From 4fdb1b87adb6bb396ced93f39a7d02ae157f5321 Mon Sep 17 00:00:00 2001 From: proposalbot Date: Wed, 20 Dec 2023 11:23:13 +0000 Subject: [PATCH] Changes to vpc_umn from docs/doc-exports#976 (VPC UMN 20231207 version For deta Reviewed-by: Sarda, Priya Co-authored-by: proposalbot Co-committed-by: proposalbot --- .../images/en-us_image_0000001646961692.png | Bin 0 -> 128 bytes .../images/en-us_image_0000001796404809.png | Bin 0 -> 23749 bytes .../_static/images/en-us_image_0129473334.png | Bin 10485 -> 0 bytes .../firewall/adding_a_firewall_rule.rst | 86 +++--- .../associating_subnets_with_a_firewall.rst | 9 +- ...isassociating_subnets_from_a_firewall.rst} | 8 +- umn/source/access_control/firewall/index.rst | 4 +- .../firewall/modifying_a_firewall_rule.rst | 86 +++--- .../adding_a_security_group_rule.rst | 118 +++++---- ...llowing_common_ports_with_a_few_clicks.rst | 71 +++++ .../cloning_a_security_group.rst | 4 - .../default_security_group_and_its_rules.rst | 2 +- .../fast-adding_security_group_rules.rst | 106 ++++---- ...ing_and_exporting_security_group_rules.rst | 66 ++--- .../access_control/security_group/index.rst | 2 + ...curity_groups_and_security_group_rules.rst | 80 +++--- umn/source/change_history.rst | 24 ++ umn/source/elastic_ip/managing_eip_tags.rst | 2 +- ...rity_group_for_multi-channel_protocols.rst | 2 +- .../why_cant_i_delete_my_vpcs_and_subnets.rst | 2 + .../index.rst | 6 +- .../step_1_create_a_vpc.rst | 6 +- .../step_2_create_a_subnet_for_the_vpc.rst | 6 +- .../step_5_add_a_security_group_rule.rst | 118 +++++---- .../step_1_create_a_vpc.rst | 6 +- .../step_2_create_a_subnet_for_the_vpc.rst | 6 +- .../step_4_add_a_security_group_rule.rst | 118 +++++---- .../vpc_custom_policies.rst | 2 +- .../configuring_an_snat_server.rst | 2 +- .../route_tables/route_tables_and_routes.rst | 8 +- .../basic_concepts/route_table.rst | 8 +- .../basic_concepts/security_group.rst | 2 +- .../basic_concepts/vpc_peering_connection.rst | 2 +- .../assigning_a_virtual_ip_address.rst | 5 + ..._a_virtual_ip_address_to_an_eip_or_ecs.rst | 248 ++++++++++++++---- umn/source/vpc_and_subnet/index.rst | 2 + .../ipv4_and_ipv6_dual-stack_network.rst | 101 +++++++ .../subnet/creating_a_subnet_for_the_vpc.rst | 6 +- .../subnet/managing_subnet_tags.rst | 8 +- .../vpc_and_subnet/vpc/creating_a_vpc.rst | 6 +- .../vpc_and_subnet/vpc/managing_vpc_tags.rst | 2 +- .../vpc_flow_log/creating_a_vpc_flow_log.rst | 2 +- .../enabling_or_disabling_vpc_flow_log.rst | 8 +- .../vpc_flow_log/vpc_flow_log_overview.rst | 3 + ...nnection_with_a_vpc_in_another_account.rst | 11 +- ...ction_with_another_vpc_in_your_account.rst | 8 +- .../vpc_peering_connection_overview.rst | 2 +- 47 files changed, 893 insertions(+), 481 deletions(-) create mode 100644 umn/source/_static/images/en-us_image_0000001646961692.png create mode 100644 umn/source/_static/images/en-us_image_0000001796404809.png delete mode 100644 umn/source/_static/images/en-us_image_0129473334.png rename umn/source/access_control/firewall/{disassociating_a_subnet_from_a_firewall.rst => disassociating_subnets_from_a_firewall.rst} (82%) create mode 100644 umn/source/access_control/security_group/allowing_common_ports_with_a_few_clicks.rst create mode 100644 umn/source/vpc_and_subnet/ipv4_and_ipv6_dual-stack_network.rst diff --git a/umn/source/_static/images/en-us_image_0000001646961692.png b/umn/source/_static/images/en-us_image_0000001646961692.png new file mode 100644 index 0000000000000000000000000000000000000000..d8f9804a86ba17c29671c2e708ea7d8a55e9e102 GIT binary patch literal 128 zcmeAS@N?(olHy`uVBq!ia0vp^l0YoR!3HEv_nU76QtqBEjv*eM$$$R;|6k80#jF+; z?O^U55wJ5{BC7O~q*zc+j>O?r+CO>N0_0+A4p~TjRK7gvqKc1@gq@&$jgF-6A(h65 b!XFtDtmNgH8Ra{GMlyK1`njxgN@xNAeY7O< literal 0 HcmV?d00001 diff --git a/umn/source/_static/images/en-us_image_0000001796404809.png b/umn/source/_static/images/en-us_image_0000001796404809.png new file mode 100644 index 0000000000000000000000000000000000000000..3bd705bb1279cd4d15bff49f0dff7ecbc93e64fb GIT binary patch literal 23749 zcmdSAWmFtd+btL@gy8NH+})jE!QI{6X;S4Kii-OKQ- z%TrljYqRI+y-u&Gqp1f73SG_2@XQ|G&A8gb2UGfHQ;o?qTgah|^1-{}{P+TgCKiN2 z3x)B6ED;Sl_zMPKc(z-tLhRJ0qiP6&PQA%cYPZsY8uvr4Z->|hID1M6ocm&wq4N}8 z;1!sWqgSRaVcC5CRzMqB;MF3VMIMQo`mwOE5kedJkk;SdUv_kUw9saRC8>gSp=qNg zan-8|T|m1TCTqqVSwK6PJX;dJ6H*K-q0)((GNcdbmQ7czfIbK>hXA=hDSb>ESmT%F6HRqcGeClgC5a#eVDc{u+zE&Df2i4TZ){T5%T$t5WtTxfSeKWf5UPm3e)do|Xpcpgyc(u;81*;SqNzgG zz_PSR1XlAb+*!#|w^0E&n*lR)fYP%4O1Odc=g$R&HA#ty->s}@-rn9sR&#SnA|oTi zBO|FnUPZHRe+8??_VE>#l$p=j)`U^nA3h*na8T=Qp`q>E3Ir( z1A9YO%d=SF=?Q3CO(wKXXeGcPuaM$1t6j0lsrpelUs`goOpHLrT$7p_>zD&ZCuOu^ zB1=t8LC3%-Kmc$=@Y9x*mSPg(mfip)Rg#DFJM&J9%K5XLr~K3L@lB2Y#N~E>3r+Q1 zKJmkvnxo-!=|h$l;IQb)tydz25jSHzMR9xgfkJlG(8mgFoGp1pI)Z!7hu?rYTMn`9(6_0%kRIrNKa4#?g779aWyjEjj#l<-oi2TW0HD;tbfZ}zS8pCCy zQw|CMEXrTbr+-#{D08ljnSit-*8tgiSc4s!tI2s8XBGnn?!%LQlz5rMys}#{(7-J9 zmW8b2_QqoNuzxqq+F67JPJdtrg-9e07N*zBch`4d^8dFPzOJmT$N~Z=&r?6+;boeh z9g52bgv^$=-E^_%$W-4ZEk#ccY4^uRNA6b4ls;0Bp)~l%qCD$UDr=L7>gT1W=Al5Xg21(l z{7ucDrqa7i&>Ih?j(_5U->BH>GY_XVG&^fjg1q3}em2)%o=HCrihJG*sj)bwLf+j# z{z)mbYE@{{^rrKRzv*!wcW}+{3x|U5VXL|cu~XGbPYV=oULSTM?11DaC2cgv-s`8) zi?@5Jd&9{#GttTpmt>2)&VMYV0qQ3gcV*WC{^1E$(1TU&adX^nr&gWsuLB?-V2{rp z8xF68iZ&?!=8@F44Wvurzk{&Pb?^2D!a@_svipY&5Hp%eH-J~f)Z0)1F9+P2a<$cE zyVcLEYnd4vhbKHa5_Pd8846jLWG;TKug)=T=_b((6Z|rzp|Hskxnsa5098k*5sV5F ze&+4*dA#R8OH+EwD9uT7C!$fb(lex_A+DO4Yw5kQr7m7|kdxyZ5u@R=c8JU`Ip-X* z2bsKLMwUCwRj;KyH$Q*2B2MPlR3a_ivZv2#Z@iB}{fU8g@dsAo3Va+$Pxii(FLDjW zjZOHo3z>_ZB!RFdDFZm*%!&YwFhZz4)BD)@pI-epyh>Wk(=zFMq+7xH?jW7VLcH@8tp~NwayAl8Lnpx0$l&X{^u1Y0HNzbe zTV3tnB+9NeQq7bnkks4 znPHam0%u5jE$!WQ!41IqB8*q(E7%!nq{Gz+e@O3l1@s1249=HR-&3{sj2aD{5DeDD z#cR(2HR33@AHgEm>Gc;3Qx(~|H@+m^@&+F0dN@Kufg%Nf%2jOe@RSfk^P&pIQDkl~ zTr;!DUJU4CR>4e?`J19Fy!1-T#g8vK$8=4yG!1o(Ib-LVvR~F?8a#3E>MYLRB zw9JGmbCl3^ikg%luG&=-+SH1#G>ri;N)dN+sVg!%d=CIjCwnK>%->BUDc!)AjueJh zAs6ejE&!8qpW&wnek=1CmZU^-l6ug-1iZZJrT?OPVG*vNIUB1P|@ zKmnH^ty7ci|2%=Z?6HhJ7dH=nga3H$%e7lL-aT&JzxW$jx1{#E7RKNlYlkOvQ8w}P zi_d;H=F0U(#}rMm+aqJ8kvEeg%puw5k`*fA_k4^I(h23mC<0Msa{Jso`p3WwcR|JP zzVNx_3wEig(WLa(LBVmu17elqm;JlUsti;`Xy^-*Bx~1%L4GDgS&pq5re^mK``)Pam z7w)~4o{wB3VZo+sxOXarB>u1h-US`ha6%T<#TCinvNHv)b@wG=G--m-nW@(~mP_Ch zb}+iIKvjbU+4r(&pfam3bdHMaGo>%aTUjVHXLbz^Bv(L*i-~7kN z^o?Kbdd_m@40=t8AM={i{+*0P$_KENYr-hR#cSpeYlyv?bbeROV4uV%q&W4xh$s40 z=$wiScp;+SaoCk`ak<{s`8MA0s^RtyI7MykctIP6*(q&?T?ZCOo?IBYti0X_EvH1j zR7^1dCYLYRo;%7w{o+wB3Y8j@`N9tpqS?1jb>qZoDN5Iug=TZ6(hpU)U1wbrMO6Uo z0iSeJ<2Kxf@aqVFS*wzIvY%!hmCJ#Lcv^@}v39f+9MkwhLTdMI&k3t#O-gm;oFQY< z6RhjIk)HO0Mg9e}0X+@aXj7GVSW11$c6#R%h7yn=FGsjYvw2p7WOOnucl#=g zWH+jxht5eAq?Hu8hWIg`{L&{RS>9+a+{)Y4K!CQ8w_x)|5$Juy8?mtpb%px6uYviK zfqHU5J0Y^va_>?}@FAAVBolp*I?_yNrGT@t=kexbe1UUwPKm8*@~e5C&)(&>mG{M3 zzkZF1Q_Z)x^?+1*zrb;*uP`XaaE7VF8#YAp_>wP7QlLu) zs1-*T^6q{mcHhxTRUUqPEK|Vw`3QYtnaDVyPkoO-GW(<*N*4w;``7) zGrY#*?B*fYS1yV$rK>QjyEgUe%}qrG!%suU{KuYCmp@%-Q$#q)gkL=kKTgRKGFAE$ z+;C~K2Sv-lflrrNe)aV6_7=Vxp`;yJWoxmxPtN=3JGK=v!Z!U&qkI8Ro9xZMap;Ge z6aDwmPBv8nTD&V*zYunO;nU-e$MO0ZQsTq=OcU>k8{F7X5mOnzd)mS&3Oa>V@z!W* zk@o&Zv}zZ;d45Bg#xvT0PD(~aw%IfXJ8-V=m*zJrhbq!%TRNR!Q=*}A`o71M8}P`+ zO&n36yfHHWHJo(iccKADUHmT}pJj%r@|t%-SL(vdpJ)`hFT8A}5qalNa#Bxp1*Biu6KSqNSeWv76uR4R3hxw=r zV;tdo166xQs^>?PfTw9AZ|`oVZH+m&0seYs;@N1Dcfe)~QRG7Av0Bau{+h-pU#?Ym z`xP_Y)@c4&rj5u2;{r{iaihK@26G8YC3{?vsGB`L8_F}I@@QA%0BoLn6+`XdQr+rf z#x=?NV7)=wKkLqypfZ%O7HID4m8|31`_>YUB9cMhwJq2sL_IFKs0#k%i^m7S?(Ipa zE0ut|!`;J|BDM02&&i_+d@R?#79cP)j}!}gOfJI{ZQ#q;+$dX=i(GYSu^Tzr`z-&@ z_T~}9u2)|eQ$j9_CFcc>zR}4LZH2?05CeMKsKnMS>*}_eq0!zD1~~qblV;6Cbni$5 zpGDrhZmI2gNIAVZqk|A`+rdwFYuH;u>ig5k?ijzy=j;k}Ghc$3Y<--ALNF%Is?jX+ zTxzvUPy}#twG+|_u$1k3hJU|~L>I#rVI}Lng)+(>TjY1b=TXeO$*sRgfn#Wm=V@;dTBtu<2 zg5LSZIpMq6N7Qc*fy8G=hJ@rH?)AvqpE)KD!xj|s_|@l| zE<+aZc%*0N@9=1MPbW9-)NP#^)*5i+5;W##0php_h+V3(fi9SJ9?s+3H7H)MK-6?