing access from external networks to only specified IP addresses and ports in the production environment.

**Table 3** Outbound rules of network ACL **NACL-PRD-DMZ**
Rule	Destination IP Address	Protocol	Destination port	Allow or Deny	Description
For AD or ADFS servers	IP address of an AD or ADFS network in the IDC	TCP	AD or ADF port	Allow	Allows access to AD or ADFS servers in IDCs.
*	0.0.0.0/0	Any	Any	Deny	Denies all outbound traffic that is not processed based on preset rules.

**Table 4** Inbound rules of network ACL **NACL-PRD-DMZ**
Rule	Source IP Address	Protocol	Destination Port	Allow or Deny	Description
For Internet users	0.0.0.0/0	TCP	80	Allow	Allows Internet users and IDC users to access web services in the production environment.
For Internet users	0.0.0.0/0	TCP	443	Allow	Allows Internet users and IDC users to access web services in the production environment.
*	0.0.0.0/0	Any	Any	Deny	Denies all inbound traffic that is not processed based on preset rules.

Network ACL NACL-PRD-APP is associated with the subnet for the PRD-application zone in the production environment. Configure inbound rules of network ACL NACL-PRD-APP to strictly control access from IDCs, allowing access from only specified IDC networks to specified IP addresses and ports in the production environment. Configure outbound rules of network ACL NACL-PRD-APP to strictly control access to IDCs, allowing access from the production environment to only specified IDC networks.

**Table 5** Outbound rules of network ACL **NACL-PRD-APP**
Rule	Destination IP Address	Protocol	Destination Port	Allow or Deny	Description
For AD or ADFS servers	IP address of an AD or ADFS network in the IDC	TCP	AD or ADF port	Allow	Allows access to AD or ADFS servers in IDCs.
*	0.0.0.0/0	Any	Any	Deny	Denies all outbound traffic that is not processed based on preset rules.

**Table 6** Inbound rules of network ACL **NACL-PRD-APP**
Rule	Source IP Address	Protocol	Destination Port	Allow or Deny	Description
For IDC users and consultants	A subnet (subnet b) in an IDC	TCP	8080	Allow	Allows internal users and consultants in a subnet (subnet b) in an IDC to access service port 8080 in the application zone in the production environment.
For IDC users and consultants	A subnet (subnet b) in an IDC	TCP	8443	Allow	Allows internal users and consultants in a subnet (subnet b) in an IDC to access service port 8443 in the application zone in the production environment.
*	0.0.0.0/0	Any	Any	Deny	Denies all inbound traffic that is not processed based on preset rules.

The PRD-SAP-DB zone does not need to communicate with external networks. Therefore, configure only internal rules of network ACLs NACL-PRD-SAPDB-BUSI and NACL-PRD-SAPDB-INTERNEL by referring to Network Isolation and Access Control.

For security group rule configuration, see the related content in Network Isolation and Access Control.

Security Services

Anti-DDoS

The production environment needs to access the public network. Therefore, you need to deploy Anti-DDoS on SAP router, SRM, and Hybrids servers. It is recommended that you use HUAWEI CLOUD Anti-DDoS to protect elastic IP addresses (EIPs).

Web application firewall (WAF)

The production environment needs to provide web applications for the Internet. Therefore, you need to install WAF to defend against OWASP TOP10 and other web attacks. It is recommended that you use the HUAWEI CLOUD WAF service to create WAF instances to protect EIPs and load balancers.

Virtual next-generation firewall (vNGFW)

The SAP router will be used by a third-party system to connect to the internal system. SRM and Hybrids in the development and test environment will be available for simulation tests. These points are subject to network attacks, and it is recommended that you install vNGFW on them.

Parent topic: Network Border Security

Previous topic: Network Border Security

Next topic: O&M Border