Known Issues for Network Firewall

Editing other types of information in the attached policy besides mapped secrets will not result in a connection reset.

When you create or change a security rule, the operation fails if the rule matches a port-agnostic application such as ICMP or ICMPv6 together with a port-specific service in the same match criteria. To allow ICMP or ICMPv6 traffic to match the rule, set Services to Any, meaning no services are specified

Use separate rules for services and applications, as shown in the following examples.

resource "oci_network_firewall_network_firewall_policy_security_rule" "SECURITY-RULE" {
  action = "INSPECT"
  name   = "SECURITY-RULE"

  condition {
    application         = []
    destination_address = ["APP-IP-ADDRESS-LIST"]
    service             = ["SSH"]
    source_address      = ["CLIENT-IP-ADDRESS-LIST"]
    url                 = ["URL-LIST"]
  }

  network_firewall_policy_id = oci_network_firewall_network_firewall_policy.EXAMPLE-POLICY.id

  inspection = "INTRUSION_PREVENTION"
  position {
    after_rule  = var.network_firewall_policy_security_rule_position_after_rule
    before_rule = var.network_firewall_policy_security_rule_position_before_rule
  }
}

resource "oci_network_firewall_network_firewall_policy_security_rule" "SECURITY-RULE" {
  action = "INSPECT"
  name   = "SECURITY-RULE"

  condition {
    application         = ["ICMP"]
    destination_address = ["APP-IP-ADDRESS-LIST"]
    service             = []
    source_address      = ["CLIENT-IP-ADDRESS-LIST"]
    url                 = []
  }

  network_firewall_policy_id = oci_network_firewall_network_firewall_policy.EXAMPLE-POLICY.id

  inspection = "INTRUSION_PREVENTION"
  position {
    after_rule  = var.network_firewall_policy_security_rule_position_after_rule
    before_rule = var.network_firewall_policy_security_rule_position_before_rule
  }
}

When the firewall creation task exceeds 30 to 35 minutes, Terraform times out before it completes because of the Terraform refreshing state.

The following limitations apply to fully qualified domain name (FQDN) based address filtering:

• Publicly resolvable FQDNs are supported. Private FQDNs aren't supported.
• Regex support isn't available for FQDNs.
• FQDN-based filtering is supported when an FQDN resolves to 32 or fewer IP addresses.

• FQDN-based filtering might not match traffic for fast flux DNS names, which can return different IP addresses in rapid succession.

  The firewall and a client might therefore resolve the same FQDN to different IP addresses. If the client connects to an IP address that the firewall has not associated with the FQDN, a security rule that uses the FQDN address list might not match the connection.

  Possible workarounds:

  • Use an IP address list: Instead of using an FQDN address list, query DNS for the FQDN over an extended period to collect the IP addresses returned in successive responses. Add the IP addresses to an IP address list, and use that list in a security rule in your firewall policy. The list can be used in security rules, but it doesn't track later DNS changes. If the FQDN resolves to new IP addresses, query DNS again and update the list. See Create an Address List.
  • Use a URL list: If you access the site only over HTTP or HTTPS, add the DNS name to a URL list and use the list in a security rule in your firewall policy to match the traffic. This approach doesn't depend on the destination IP address. It doesn't apply to traffic over other protocols, such as FTP, direct database connections, or API interfaces that don't use HTTP or HTTPS. Without SSL/TLS decryption, traffic to other DNS names covered by the same server certificate might not be filtered. See Create a URL List.