~ zsod6F(;wi{^50aw?|Qn!`8ivH5U%DhzOz%^)LD@H;=Jovjcs>k_hWd>nU012MR-m? z!hXfz^FXy@Jv6u7xyWlV##ZWD&R??{pI(By1+cWXB{(YYMfITT`Ad&3SpLr<=UsU$ zyabi``?JegPuHp>(U+x65_K2+uC%;ug#9-H!+(XE9SzDP10_8l8PduA2j5aS%NsAm z)B{i#_Rt=aki!km)WO3p9&tXw1mffOZEj)+o&00}fjCJ211zwm{8=XQ7p+iyLGIB6 zeN=YC&wLA>R4jJ8Re_gbNP8#HSka+jqL02*+ty_l>5_HBYPon)2{Pft0CVn;W+TYYc{MppO>UFoOYFT_Ycz)AzOPNp2rE_$+3{c$MPXw zF44VXY>u$B4kCi&(l^si0b_+q!d!zwuv$Mvu}VEPVG3d;Z5PWwz6=t>6tr|}gMVxYa%H%;cl4*ctXem%*TP6=vF*}9Dgdc0Q^ z`hGn;>M@tEICZ)A2|3nl+7ul=wZnu-se(ZWKd(7Ka%fMKe1% zd~}++Lb|GX7U?}9q82|C#q;MbFposz8X_|UO&SE zIhv;Ksf|v&lLW`0*nBw2e14UJ*vPnxUv`_Pkc8egvX%SHC2x|4VQlm;<4XC-jyqg6 zpm$)3A&JL53Y5wU?tW`J&-)eaMYZAZPMYENk+ksOEKkUF^9;K#)D=vYD0_uE#m!7d zJ1sK%_P$l#0d8EzR*H_oj0K0`ygVD%fIx?byP{Xite6)4>;X>Zs(_U@bH}6G0}V0S z!b4cmbL|ZqVE2uCs5fO75yO2E7k#_^w~^p0kKvOwDY~raw9sH)v z6#WW(p|DwJhJB@T-IDBGNnw5e?8jN?z8sIs1B$rIDL6tt3?q^2H=FT;+1xvOT@#5P z)$RE;WRo-TQz>rUmoey8iG)K_<@DhLej7Bh@xD>mi(=-RXIOLXu*{ z#0NFUbR}^C!wJcuGHUW4H&As+p`-4v_hlDifp~ zkw0ATu;#|JY0riV1N}l{a7Vee<^6LfQwe6fkW%Ucw`yw2wMH~o({J5Q)sJ6k@_aG- z{{R#8T-(*v*S`*Y?_$3lNb=B4XL3d_ch^lq*!+ zZd^lq6UUWdAaOt~ty6PDE#UL<^^-~PMI)vCPm1CBHC$+Zi1+$Q;Dd-1{qX{>b6BQa8_Itl+$-9;ey=rppzH}a%LL(-pkYyOPQ3<@rE{gHi8K=LFP(_V*MB z>tiohH|)r#h3=?1upvp{;6^?o7Dp{W%q-REx-f(>MJ*?}xOz33e-Hp_{g^DRRDA0g z*tr}Br92<-2)3^$H9n6-%^!XZ#}2TQhS_oKJ0`TT&e>=$tujP7&b7qTJ{>%>9cg^f z<iP4mc9X&3+Lwjm)oN0PoNPk|A)m;-pm8?22~?Opm{7C(8U0 zX5iM8z)!BYT5CHXrS+1UY{!*ez(X8U_L#Ht<~0HmYEy z#=CJ=#OwXcY=HjGQ9*^id-1qgVkLkFO2uYaHqnpuO=5$(bMlo6{6l?GEdzft-{Ima zDvT67;na+tZ6pp<#bxrAFQ);$ha%&$CqFDmC?+EcBtKk&Y62!aE;tE>rUV2u*Dw41 zYtT#1dnxJ8w%vPcc<+g5^zHeG(&be)a*l79Wyxdfr$#?<#A(ag_I$X=@4OZM$FWU9 zsocm9uz+@_j*H_`V)y*AqKaY_STriI(MWx+9|Z5ShM!VODpzT|Z#_ZV?p5xuPZo5! zH(vW~rJQp2O6sXf*UJ}L&Wvr2?%qBs^JhvzWI$>3F|{eP#~0Ae;jUSp(_mPN@x#E$ zxSn90Zn+QKD8u=h_v6eAd!TO`9DG4aXjks(R=@q@#)VYg8jnZp@Y9`>@Lop_1W3s# zY>Tg8{@nRd#IJ0dqM-!u;|3QBo|7iL__|{-uKk*fVK{84bVecD1_}rZzEO~sp7L&q znxCifsz0w-N_lvE97tB3uw(dkRxWb6N1A)!0`R|lbb7K*V;R|RC*1Z$4nJ0rh(i6c3DX;fseYZ7 zUs#P-&(QT950ag8)~~FHin)Gbrj}Z6&z+M;UDQ#;8nnrQR74GtHl2m4@bAIWO()JV zvRl5dbnlO+a;-Kv!fI<`;yQR80Uw-k3bs5X8pl&$ul={VqS)MywqqQ_p;7Oq(Q;Cu ztA9>`JhQ3m8lvjzapbv82ZbOYi?w35oEzzTg;D*z#7|49?{2*SePj`pXOEt3t=;|P zd-*3~;my{lFK521R%6#$kL?$O|CTclc@WETO7hAK@v02eJU6{f8WlB|^Q(R9SUHC& z+TE|KzWx`TX-;_DC44+J3fw7In1nT7Qdluk+Uxz@`R-Y)>SYh5*?ojLC%2%eQ$&5b z{CzX0F#E)&DfQ93EUjdTzJ~ja)2aLY+8V#988&5<18wlalbhfs_TG~Go-VJyM|e!+ zPP+Q=n4YHq0}b(KovLt4pzoQ`c(r`nA9mog3vOx5urMf+Wny=3CZRvVm41{1x>iR} z(~-oe5@D8+r+U*Ui8#8Sy2|az~9{hJVy9*znQsnSU=k?FUlj>{AVohJ{J@s`XpWq(a7tL&q zfVeei9WLDFcL?<7a!SOkc0bife>|3Sx#<`yT+$d9F2=U)`0JJH#dS_M&q(3aWDcOiR;JxO`>o_zJFivV z)+TCFWdL~V%=|Y)viSmQr*oy`29@|;#Kod$25KTeXtVN zV^~WFx*Z)cDxrgNnWZl&;O(EZgix9d4pwqZ-dgKy?5usZJv1s7z_pT1?o=>_t2U{B zMM!JdzS1g>DG#xNMNycqv6*pD(;OZ7O^Hr91Pv9ScNm@OzyE1H*}80OY&>x_R*uE9 z5pZE<_~=690pSwmSTm^jOTeCh8BLu2qmV^B20-n}zCJMXf>lnulO-kS(dvW#&9$ZDaiL0ble102A-lBTq-4l8I8=z}9dnsZc)s_!6q$suyv`+*(iUdLG zIHC%5%S62v$2WIq(`Jz8WR~`uU``FM@5tG?xEqI@9 zY;7F9|Bm^~LSt?o_?>G*C@k{@W6h?Fe#f#F-lOChFLQM#Ksd9&gLq$3rIP_dj^dZo zQ=RXyosJ{V@HFX*CtRcHWHN{=RoiIkHpOZx^d0Z&HSNn zM*ibtvV3ZJl%tuDC_0F*3R&oGWrT<($+~Plo^b=;l>EVbo=a?U<9ElN7~ zcCH^iSyWaZ{9Iz0IX{&*Kc6Ejw7Oh2-*EKHTcB=i91Vs7a~vg`y8VwPj)Y%OPE(M! z7D!ZHo^fPkq>-NVJ3#rh4yaE5_3PL0?tq-vpWkz87$OTe4|d+nX(qVZByxp*HMQXn zg?>IfA~d#kjHxOVpb=DZK0P!!by#@0oz}X?&(N-2d&k4wjj~Rbw2`=yW`G#&bhYJI zCs@~Y6I2}PA-uzrLM!X&6%t?lSfaW49LHGS6dw(Q-_Noe<(sAR6)08^CU?OPY&917 z(A9v0wg412m5`t`G&IcS2OLZL9*pDv{P~lLD01iFKcsjMgcMhFP{HV>$ys*jLS&GW zV;rAg+l|c*+peZ7e$<-V;?nxz!HlDElnk}wVb>NT4AsMciICwD2NzB z9Kvx!Bnnot{~w7W4!5?@#KrsnD|!&o{a;VH?okJ#NI>Kh|2?jHj*pMg{-*&^OMJ}A z)8oR5q5bzD@uDRA`jhO-e-DEH|26tT1}<5}-@4oZW!6r1#Z6T)%^uhWLT^YY$Z7$Es}DvhMQ`YzrVtK`GQ2rN*f)1f>2~>o?xUYC#NNnh)pX0 ze_!@Ce)-8j0V4buKzAMbErcU=NQh@@Z5y1@#Kqm=uxw!y8Id6T{QOy)STH!y99oA8 z+5HxoobRgFR1?NDFi->l03@fTs;a88Q)p^v%&e^NJ^!BtmmgE+nMl!*cxf}UvWZT} z;Cji4+j1ESb4%+BkM35q*Jo7GV%`pXXDn4}HF2^FPRReJ88(TLsx8_TO)acEt}Ch@ z)?Z)GUQkfb>T^fGy}iw`(`2{Q3OGsqCGkI7+=?k~z?n?B6*!L~r^a!=OnPuzOzW7^ zGR^Tv;0hVAn3RS##HWO7&lJs8>%OP2PQ5_vk0krUk1V|@XnB5K!rYv4aBvU_2`Sp~ z%>@Y=84`M?VhDNujf~)L(EpF!^qGHF(V*VG=*D$3L%b)xqT=r$(74z-d>5Eo)Bpbc zkdCNQft8al$kQH*NeG60;}*&o;(`GHuHN2W4jhzWJR%}W3JP&d47mS2=$!mm*&RQF zWi#8p+BGrjM_r)Yzll*YA*PtdMt64Cs4~a1lEBL7%x>M;??NjzBr@x} zV)7;&LhR9AAdU(sHdGebfKGz`#&MS3N+0-q_A(=I2InQ)vV?E8;qKw!f1C5s~-8jh=`P zq!?(W7C{GzoI98tv<}A-9C#p*go-PXR!9g}Vc}}%FCz+Swy?;O>Jcr&^9(2gw;Id@ zb=v;NKBc&PG5#@(Hb1Hq;O30ODiZ4Kny!SY7bSj^f2Kl+e~!A<=6enT3If&XD)Q_# z(1y6Dh_6pni^HOvKNbPy8zW;RVfm9f=fn8=gIR4>b0)OvE;#}s^0uo4kMum(} zj`cMu2NU`_^fZJvzmyXhZ*?wD2GHsV(nF(iO4h(#g=|}G#Xt#`>e?cQYMeFO`i6w} zqC!FSFZzA*a3zL(G5@&X!}m31p2xPUqLleLw(`4ol4srWe~RSCz-#{A{9nVC$_1Sl z<+#CN{J?)Q;d`#(*DWY<|nS`UPsb2iN0pF9-Wrh74M*(TxIH;Kuq*%r!ly zKVSrSgqlW(*4XlvmWU||yUm_s3&>vK@y;*u$E_$>re==(M?V>B*n9p&9+S z(Y`-&fGFy4rEexGb(#|QBP)3D>MzVGb((ZR3%Q?NYjP}luB0?;bc>VqdXHmDmR|-` zrkA;9wmg;+@jZTSJfEbvR&ebv+Bg0^GR3f{5^6EZ(daWV6T@;85VlyW!;{rJcYO}< zL_X>ruAKpmx8I#;xA;)WrPU0MKasZ_`_gm(GCm&ddMjrK^2kYg(b~WP>ADG%QQKX?@g+3nv z6$e2p5_F{j8(f+70!(q3eiZ=)*^qGLtaOX@YuEc9Mt|4l01h|%rY=fFYjGpOJ&x3= z#}!R}WeN!(gkxP=t$-!WBdfs5Bl(0XMs`EQH9T}%DzWRdj(c(V-4%Vp;K4aT^>O7J zl#A{;8d}dHcq>CrLP9Fqmuec(YL08%H;_&{cXMdf{MrKB#0}o>``uk(czDyyux5Udg5F{1d^qyZXI3D>M8{YB zH#oO^!en)YJIW^9qWo5tP-4rWOGy|ZeiY86B#JS$*zt^C5lmi94yVueM zoUk>mY7#S(lw1dF?wt$=hEK9(Y!+{&@D3}f_UAQ)U(G3+!PN;RuV+rbNQR}J)&iSu zc=4HLq0oQ92XE(ozQ!a+=yH$v8}GcsF>0ODYRN0qA97m(9Et6b{Z}mdv%fkaT}|@E zKqKzWohQx4lJ6JnXLKK~(8iy-{O8BZhU!hfizJM`@v>@j5K>n(q8k|WY*$M~e!U){ zb;8eZC}>P#!sesY@2KRvmvzT@(kT4qFmzbTsC$&AOISNB5ZfnJHRjN-ut#M`GcFRe zyza9)OcR8ZFMBgQvWO%kPE)+&bJ0-eL>3W{0-2tc6yoS>;9BW6#z#4&1fmZ5KUyR@;R>jmwNoD=;31;0l7)pNk_ z#&CSGyVs5ol6i;-1$c@2Wq69zeRCZZO=?eYV2IfsxR>;MO!>CyO%Ydvj}Y!uYn*}U zLQ$F_>Yu_vgH*a;biIM%R3A7_wi6%ulNHy)VdJNqwXlPkQR_AeJ;rxlz-pe|?e-|FXz!4O;B8v% z#^p<3XEI$H=?BB<0JwRc*)$a)Gf}1s!zOIJLC25N^ce*SqlU5=P2{o zHCOAD6Lq9=*)7&C3}hfiV0(67mIag;&mg~|WHfkB&}-Hh_8)Vd%rpp#Sz99KB*hY! zRM7t1l_uiFGL*kChHq*i=e4jJ7+R=EF~eT6A9xHxoqzDbg2=%t=5PuC`Qr z^H&NbJTI-H4-22WKV@e#O*^qDMm}ymyGH<4Z?`XDz{okN5~|B0VV`S3g4UBP9=mx~^DF9)<{o@W)UlV#_feem-dd6Hk!A8uzvzRaz@W z9;;^-ti*Qda5TIG*PBD~U~9wi+|;r&za9tjK`fL?eg}Puo2Hyj=N0Y9Ss`I5>++1K ziYzQTk81fb-Ue?W%82bQR_7f}XPjC*WT0MP!`o~M4~U&or75vyo$|*Q70D_J(8nSn5!<{~SOR9SjSA7*vzy1d14IToK8cEB8rYOR`|7?^ z1Bo1+BAkA(hj$COtUFZ8_Y=q>@(~w#W3Xr;7N-bIAbID2ONO3d+(M+@lI}UblxM^)Cu@a(S@sUBf@NE9G5J zrMh4l9H96$p!Z}x^tf$bn^=>&jHW8=f5tYgqHxV8m&&9a7o){H(o!#jBJz7n{(kV!E~yJkbmUCnhOq#yplrTkCQ z<}=posYk7C6Q85lmAQEd24Iq;3)^nm^UI#*jl5*Ftm!1lkknLYL){an{KpCH$LB82 zlp^P+Ju#0A0+Z$oyl?nTWsR0~(Q}FaM&3GDX9d2?8=U+AX}7W@1o1LG;Gl)Q@R!T* z{eCJ?(l*EaVd+nkqQ&^+QO;JHva4YxQ_}(~($AvZ{eZ!Tydle}P7i!W>hw4>A5Qpk zt>^QPuPMkI1MPPnSpx=Iis-beD{|@njkYYW4(7mEyu(P^0dGIdhyo@_Ma ze1{ROIHb%^*NKvN(URbls_XKtO7}>Y);%Q=FHcOx0p4F+@{v)`YYD23XCVU>WDqep zW43$&3Q2j_Y_8TD;gM^u1#82?F}+cIV|)4H)Wb~*#=5hMCKBlT6ak+LZc`GX#Ul(* zw{UrKW7^vRP37LO#GxgF6r zRE2PyNOKGEAvI4Oe$7JZz?rK5njSa0$t?~G^FzKDqgJ`}=Zcz!hXyU3y#TvRG%2HpII$-A4{Wbd>!_@@<*0I1Pv z{$WqWi8irkrNR{PA$nT%gH*ZCb!IOFZP>BK#`5Tu!wt^FcTEY5D}a~k{*!uynxR}jL*%Ycb|UHb+&%s2Tz zR@gDnj1JCFm&|-!cYHnGU->!(vuoF{iSzs%!tErE8j+L3rTKh>)7Nb*>F<*z zwjCd_YdT-}#>P=x4s5@Ad$)w&dCs|GEN14A0XviOfxOw#G0W%989(XN0KmeB{1$6$ zc)wX2#<;(hQNkrOrnFhE+a2WNzwYuJ1{9voTd?5sTU=>6{2{U;*MtsAV@%Kls5j%0 zy%;BR6e8VSwChO!xbNs}u;%*g7(4)?FQ5cdci*o)9#{QN55=0D5gAal!c7$HQ@O_aY=nUmP<54n$aW} zLr8McZWBo4HyB3YPI6oMO+3c!LZ;jCldy=5BM8O^;)Qx-<__!pxgxUpPXFer(KX&K zC3>x9DiAXAWmIn9p(qmvBF!RgPiV{b3pPzC;XdL#i)gyRQ8wH`bhAIRf z>Ot>b9%DY|1+((FNp?*`c@;|4G=~R-`8IkhJsHg;fsBz)wPhvZ9>Ye@~+B zT;i%TyRo$*!WQoe$+@48loZ4hRWSZ{dE7NBRohwc2LU#1(0JTPfNRzzRH({u*t6+UVCI!%)3M-o^l7 zQf8jsqh*^;f4@r=!NxZSL!;IVm|?}86m^+WA9Mt<$%4d6xZDbD`UYH$0wmzGn z&}KA>T&RORwsUe`c1O%QeQo7Bx;{t4UOHW_bH$8JbG5FDG@WX`J8TP8VLjUX_f1wj zTBk!I4s$6|CFQqis}Gl@)ec?WJPSd=WuH{Hf&I`^GQHyk?h#731Dw_u1iW&QA$dl- zQaT@z8&Ck;Ta;vDY$*txeFLZnN{;6j2Db=mGa82syq-;C#&aU$%2bBsUTG6ui_TBV(ZG!(aPw@%4O`kI`42}>w zy-^PB*UOh;lybqTRdDVwn}hotZU5UwvJZp9#L4HmMlJ)+Vq&vhfg8RAu6BoHF%4vy zb3*SA4!!ClTes&-TBH`MlQafik^Qggf&M7@FFf_m5M&U*$R(ykC9|n{Sj9!{F8j8q zM=~YT5L3x{^-a9k9?zDF;gFWOnOVO^_4s5Gx|;Xw@4rK|x>cC8uN&U^M9cLF4k)r8 zm(qrhMB*vLp6xECRPJRc3{p zS)Q)E|70m5#t8%loK#z_KG>R@BUq(5!LA{rvs0&cfowutPekGi-1kVEHF?<8KP7{PZz?Uv47g5PU z1ypYTYy2!FtBnP6E{;KGacb~=^}YZVS!kMd;8bXN+ji_zX3BE5YxjZQ#^cE<#C+~e2h%p_jZ)?@|WPMPurM?sCEoYj%UGvBs&O}RibB6x1ULGEE? zSHh;TrlhU*(BEr0t(l;rT|=x5sJg9Fa^Zjz($`&5%*?Rl>Gbo#mW!U)-rwZ9)Nli0 zvm2Y+ci#7ujUF7@+rzVbEM^3Yq8CND4&+`ZH-Z(O83$_^Pn=LLWqFgQyNrH!$fu6h zMkb^MrCe!qS?`1ELUm=I`IFJk`*u7<`sidj)<2zTAP}v*LK%_BPP0YQf9ZP*Rt;0n zHoHSb3Xdt5*7*p5*%51gjSpHjkSR!`5;!L(LuuYecYS4j$tI`O(sCiDfSS34{NGB& z@MBa4o>BgkmpDi6jq?HfzENFOGg~P@gJZ)JFaEHqBe>;_Szi7OVbbw?d&vXOf1uS+ z=pAPUgjhT6reT;Gal%KR1_71d6BIYizH4Pwz@pAdzr+L-(yQ}K|6e5ss;Z#DzsZnF z`!SAfzSIv{|8cK)Y57>~kNdTBiydA;PgS&CSSoF=nW_3=ER>7ap4btt!{X)0ccIC> zXr$7&4(I|Om!MWP%}RrA;)n3r2rJ<`o}}}Zuo%Kymo{D52T>s&p^25|L4ulr2>4di z^6M{+Yen7%CfdQX6nJIdM!n$)J(n@lS2zO(J<5bIN$0RDYx!mLGp+^hwJ1?QRcoTg;&}0^GJZ@dLg4PLfSlAFUFf_Z8}gPb3?^oHIWq1JcS>+17SGv>LbV{4>a>3{r# zWy(X>Dk4NWLs7e(4-S&`pgC#pd{v4#)`X2ht)BPFbGraK`l}tek|&A@B@AVEnn|vX zJOY|{&fh$*)AiGy6BLFBb?it)9j92&o=k`U8zKIWhd+5BPK){T;Tf;!KoMf1Y#av| z!y~KNc#BB#XwL{7#<4ErJ?@?DAYbb&D6KDs+0JgNkSJmmN4zurTLPE~n5fV=ET>@l zi%rNOUKuB)GCxbvBDw+oPkMm=HT-K;#AKymOK6RVe_G6NO6spn$rPe21Xv!!-;R98&Uf z3Y7Pwe6i;XR!_rGtjSlc$gld&w(FRZ5Sn@(!4JEh905s;PL zc6q4@mm2&(_zF0p=;;2D4UMJVF)Y?S_(5xAhMC`~p##FJDtL?!PnG->>8PG;Byt+f zpAzqQL(OOY+yrYsc%T-vlZ;)jk6Mvd|2^KbP`zd-XP%&bZlnTre=uq0OS;<}B;O~T zG^Kjy+4sNCDqN4+(N09r9BvV8K6z2#MoC>%pbMUno7P!_}{efS}b5gIjP2~iuEtK^Q70)L`WA!R`#sJL{S|F45BnZ&& z7K(2h)q8yh)^_)}HoxxO#4$w;_-AL7{mn>=i*;Sj&V`KnX49&$=U#WX|CSRMqt*9Y zUgbln#8O=d{V1kle$OT0c+Gr_qdLbg;43xFL~8vwWA;}AjZ0BXo!(e`y=MGj?X&!e zZ<+NW&eM9sD8szAVeQFi#}QFEOu=x4G7Uxu)w!DX>&AmC>Sv)2@v9O_<2;U54=e5j zfUa{?^IEzzhSIY-PHyn@O2s-*MM0;WV6;HUrJk#I&x^7cnP1f#ziHVS=!UFi3_XVvurxyM{TT1ZwY!y&k=B!28|f4g*jr)5-c zK1i@wsWVvbBm$n39Gh+tk}{te82FnI^oTUobIWYRs5M$m>~eRE&G>fD&}{(Zj6Clx z;!$kWTfIAFuI4HW?XLlTPIzrU;8=)_c0Q}b|K9k8UJdBq$%#Pin^2fAXs8L+N) z1|zRUv$C&_lmN2Wc%5U@3l6TrHc*?eF?SuNCSwSf8~b4?`p@k3JK!ivKP8T?4dDjk z+m7r4!GW74Qah%#X{_}Y4Wq}p)j+8nkhlE#KV!Qi#&(s+7U4-d}Zk`h>|w|zpfXEvV(-b~1oqTv(#sh~{k zA3Aw*+_yxUsA5&_yITcV@`momeJJ1`=2JbehaoLBxZi0aO)yTcHOJoR+4H(qS({2| zL9&;`?OxrVJUzW~SOU;z z`(XD?o3y&ClXpiZ1F}pvVM*_{+n~##4$bmI zS|f>vlWg!$is-)4^UULi+!3yj>V8*Jf~zal=QDPTJ-s@p&6@pJh{qu2JT+*)Ivjgu zN48>zo5hpmLf&j!)Wc^+dj?RX+>BjJ&paJk0Dq;kP${o(P{LrO{$bv5{f`SzPG{1u$_QZ>C{3CaRBj(FW17aL8f93sO-JFM0Q(L>n4}u~c zDbhiz1e7AZqX-jw-oic&7+6AQK4%F@x*tCRn9m6|Vt=c5)cAv$~pxLlsc&Q>) z=y!T2m$jbF$d_znuZ7G6%?$O(H*@ULMH$>@tg_wvq^<8-ENgT}v#KOy8saL#v_|i%BGA!btkv21 zL~45aFL`WH4h-(;gd)q{v!SKoiKI&o2}|vgx_$AD+p8gYP8FS*6k&?xNe=AyiS8&$ zs5_4b#jHJnCfoCiunK6dd?Vd}X9OR;aa69Ej_gpAnj;qy-f@kd9ErU_y;H@TqQL)Y zlS$Icg^1OAt>Ea11##2+=@u&~nb+`yom@!eF6!VAkHyj@HR8f8Y?9RTiLS-hr6H`t z$i5z>`^!ZLwl@`XGHSyX851*#9_B3TADDW|=qzVE(R?^AlSucz^8K(^`BjZ6W$1N> zA;ZCYnA*9$Ui>i)`%YqE1K&+`>q>?yB6P&d>#Lmle7%jIfjE%b(;!tF!3wj`a-r{a zd^AJ?`1P+-J%dL>6Fym(wg;F<>PHWLDTB!FEmk3Y*VI&Lw18CtI}2giKqY7HC6aq} zNyhI!2V_5YAOA-Kaf<;=(}M`VHVn?>a^u1rR`Yu_I(065Fz~_`-|dKIl0)h|oA*XY zu@s0U)l@;yw~AC#_~}Nq)vE3>{s8ZMQ-FXqepOqF-00-p)(X$RxvBY}H%x^33>nw? zt)c2TQIE^qs?1OB9TTYVOx9oqMb$Gg#n`XzAku_0`KjMvYii~PFB>;U zxuWXwg2qy+OXjTex&7gV0TEH7va?$D7Uq_i>W4B4Ti-m0A){PIIcM=(^PvJedx( z+~U!3it3b)cCJ&i*8M*8R|^3^Xs370P2EM2LV~);hl(U(^V{12{|4dn_vhM;d!NVs z0eMFM;$pw=a%f0MPk%p)q@=G)Oi6tc^RCwWA4wEAzFJ8R(z{c`N7UK|u zPsBGgqhM_!QKvPoiPF^2n30YwN%Qr9Ph$=OKosDsa(HwU9v;pJ0)?-vtT2>ch;PMq z*4FZ?sFD4Vco3UM1NX8TW2`PJ3L6{K%m~i#TSuG_)1{l;$KV=h8{CQh|tA%toZ|-{{K*;w`^oXp+YlDG=e1jhyo6N#uq7DwX zlG~@##xQqoubtEC+ic9xbp3r{2C$+!CS41r=pb{%LLuNI^Uv3>ibaPMZ0%^1!F1-g z^qk63_(OdB?OoQ?gQ~RjUld&W=ffA5m!wow3bL}nNEGS6^}GBwFL!9CzZ`VU)&G%zXUZpxkMY3t zVSgk^f&FAx?O zHPqHtR{RX}4Auq)bW>APsY4*fee~nvWVYip-p88d2 z2o+V5pE=Uc?yYajE5vJtY9D>Mu9X+}iG4o*m%=k=|8TW0HCtF*yk9w6QdL`<0t5oF zu(ED?171JBH7KV?2raSnY(z zSd$wpNoOYOSOWYqCnqNkE^cbIgK)@&cZ1y=lc3<6-)>63I_L7>)O;#FSC(X0cq}W| zdfxX6ptjqPj$O70($0O!-4B6*5~ru34x+n=#N*eg&9!${q=k0O9Mhev5nYoX@{;+A zt|`nAf*)_gUA-syMGl)bU3ZA}w-f zzH_qEi8V?ZYGWI#km_*Wdvf1&CL0|N%paW0>8@{~zi@5dsc=&i5o1`!rP+v+weH#j zlJT`AJ%r+6)pdC7o8vB}4Rv$Nx#bv~Qn%@Yh3Bh(pKRA2EGn84*tTd4x^laHa&r5x6`g_818;kTa)+r7G1~8E3I?y#}gZAM4%g&x#%p@yc^qiJXZ0 z8vb-)A30m8Q!^T5Fai5kH)Pn?@sok)%vs5sw9oP~K6kr%Z^?n#rTY-jk7W;e!pwnoPk=9@T8vMnWI*q#9wy3gzWh6=qPs%*J z)68iL=9+%wWfRuzu}S^VcmK{{B|vlDB<$qXFeYJUwIa2n>4l&82HrhAC@M&Z1wc;# z2=x8vh*r0Wj9}lRcplo<;p@o`xVlWAs}A|6k{+U4`xe7o1qTb z$;i`()aWe>J9K)ATM1-nZB2I8Hfos9k(IwLp&m5)>N0{^#LT}T?(8%cbL{_(wF2Qch;jC-YwFDpUa@WIN9QKPt}_fNfv9>oTIjaDsNwxi{02^ByLQ6$)CjF1lT4hE!rmo&gxJZUb!IDhY?? zv;s@#KsO9~FX%3z(~yz~=c!_>LJ`R+{;elRd$mcmLmJzthOgHnDu63j;;>V8;Ngmz z_)a;GAkW&@CQ2tXj50;H0z@t)B&Lk7-;{3fd)Dx?zIHc^EPs)}EX`BHUhB`bC$UdIT-!V4y5)cxv zKN`5)t3KFp#ZB{4&!>lu=hg`at*9*s=+=wS7v?hA5Eq@;b-En=fX%Z zcfFFX59}bWHbsYIvxV~5Kj4u!6i)ze2=+# zp$*)AB9tFgG^ut>7>nCN3rb!@zrVM?OK<2~NqaUN`wIMJJZD6?bL;`}r5Jm!f?18v zUs*rRKk*4hpyuSBdy<48eZ@_F^hpuj%VkKFl`|RaxuH7P#WdEoeA2oL;~i`0m^!0w zDA6nQ1LtDBJfH_CnR560VcY{t1McgG?br+-#q4)4fs+YN@8%=+;h!q0r9zl=o3w_o zusXu_)Fs~&54|55I)}jz3Q2n93X%o8e*Eo5mjsOmS?`Q1R{MQ*Ov!d0h+6x9<;d&;K;{ZPnEFyc^qO|k(R~ZTl&qwF`gyr)Wy-%4K_F!Gc z=y3nZ;*t)>80_1$agT@Fr`^vM@9k1_oKIfiw^ier7s9wBW8|H$6!GQ25OG^)oF6n% zz12Sa?8o~O}atp(0ZF_hKwqgYkAL}E+W3}=t8@Hh}3WEw#ohg+V z5|+!Et#DkTA3kYE-cBrcQ2SW4J}=H)8Yt{Dlpn!83tkv=dZ3U?Hs)V*j)qqRw>bEW zeXJfmKBdWnx~HPwYV}^i0XZzEvGAs8;7!G77ulHQfDI{P27sh~H7dgs^OhVDuhU&B z)Mg{Mk>lG04uEFc-WrhRep`sDdLM|HlWJK|-X+3i67XHYE~#N;L0jc`p0%w0n5|A9 zCooTlObIYpYd#&Fi$e}`uk%1xsT9A_Z;mV|$P{3gLVV-zo;v3JY0tujwgxPDbi8;i zcgT4GSaVLIwxQmM^I1yUrYcStOyWGNAbFo%ZFpoVs-!7=axwDCJ_O>uk|FEiML}o4 zp%}?GWxk4#Lb4lGHU#GOqrFXj4DKcn>L&gWZ5Cw*^_ZY?oV{0*@V z@I_ig@F7<-KXa@>!diabx%}q<}GpM-C`55{=ahWPLb6VBF6WB0N z8tuA;ry+Jkdq3*LlXQU|a}vInk2UaFPgJ0Zzjm0j{ur)DIhDB6u#m?dp{ppJJ^=^| zPNK2CycwF95VZ4>rU_+j$VP2rSB*{GcPyW)mYY8v4+&!j@tFB%IA3LfnQNi>jN@!hu-$c(^R9`n#vX$%J zT%2!(U7{eo7g1h~Q^ELFvvxkGjGg0Gt1?u*isJIZJ(xKl&?5?sr*-kq$9uZ3_=Mpz z&4T_bZ%wRZ87|esuwgHFwGI)5z2A%1rJIy~(k1LS&>gfL+r+Ld#McsZIjDLw3n4u2 zhTe)oe0}KA*JDH-$-mc8@cLg8o5??=+|m){I$~AqGcamlpN&)hbG&s^t8cv^jA|aP zu-lngitgEJlSBYe2wJZm_AjCZoDsV7k6N!rrEyZ$B(IPYS#|R`FUbT|TCp9Iv2W4H z_$wj_BKm2X-gf-)a}jJkYvIaT$J~0{sbmo&`+$H|^$K&X9BRDQT;V8S z)o={~JV-!X@T&Mq0(Yb89hrwS7jck$>ZXzL1yy@{A_!3q>%OiKDZ}S>{#_(V_mELR+rd?DZ|xQZrJ2c8}v%IK2thg4WEv_rH#p& zvBUp(2Ec)$iJ}ini{T!zKQ2G=x;4FY8s@(qnXu^qi@vig8f-tpArm-#)%N-d!ukk| zRt8QYFCw_AexPGMA6<#1WT_VFx~}K=G-0b>fkcN;vaX-#ogu!YGn8{@+{g7O;=RUC z$qP3@n2zOt0?lsVNlkW7@8WrT`G)$$go{Jil#dU?(FVrGe(EwhJ^$Rp5{HXk^6FGt z*f%i`!!d@a($nnq)ch;`G4lD^L#UQ1q6c$T>qNhWq{F&CXOgAiW0tcZ-G=pJsS8>z z*fDRdO9!`LOi1Q;vyymBkyV@E@dM%!MHhG_^4ap$Y?T17v|lAfwTG)q-$u@RieJ6| zGhSHWwOLS#4+8#^?L1#Q3T&AI!3kSd9i9i1LzCNjIkRB#Qvw6B(XE7AqpB7UOMk9N zlL`DA(e@t5JSH6bHd*FbzDaw2TXIM(4`d=O09dws!HZh0uHlRNQ!hW?OnAPyx_)nL zNC{b;jvOn}=B3N7D@m7m?0w#u^9q^BzT}!6c-7C6qdqGY<9T_^MXvZM>~7VF zROr=iIO_a>a0sRTZ9qwWsuW9{xyI+cJ~&s|+92X)-mY0xvq%(X55umm;R?Oa4Lwca zSQ;7&h{OrzKk0d@v^)opuDaM8JAkoDMQ*A4F`mGXlC~G;)18b_DX3iG^|1?kcU{p& zYa}So$AGzV80E)Z$rw>nHe%scFEBhi?HYp_6RyRRJ$u ztNYDlUylUaQ|60ML3PMA-P}ruS@i&jenJXS`El?t=hD^tNOz;TFd)!N&10^0mkl5< z9lDUTn3$L!m6dsGYRwx0Y3QLo`z?!+$%UNJmu^O8MiJrFj29On+fE0}Ty6IfJrjKl zem(d9@8|fK65{@ib^G5U#bi(K+?0O zTV^PMX6EKpl+L>D&-i-^DkcA|BI2HRA&_7q>c#d#!_Tkn@IoSW>gkW?iY;N_n7>t~ z=7+_oZxU>MT3S*;87ctoQ4i`q?!WlRz3RS$*1BUQLiJ$Xp<3%hZfh&a9ReO6{w}q0 z5?X@elOc@{IVU-z`U;?&))qbUyl}ua2QN%ZODiZSXb6Q8qDGtFJ89y3_N>wI$2Z$b z&_BUMoaHM@@9d$6%X+5)3Vo@ZKW=$BEHdV?BxA7NPx3K=y3yfrnMx9TvoW=+9Hg$a zjh!8vsHiUKnmGqcNhNM#Vxr^qg)0Eby0ljO+d%Uu4xi7Fbei#rh{x0KD^|%kI9c+afM(&CQ{I zo~{7!t$(f|;eZ3*KiQmL6M0t5?^)sB4}fLkKbK_xR|<&dH+~3%*qQTJ3&eo+_+JXL L;FlFI-hKEVM+eXK literal 0 HcmV?d00001 diff --git a/umn/source/_static/images/en-us_image_0129473334.png b/umn/source/_static/images/en-us_image_0129473334.png deleted file mode 100644 index 9083ba2c1cab6f26f25ee4e4123f543e49a5be60..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 10485 zcmc(FX*iVc8}>AfJ%pm{QORBkg&4_FBH6d0$iDBpu@p&`60$2>ma*@{jHR+=X9i=2 z?2MhU5AXQDAAaTA`|17i9QPc@Gv|Gu*S$RFd0lsehPpB>H7hj$0HA%M@>ml9INwBS zyHb*qo~bgm-T(kM;K^foZSQj{SU+bSLgVfRJr4!h1#aq(8mkwla}4Dfz7hTmEcs~M zH?eh~r=0zrbXVWy3VT={-GQ=4<%g{4ckxy|GF6XnnH21t`-!4sd7<#Qxl8Nb#nsQ0 z->f5yA8B=N5n)|8yS3%(etdp>Mw=$j+I#AcP)^95V^|de?`6QTvs@^9<0j~0dja_5 z8)D3eXrMcI{SN8(vmnvQA9RvVU{`aV?1DtbCfr4KD_v-&z|Nq`^N*e8vr%2Q6o;c1O8yoxZNfuvJ;jX^R zsTodp)uFBPufhM1MmBFO0kD^n%zF9q<$Ps&8q2$1Z0+FzhdcQxG$BcU$KaG$dpQ_& zesa1k+JgP4epg#VBXhbf#_A!U*xU6JCj=WirlA%v<${&@{&n`Za;68!vr$HQR~FuQ z+!OX}&^%_MU@kz>Yl+^?vhbk#a=qU(Vs^!Ywl1iT4b5h9_joKbu$y7MtLqa7p@zeC zp2>F`)l6W?zH5ciK%*~9Q|Po3=HD+E zByI4Ecg_bpRRpmdb@uFbP0#zS8Ozlfy2Uwu4oI2c^HJu`AX7gC)bbyF7S~&CF`uRs zy|R&@H(|>nM`I@5(ZQmElPVjNwvA5_v+_9rW;rG2Ueon+Z<4q=6CfIS&%-OpSXf72 zFn*7iaxoRmTV+6V)8=^*xuDpD1uy?XbnfL`t}d8foK9|Oh)^B-57aanFfSgQe-rmW zdsi2(GF(CyoxsE|dsExxf!ey+5W>k)S?L^i(|~eZO%35RLgV6koB}rH&i`Ekwab-T$Ao3^cU}~3P=h@?+(K^;3cJZ|Eq^oHi7R-=*Cq%m=PRxM zZ8xxtuq%F&3k_knW+^+~UAqHc4|Fd-Jf=l;$H={6>05n_FA*eTsXdQPv#LP|Pc(vS zWNdU^IF>U_HujR+jP4ru%I3(undPAjq|i6a?+nfWobWmy(A+bgYuQCSRb9@_H~m%A zpl`rBMb@#gDgl=*71KLt{7^4(eGRSZrJR%==wnrDzT#ayZu_CtyjcTga4|j7c(i5` zja}dDJcbnnN(7d%ak7n*d3;%`JKyE*rthi`n(famMo?ZbQ zW*>%)|J3DoG@ibS<88Z!SGs|B-B@tMYtD9_G*Eps56xkrNzax)g{1KHT&2FB7z)LY$YsldnCYcIFqiwG!2xG8E^nB5(ZW!{!pCmNk3 z53?IN=oBSYk#$roPx%wNa1lM&y%)8jhv{=})kh+QmkXhcy@Ft| zP;eL7@?7s=ajK7`;-H`#m86E&%p{oLNn88U`TdQL1|~in1$XrJ@U-;=7aH|x3#^=% zBFam&ZGx3;umxUMh?SZwE{8<9JsRD$t1>r&2k^V5SC9opeTLeY~?s*9Jc6 zg{Dlat-PD1^rs;k3t+NFXRpj*Zd!M!a@i)5)rER;^l{PvSEB>JoTp)09b#dots2=4 z@*I8plhXm6JQ}w=bE0x~q_rQ;dwFYkW* z@-p3rV-9Ge-HD@}m_b3yo{*g$ zzlrBy^DHW-*}UXqE#-j%1A;$*LdHyL)cWc>p`2&0L0-%8Ap zTI~?<`*QI%O`F5=9jR3W<1_$_y=*8_4ek*1=%%n5lu0bU>$~a(5HjxZy^96 zOf+^2;e?ko(3;6kDWW1egd*xcju}6{#=KYW)s@R zp~pItZ&5%#oA~T2MIm^iR>~Wm_Qd!Z^oVv`>(dOrYna@$SQe14u$Celv}5SNmRL zqi|Q`R(Y8SV^?71QLc={z0b^B4B*Ut;HpxBq`I;z^l-Q}1VmW!si zk@7vmhDVd`OxyrE+5UcBJ{5_kzE8pZ#|h1k?9!{n8oC|3bxaH#ye6GoS9*>DwKsy5 z#t&9k1N>u)xXA*q#hwp7m_R~AcKCaaQbDvz>xVAWoV9wZdR+D>@Fa@qnd2^V_zi|T1`4?(CWM>NGI?22$kKDPEX?y zb*q-~4K0}J7{yty_jj}UuS9t;2pJRqG_wMn`sCmx(%e&@r{`BGy?$ZiAikm$|U)ADhKJ*aoMQ!%Y?ILonTaM2+u3i}oN4pA89|6N z;JsivxthsLZ4M6N17nFFA=8QWr6FX;7tq=>mb-h@DdSDo-3s|e+u<7w;x?3afhF0t`1zj?=w#7MT;A+X6 zJ&Ib~ps!`vYQ`Vhgir+!>SVU22Mp(x@6RFbmzwe_eX!R3lp^6Uu>V#K%j%>%U}HaH z+mQar@~1MwgUv^wAKu13dVBLv8Bf#?{hTzKZPBH|#^H=AH!_?o&_NLV!2ZX?@H#^K zM;(lThxuA;G@vcX{j)wr@DXDsmHVDgZQJ9KwEeCKR|SSZ-c!+{Jv*2W)ffF#mGf|`mMPkp5iBbCN&x)r{%e13j~r;nVZzsCS+5T3qA!9{35p#p^m z9@lzk^9nb@{;v=R1Q$_hV3Wn4GCulOa<^NZ15WxMySKCbtK6wcrzlN3Gb))UHq`z47v%Al?N!D~)ua159hoI7)ia+JJ;i+a*Zy@*Gx<$PKFOm0lJ&Xe>_6`dE7;R8@?`J(YVKh|C+)GA z({hbv$uEn~`uAkT)@}4_s&l59t^6tF5iZLkcUG`)J>?kA?pve95O{$pGH?k6Gg88o ziT%y8G6ak@X(UcX9&DK+K6CBlj#=@gc`ed=9Il`Xpn2L|N#S4&_3MWKT)9OgH4V*h zmU7GooPnBJR6${(j;7|Pe$S#0f6vMT=I@0Ah0o*jkGA48+Z+Yzmu(?lgj@03a>{8! z?8lZ)IT8(U^|e4_7_VczY)-Q0t{SWQ#nfr~u$jA;+kLrS>TRXitmDNX8XDYseyPO# zrxseuwzdX3vD>yp*BO*}423BD$nm@N`qggLc^aJ=mgcm6<(v zca+0D^ekFE>NTST(xJ`tfpEHE!io6v3dfAhPd$EBtMNI8_1l*l>)=@;jXnu;L^OeQ zOh;5 z@CCAhPG-BG*-w(S>oj^L=fj?b9h!T9E~+q>P9IENPJTUG>iTEvm^N=lXOE4voUEOI z8O1204E^0-(E-{A(>AR5F$pfi5{r|@$AvgdQFn@*_C8*9d!h?fn0unHcIc9S;Ql!} za5F&{I)*FtM(&IBsh^*`#MQNKlPvpWth(f>j)j)ESRHxKFy-~`LIFRG!Z0<)sA?^5 zvBIlBodSKG{3ki|--i&9f}IgTDZ%YGDJ!347Cb5x;LG0*)>IpyesRI*R|kruQ*M=J zl`ElP((Fe=3qKV;&W1-X6_1qj`u4*x8nh*aL~MX&0WsXNNcvk%=xbKB2?r+ClTyx! zX{Q-m=sZ_~>;vy-=m2fD4vnMP+!(n5^o~{UM>IY+Q*EpGJ#9hdm)b2ar6mfvD>>(M z@qU$?YA|Btkj0rPMv~xmGTe>;?WHz zB|Gn0gm^%p^DqbtZ3}XyLo!$=H7(6o^+CL25`XzIteYjHYMy0iT(@x>miR+Co`2y?f+VZ+lYC)Wt8Q=;(fP@K$2 z`~9l(^`kqwKYdY2zH{}C^{7u?&1)Z$qj$XCZ$q3L4>Jz-Z#0*y_6+S{0|9|6vsi+L z*P>a?T37GWjTbsL69^^=WTHsJ-nWrW-m110556=x_cy;{xJqaaYZb+%4x*5qiY%tq zMk;(eD}@uVF4MOs4AxAf!z&hR>pc&<)&HiSd5Vq;Ms*`zqQURVxe{HUS|R-j$aUHj zSz*qL;fw2R!IspuDMGqLyF{!+6jGsr5fR$`>~r@;F!%X$UPWF%`vl+WUa%U5Urm-b zD|%0&eotgFWQ5y$I2~$TM^>?$0OD05EEQzvYa}0Q7tT`TWEjn3uKiI;I99+uU#im% z@DnEHl?e8&h&*y|Js!N^MwxBNfUCc!Sb+Q7ed-zKjq~5iapb>!lF^h+#wOk^IMOQa`zV6BxIiPm`wF7o zSn%mhYXkiSNNEw-*h2BgmMahVg^wR|^PaPNQ99yS{@ZZQ)Efi2aw5HOz^(4rMF0No z)7W?hFt^sZ68gXnp`Vdo;aBT5XkZG*l@u-INj3#VF(kGi;CU(hJVmq(LR`Ufa3&Zl z&S$MsJ3S%?6W&1n2-P#f)wod<$`W)P4v-3bRgk<&|E*Uf!4u%v0R1j6uTskn zGS-ikmYW%`qY$4gRZ>CQkULO}EE&F{9J>Ca@*6ZQk5i;ufr9Y1 zaF0sxO@mJK_qh*SI<6i2OCF1`19VqUw39yJtvw5~|8AepMqR_B%x+dqx#ngg_eFIp}QVoewRj>Cc$LQ|ihdC1*m& zQi&amSxN^v;q0*MS9?If+n-y%=CD7brN+s*Mp0CsbpVh0Ih>EqsTW{98q>`PELSX^ zb)OF;GMZZ^US|S2+yZk=l5Y@ievhYNF|3t-Mr?sYrn$cF?qxHwQH(v*jhL*Ff5v?8 z<|I}-DSMG$q`0xU^b`4OJ0boAQZ8-_M4Gcft;!3V6s-mB5VPdOdq$@!01+ff?RI}5 zzFTVBtI+@>f09*0IOK57y@`3(6Z4kn;m}twf0Qs_vy_(8(I~AS<$66}w8;=PKE}2( z%Jxc1YRMgjtJ&t;wHMeUc*#wbcQwxSm^%3@l;|p^vovhE-jax$k4YUZDjTP^=U^~i-0LgF5;-Q{ht-%qj28oK4_ntRF=d3$~3L#J9!MCp@ z;6vNr0Dun|DGw(nK9*l14}G;^zskNCCj?wk=DzZ|lW=Z_Q~7n4EIr2+y2l;~b0h7) zUDe{So85Urx2t8F(xh*0)2KI5hs<5YA2p$dm+R$A%oa;3=zhGCGsmCzFCmZ}SCKHd z-nu`+z_^@8DE7zFIf!lCqvna4>MT*{UD4`!_Ov78S<%lnD>!b-)qwPaS{Jw!LFofVaIf+v_h7o>;>m*`|ERm&pI55g1QdJJ%1l=%w7rSQNBF zG>oU8m+^V&tM=LGMqFAL{#VjT{;DYAyWGjFst&aDY1eYz@z9fb$bkYj@UUu$OJ+F# zSn9WY<_f6XQPp>fhhwtp&zrB2zSKaH)T=h9A zgj*x+rNgh)%l9)C+K%S>((1Q0|HRS|8vB{I1l(NDb6t4=O%Ug|1|tm1HY-qvNNGF zXL{z2)jDSz}kH>9F5;y|9_&*;I2%-^NI3(vAuesztMJ)C-{ zo_a4jI&FC62q7R+XPEU=RC`T*CFPyhgfEaI8jVWtoLf~NLfM`i6Qz8&t(7`FSH^S# zsA)WQMy;$WIRyWX3^qmH_MF)}8AA47h2PG#P`+Z;^^W z-n+#Rfl6>S$wghYsL0J#8Xg{Iz31(G)CDe!%oNr_`YNGW=IAaauu(UWSW7DXZqH9fS(`1RSogFlm z6$C}RV=0TEn$0oUR~7KG;}RJrel*jQxhu1FziXy4XK0=s+SsTyc%SP={MOt`Z_oRL zwH#uWPu23x9N1LS!OC5&OX+jT<<>D1oVdF{8!B&fROBVOI6h9RPlN46MLB+{R6C#4 zO~%VI%__a3NU3XkF8Fcw{DgC}lQID@Wr@ABubEb8xPn_(hG9MQJs`bW8#(5LK|dv% ztouhb*AU%_dAkUnD_Ks&A- zr-ZQCEmH%pUDMXcb{xGhGyU9lG^CO{;Q&fhba20(V&C zHOy8?^0)q`+w)u`k|1glw{_(Z1F7xN^M}sT+bn!rEIZ1sk(1ktB3}tS@SN^;%&Y@o zYf8;O%pU8hnmgsXMC#x4A?<<);IT&*hl<(!1_fX75V2!^%{ePKTKbP~^O}2CBhuH` z$H3@STS&hrMy9nvMO*-if5=g(+Y5PLLLV|A<#00XR5?TNBAf^a>eOvG5GSmlS#l0? z%8Ad8BLelu6{UPM)*1=X4&86StDsY126P{}q?UBcp#*1X;U88^CFw zlhA^)ET+zHUO4`=Vnt8&vezl8sAHTXLYVGv6s5I+689Bl zyzb2+Ij!_F8S3NJg8DFca`58h68~+QU=*`T!xg8M#tJzQVg-o%3E8+0xf}y!!VMrA zH^?LZgai_Gb#7h-04PgO?*a(lGOlPAF|JvxSot%)zI&U%Apk3KUJ>5OKb|8FO#o-a z*;<&o?;|C45&f@#QAeIEIjA>d!=2fw1EZ!;q{Lwo7yrIcHLM<&(qGE6*6j^bX01_4 zx@O4}6vQ-ABRR1BfO`>*#EDzIi#IS(%^MHr&r4$Qx+_%MpI~5;UC(i-v*IZ^;+T0E zbO_5Ic41-iI*tx|ekF@)g5z~#po5gFcKG-j5Z<#B1}s1Yb9gw?F##WtJ{fcdjdOO* z*ptbgfTNZl5c}(>3$^eyg)FbFR`@ za($B3MXE18lKbG@HD8r%HRzdg?IicUG1_DcE}~9N8XiK3M>q_BTg*Xa@w>PZ(~g3R zj^<1v$I}Ara>ahz(MhNyX-mkBONH>^i;jqJ$u*|9DN)dv$xA#Bv8WPPGj5y2(|sEw zn>YgqK4K`9ZA5M!%nwTy9h-Od*IcV4D5ZTcSOR3cmHh@@@g%F-(wr+h zxXDKN<@w+H&uP{tEVgC((3blFFQ-{T1GWBmpEr{XdovvI;~itl1#)7rd1R>N;6}GO z<_1!Q9Ws`N%pDV0^>Tmgg=G6dM9qw?QH&oEeGVr~R;P9Gm82|pFuZ1p3OlUW1_9uZM!GjRV0ZNu75A*Rv9(t_VoIvwM=~wj9 zhSxmbiyYOfr%`>}9j27K%GJBc)O-?F(L%J2PwS2m{dF7Y#m}Q}wG7e{Tn=3&08yj3uJQI^vD2CPd; zEwjyBP---;Y;VD~2iq(MlzqiFwkeEciM(%=-uSbSLVL3v2x4V+=4~;In;kJ%3K4Jo zXp*vAf#*y!3-E*Obe8PfcuNY&1A@sxzmD7ehI&;$TD?)E__b*pswWch5Y_%G0HwOq zH0jJOAo&T8QbfkcnF+npwmI=HcYU(1awG9=6%x(EMvICnPTqgbi+o(r! zF2efXBp1ZGA{)bH^_F;`Dpv8xYI)P2I20$$h>-h`+$IaBk1+Hz+d>Y6p*v^k*#kZn zFEbf6(SXWHInESt-u%L4Pk7T4|Dngem~v)d5>>787olpfXMJ&mC&r`qDB$KI_2>b= zi8*hRQl1&w>CUG9+XXQb(q$(p;HryR@rAKWO;q>Kly6wd2IX1d0b>6Kukrqc$UK_N z$UGx_ruQHB*#R!SmSpLA8JV&F7SE~l*dBYB#f*^?|`?v6>vW4Bscd4us?P86A?LXtYDab770 z0!0^b^`ct5Uy1Zvw$?e>8sx9dDaY@lwDpHPqfP>%A9aX{WCFxvodfUZZ|NKZ6naJ1 z7-eW`^LieZq)2hf6jzAe`iwW>p^1?cg{nhwwrL^KJ1CtAq|%?J{y@W{7_cXq6nhEm zVSM*>xzPrL|Eg|36O9Lo97g}C@@y(k7Si_ONe0*B2PbqWAMG4<#Un=vB4PZnw_FAl z2rG!082&|@qV4g$hg8%Os5_S1o_=wx6}mMKiH#dn3u2udTw$6e{$(p-DS-3Q^$K_E zk6v`0Y$JBq3kKjN@Qj12_z{Po;)XvH?yWf>B*EiLoWp71YYkVWO1gTbBQI|m#bRq~ zs||s`). | | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +========================+=================================================================================================================================================================================================================================================================================================================================+=======================+ + | Type | The firewall type. This parameter is mandatory. You can select a value from the drop-down list. Currently, only **IPv4** and **IPv6** are supported. | IPv4 | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Action | The action in the firewall. This parameter is mandatory. You can select a value from the drop-down list. Currently, the value can be **Allow** or **Deny**. | Allow | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Protocol | The protocol supported by the firewall. This parameter is mandatory. You can select a protocol from the drop-down list. | TCP | + | | | | + | | You can select **TCP**, **UDP**, **ICMP**, or **All**. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Source | The source from which the traffic is allowed. The source can be an IP address or IP address range. | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - IP address group: The source is an IP address group. An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Source Port Range | The source port number or port number range. The value ranges from 1 to 65535. For a port number range, enter two port numbers connected by a hyphen (-). For example, **1-100**. | 22, or 22-30 | + | | | | + | | You must specify this parameter if **TCP** or **UDP** is selected for **Protocol**. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Destination | The destination to which the traffic is allowed. The destination can be an IP address or IP address range. | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - IP address group: The source is an IP address group. An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Destination Port Range | The destination port number or port number range. The value ranges from 1 to 65535. For a port number range, enter two port numbers connected by a hyphen (-). For example, **1-100**. | 22, or 22-30 | + | | | | + | | You must specify this parameter if **TCP** or **UDP** is selected for **Protocol**. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | Supplementary information about the firewall rule. This parameter is optional. | N/A | + | | | | + | | The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ 7. Click **OK**. diff --git a/umn/source/access_control/firewall/associating_subnets_with_a_firewall.rst b/umn/source/access_control/firewall/associating_subnets_with_a_firewall.rst index 9b7409a..b6cd722 100644 --- a/umn/source/access_control/firewall/associating_subnets_with_a_firewall.rst +++ b/umn/source/access_control/firewall/associating_subnets_with_a_firewall.rst @@ -8,12 +8,13 @@ Associating Subnets with a Firewall Scenarios --------- -You can associate a firewall with a subnet to protect resources in the subnet. After a firewall is associated with a subnet, the firewall denies all traffic to and from the subnet until you add rules to allow traffic. +You can associate a firewall with a subnet to protect resources in the subnet. Notes and Constraints --------------------- -You can associate a firewall with multiple subnets. However, a subnet can only be associated with one firewall at a time. +- You can associate a firewall with multiple subnets. However, a subnet can only be associated with one firewall at a time. +- After a firewall is associated with a subnet, the default firewall rules deny all traffic to and from the subnet until you add custom rules to allow traffic. For details, see :ref:`Adding a Firewall Rule `. Procedure --------- @@ -32,13 +33,13 @@ Procedure 6. On the displayed page, click the **Associated Subnets** tab. -7. On the **Associated Subnets** page, click **Associate**. +7. On the **Associated Subnets** tab, click **Associate**. 8. On the displayed page, select the subnets to be associated with the firewall, and click **OK**. .. note:: - Subnets with firewalls associated will not be displayed on the page for you to select. If you want to associate such a subnet with another firewall, you must first disassociate the subnet from the original firewall. One-click subnet association and disassociation are not supported currently. A subnet can only be associated with one firewall. + A subnet with a firewall associated will not be displayed on the page for you to select. If you want to associate such a subnet with another firewall, you must first disassociate the subnet from the original firewall. One-click subnet association and disassociation are not supported currently. A subnet can only be associated with one firewall. .. |image1| image:: /_static/images/en-us_image_0141273034.png .. |image2| image:: /_static/images/en-us_image_0000001626734158.png diff --git a/umn/source/access_control/firewall/disassociating_a_subnet_from_a_firewall.rst b/umn/source/access_control/firewall/disassociating_subnets_from_a_firewall.rst similarity index 82% rename from umn/source/access_control/firewall/disassociating_a_subnet_from_a_firewall.rst rename to umn/source/access_control/firewall/disassociating_subnets_from_a_firewall.rst index 808b884..b850868 100644 --- a/umn/source/access_control/firewall/disassociating_a_subnet_from_a_firewall.rst +++ b/umn/source/access_control/firewall/disassociating_subnets_from_a_firewall.rst @@ -2,13 +2,13 @@ .. _vpc_acl_0003: -Disassociating a Subnet from a Firewall -======================================= +Disassociating Subnets from a Firewall +====================================== Scenarios --------- -Disassociate a subnet from a firewall when necessary. +You can disassociate a subnet from its firewall based on your network requirements. Procedure --------- @@ -33,7 +33,7 @@ Procedure **Disassociating subnets from a firewall** -Select multiple subnets and click **Disassociate** above the subnet list to disassociate the subnets from a firewall at a time. +Select multiple subnets and click **Disassociate** above the subnet list to disassociate the subnets from the firewall at a time. .. |image1| image:: /_static/images/en-us_image_0141273034.png .. |image2| image:: /_static/images/en-us_image_0000001675413845.png diff --git a/umn/source/access_control/firewall/index.rst b/umn/source/access_control/firewall/index.rst index 7350f36..2f4cc01 100644 --- a/umn/source/access_control/firewall/index.rst +++ b/umn/source/access_control/firewall/index.rst @@ -10,7 +10,7 @@ Firewall - :ref:`Creating a Firewall ` - :ref:`Adding a Firewall Rule ` - :ref:`Associating Subnets with a Firewall ` -- :ref:`Disassociating a Subnet from a Firewall ` +- :ref:`Disassociating Subnets from a Firewall ` - :ref:`Changing the Sequence of a Firewall Rule ` - :ref:`Modifying a Firewall Rule ` - :ref:`Enabling or Disabling a Firewall Rule ` @@ -29,7 +29,7 @@ Firewall creating_a_firewall adding_a_firewall_rule associating_subnets_with_a_firewall - disassociating_a_subnet_from_a_firewall + disassociating_subnets_from_a_firewall changing_the_sequence_of_a_firewall_rule modifying_a_firewall_rule enabling_or_disabling_a_firewall_rule diff --git a/umn/source/access_control/firewall/modifying_a_firewall_rule.rst b/umn/source/access_control/firewall/modifying_a_firewall_rule.rst index df4f444..6bfc3ea 100644 --- a/umn/source/access_control/firewall/modifying_a_firewall_rule.rst +++ b/umn/source/access_control/firewall/modifying_a_firewall_rule.rst @@ -37,49 +37,49 @@ Procedure .. table:: **Table 1** Parameter descriptions - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +========================+========================================================================================================================================================================================+=======================+ - | Type | The firewall type. This parameter is mandatory. You can select a value from the drop-down list. Currently, only **IPv4** and **IPv6** are supported. | IPv4 | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Action | The action in the firewall. This parameter is mandatory. You can select a value from the drop-down list. Currently, the value can be **Allow** or **Deny**. | Allow | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Protocol | The protocol supported by the firewall. This parameter is mandatory. You can select a protocol from the drop-down list. | TCP | - | | | | - | | You can select **TCP**, **UDP**, **ICMP**, or **All**. | | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Source | The source from which the traffic is allowed. The source can be an IP address or IP address range. | 0.0.0.0/0 | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Source Port Range | The source port number or port number range. The value ranges from 1 to 65535. For a port number range, enter two port numbers connected by a hyphen (-). For example, **1-100**. | 22, or 22-30 | - | | | | - | | You must specify this parameter if **TCP** or **UDP** is selected for **Protocol**. | | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Destination | The destination to which the traffic is allowed. The destination can be an IP address or IP address range. | 0.0.0.0/0 | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Destination Port Range | The destination port number or port number range. The value ranges from 1 to 65535. For a port number range, enter two port numbers connected by a hyphen (-). For example, **1-100**. | 22, or 22-30 | - | | | | - | | You must specify this parameter if **TCP** or **UDP** is selected for **Protocol**. | | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | Supplementary information about the firewall rule. This parameter is optional. | N/A | - | | | | - | | The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +========================+=================================================================================================================================================================================================================================================================================================================================+=======================+ + | Type | The firewall type. This parameter is mandatory. You can select a value from the drop-down list. Currently, only **IPv4** and **IPv6** are supported. | IPv4 | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Action | The action in the firewall. This parameter is mandatory. You can select a value from the drop-down list. Currently, the value can be **Allow** or **Deny**. | Allow | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Protocol | The protocol supported by the firewall. This parameter is mandatory. You can select a protocol from the drop-down list. | TCP | + | | | | + | | You can select **TCP**, **UDP**, **ICMP**, or **All**. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Source | The source from which the traffic is allowed. The source can be an IP address or IP address range. | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - IP address group: The source is an IP address group. An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Source Port Range | The source port number or port number range. The value ranges from 1 to 65535. For a port number range, enter two port numbers connected by a hyphen (-). For example, **1-100**. | 22, or 22-30 | + | | | | + | | You must specify this parameter if **TCP** or **UDP** is selected for **Protocol**. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Destination | The destination to which the traffic is allowed. The destination can be an IP address or IP address range. | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - IP address group: The source is an IP address group. An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Destination Port Range | The destination port number or port number range. The value ranges from 1 to 65535. For a port number range, enter two port numbers connected by a hyphen (-). For example, **1-100**. | 22, or 22-30 | + | | | | + | | You must specify this parameter if **TCP** or **UDP** is selected for **Protocol**. | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | Supplementary information about the firewall rule. This parameter is optional. | N/A | + | | | | + | | The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ 7. Click **Confirm**. diff --git a/umn/source/access_control/security_group/adding_a_security_group_rule.rst b/umn/source/access_control/security_group/adding_a_security_group_rule.rst index adc8d75..8c251fc 100644 --- a/umn/source/access_control/security_group/adding_a_security_group_rule.rst +++ b/umn/source/access_control/security_group/adding_a_security_group_rule.rst @@ -71,36 +71,37 @@ Procedure .. table:: **Table 1** Inbound rule parameter description - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +=======================+==========================================================================================================================================================================+=======================+ - | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | - | | | | - | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | | **Port**: The port or port range over which traffic can reach your ECS. The value can be from 1 to 65535. | 22, or 22-30 | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Type | Source IP address version. You can select: | IPv4 | - | | | | - | | - IPv4 | | - | | - IPv6 | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Source | Source of the security group rule. The value can be an IP address or a security group to allow access from IP addresses or instances in the security group. For example: | 0.0.0.0/0 | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - | | | | - | | If the source is a security group, this rule will apply to all instances associated with the selected security group. | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | - | | | | - | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +=======================+====================================================================================================================================================================================================================================================================================================================================================================================================================+=======================+ + | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | + | | | | + | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | | **Port**: The port or port range over which traffic can reach your ECS. The value can be from 1 to 65535. | 22, or 22-30 | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Source | Source of the security group rule. The value can be an IP address, a security group, or an IP address group to allow access from IP addresses or instances in the security group. For example: | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - **Security group**: The source is from another security group. You can select a security group in the same region under the current account from the drop-down list. Instance A is in security group A and instance B is in security group B. If security group A has an inbound rule with **Action** set to **Allow** and **Source** set to security group B, access from instance B is allowed to instance A. | | + | | - **IP address group**: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + | | | | + | | If the source is a security group, this rule will apply to all instances associated with the selected security group. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | + | | | | + | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ #. Click **OK**. @@ -122,34 +123,35 @@ Procedure .. table:: **Table 2** Outbound rule parameter description - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +=======================+=============================================================================================================================================================================+=======================+ - | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | - | | | | - | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | | **Port**: The port or port range over which traffic can leave your ECS. The value can be from 1 to 65535. | 22, or 22-30 | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Type | Source IP address version. You can select: | IPv4 | - | | | | - | | - IPv4 | | - | | - IPv6 | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example: | 0.0.0.0/0 | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | - | | | | - | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +=======================+====================================================================================================================================================================================================================================================================================================================================================================================================================+=======================+ + | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | + | | | | + | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | | **Port**: The port or port range over which traffic can leave your ECS. The value can be from 1 to 65535. | 22, or 22-30 | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example: | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - **Security group**: The source is from another security group. You can select a security group in the same region under the current account from the drop-down list. Instance A is in security group A and instance B is in security group B. If security group A has an inbound rule with **Action** set to **Allow** and **Source** set to security group B, access from instance B is allowed to instance A. | | + | | - **IP address group**: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | + | | | | + | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ #. Click **OK**. diff --git a/umn/source/access_control/security_group/allowing_common_ports_with_a_few_clicks.rst b/umn/source/access_control/security_group/allowing_common_ports_with_a_few_clicks.rst new file mode 100644 index 0000000..729c0da --- /dev/null +++ b/umn/source/access_control/security_group/allowing_common_ports_with_a_few_clicks.rst @@ -0,0 +1,71 @@ +:original_name: SecurityGroup_0005.html + +.. _SecurityGroup_0005: + +Allowing Common Ports with A Few Clicks +======================================= + +Scenarios +--------- + +You can configure a security group to allow common ports with a few clicks. This function is suitable for the following scenarios: + +- Remotely log in to ECSs. +- Use the ping command to test ECS connectivity. +- ECSs functioning as web servers provide website access services. + +:ref:`Table 1 ` describes the common ports that can be opened with a few clicks. + +.. _securitygroup_0005__table117828131111: + +.. table:: **Table 1** Common ports + + +-----------------+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------+ + | Direction | Protocol & Port & Type | Source/Destination | Description | + +=================+========================+====================+===================================================================================================================================+ + | Inbound | TCP: 22 (IPv4) | 0.0.0.0/0 | Allows all IPv4 addresses to access ECSs in the security group over port 22 (SSH) for remotely logging in to Linux ECSs. | + +-----------------+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------+ + | | TCP: 3389 (IPv4) | 0.0.0.0/0 | Allows all IPv4 addresses to access ECSs in the security group over port 3389 (RDP) for remotely logging in to Windows ECSs. | + +-----------------+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------+ + | | TCP: 80 (IPv4) | 0.0.0.0/0 | Allows all IPv4 addresses to access ECSs in the security group over port 80 (HTTP) for visiting websites. | + +-----------------+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------+ + | | TCP: 443 (IPv4) | 0.0.0.0/0 | Allows all IPv4 addresses to access ECSs in the security group over port 443 (HTTPS) for visiting websites. | + +-----------------+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------+ + | | TCP: 20-21 (IPv4) | 0.0.0.0/0 | Allows all IPv4 addresses to access ECSs in the security group over ports 20 and 21 (FTP) for uploading or downloading files. | + +-----------------+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------+ + | | ICMP: All (IPv4) | 0.0.0.0/0 | Allows all IPv4 addresses to access ECSs in the security group over any port for using the ping command to test ECS connectivity. | + +-----------------+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------+ + | Outbound | All (IPv4) | 0.0.0.0/0 | Allows access from ECSs in the security group to any IP address over any port. | + | | | | | + | | All (IPv6) | ::/0 | | + +-----------------+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------+ + +Procedure +--------- + +#. Log in to the management console. + +#. Click |image1| in the upper left corner and select the desired region and project. + +#. Click |image2| in the upper left corner and choose **Network** > **Virtual Private Cloud**. + + The **Virtual Private Cloud** page is displayed. + +#. In the navigation pane on the left, choose **Access Control** > **Security Groups**. + + The security group list is displayed. + +#. In the security group list, click the name of the security group. + + The security group details page is displayed. + +#. Click the **Inbound Rules** or **Outbound Rules** tab, and then click **Allow Common Ports**. + + The **Allow Common Ports** page is displayed. + +#. Click **OK**. + + After the operation is complete, you can view the added rules in the security group rule list. + +.. |image1| image:: /_static/images/en-us_image_0141273034.png +.. |image2| image:: /_static/images/en-us_image_0000001646961692.png diff --git a/umn/source/access_control/security_group/cloning_a_security_group.rst b/umn/source/access_control/security_group/cloning_a_security_group.rst index 5248029..6d6690a 100644 --- a/umn/source/access_control/security_group/cloning_a_security_group.rst +++ b/umn/source/access_control/security_group/cloning_a_security_group.rst @@ -16,10 +16,6 @@ You can clone a security group in the following scenarios: - If you need new security group rules, you can clone the original security group as a backup. - Before you modify security group rules used by a service, you can clone the security group and modify the security group rules in the test environment to ensure that the modified rules work. - .. note:: - - Security group cloning is not supported now. - Notes and Constraints --------------------- diff --git a/umn/source/access_control/security_group/default_security_group_and_its_rules.rst b/umn/source/access_control/security_group/default_security_group_and_its_rules.rst index dc6f8da..dfc0a07 100644 --- a/umn/source/access_control/security_group/default_security_group_and_its_rules.rst +++ b/umn/source/access_control/security_group/default_security_group_and_its_rules.rst @@ -5,7 +5,7 @@ Default Security Group and Its Rules ==================================== -If you have not created any security group, the system automatically creates a default security group for you and associates it with the instance (such as an ECS) when you create it. A default security group has the following rules: +If you have not created any security groups yet, the system automatically creates a default security group for you and associates it with the instance (such as an ECS) when you create it. A default security group has the following rules: - Inbound rules control incoming traffic to instances in a security group. Only instances in the same security group can communicate with each other, and all inbound requests are denied. - Outbound rules allow all outbound traffic and response traffic to the outbound requests. diff --git a/umn/source/access_control/security_group/fast-adding_security_group_rules.rst b/umn/source/access_control/security_group/fast-adding_security_group_rules.rst index 7928959..a35e38c 100644 --- a/umn/source/access_control/security_group/fast-adding_security_group_rules.rst +++ b/umn/source/access_control/security_group/fast-adding_security_group_rules.rst @@ -43,33 +43,34 @@ Procedure .. table:: **Table 1** Inbound rule parameter description - +-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +=======================+==============================================================================================================================================================================+=======================+ - | Protocols and Ports | Common protocols and ports are provided for: | SSH (22) | - | | | | - | | - Remote login and ping | | - | | - Web services | | - | | - Databases | | - +-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Type | Source IP address version. You can select: | IPv4 | - | | | | - | | - IPv4 | | - | | - IPv6 | | - +-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Source | Source of the security group rule. The value can be an IP address or a security group to allow access from IP addresses or instances in the security group. You can specify: | 0.0.0.0/0 | - | | | | - | | - xxx.xxx.xxx.xxx/32 (IPv4 address) | | - | | - xxx.xxx.xxx.0/24 (IPv4 address range) | | - | | - 0.0.0.0/0 (all IPv4 addresses) | | - | | - sg-abc (security group) | | - | | | | - | | If the source is a security group, this rule will apply to all instances associated with the selected security group. | | - +-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | (Optional) Supplementary information about the security group rule. | ``-`` | - | | | | - | | The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +-----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +=======================+====================================================================================================================================================================================================+=======================+ + | Protocols and Ports | Common protocols and ports are provided for: | SSH (22) | + | | | | + | | - Remote login and ping | | + | | - Web services | | + | | - Databases | | + +-----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Source | Source of the security group rule. The value can be an IP address, an IP address group, or a security group to allow access from IP addresses or instances in the security group. You can specify: | 0.0.0.0/0 | + | | | | + | | - xxx.xxx.xxx.xxx/32 (IPv4 address) | | + | | - xxx.xxx.xxx.0/24 (IPv4 address range) | | + | | - 0.0.0.0/0 (all IPv4 addresses) | | + | | - sg-abc (security group) | | + | | - IP address group: ipGroup-test | | + | | | | + | | If the source is a security group, this rule will apply to all instances associated with the selected security group. | | + +-----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | (Optional) Supplementary information about the security group rule. | ``-`` | + | | | | + | | The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ 8. Click **OK**. @@ -89,31 +90,32 @@ Procedure .. table:: **Table 2** Outbound rule parameter description - +-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +=======================+=================================================================================================================================================================================+=======================+ - | Protocols and Ports | Common protocols and ports are provided for: | SSH (22) | - | | | | - | | - Remote login and ping | | - | | - Web services | | - | | - Databases | | - +-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Type | Source IP address version. You can select: | IPv4 | - | | | | - | | - IPv4 | | - | | - IPv6 | | - +-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. You can specify: | 0.0.0.0/0 | - | | | | - | | - xxx.xxx.xxx.xxx/32 (IPv4 address) | | - | | - xxx.xxx.xxx.0/24 (IPv4 address range) | | - | | - 0.0.0.0/0 (all IPv4 addresses) | | - | | - sg-abc (security group) | | - +-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | (Optional) Supplementary information about the security group rule. | ``-`` | - | | | | - | | The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +-----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +=======================+=======================================================================================================================================================================================================+=======================+ + | Protocols and Ports | Common protocols and ports are provided for: | SSH (22) | + | | | | + | | - Remote login and ping | | + | | - Web services | | + | | - Databases | | + +-----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Destination | Destination of the security group rule. The value can be an IP address, an IP address group, or a security group to allow access to IP addresses or instances in the security group. You can specify: | 0.0.0.0/0 | + | | | | + | | - xxx.xxx.xxx.xxx/32 (IPv4 address) | | + | | - xxx.xxx.xxx.0/24 (IPv4 address range) | | + | | - 0.0.0.0/0 (all IPv4 addresses) | | + | | - sg-abc (security group) | | + | | - IP address group: ipGroup-test | | + +-----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | (Optional) Supplementary information about the security group rule. | ``-`` | + | | | | + | | The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ 11. Click **OK**. diff --git a/umn/source/access_control/security_group/importing_and_exporting_security_group_rules.rst b/umn/source/access_control/security_group/importing_and_exporting_security_group_rules.rst index 3a8afd2..2630185 100644 --- a/umn/source/access_control/security_group/importing_and_exporting_security_group_rules.rst +++ b/umn/source/access_control/security_group/importing_and_exporting_security_group_rules.rst @@ -51,36 +51,42 @@ Procedure .. table:: **Table 1** Template parameters - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ - | Parameter | Description | Example Value | - +=======================+=============================================================================================================================================================================+====================================+ - | Direction | The direction in which the security group rule takes effect. | Inbound | - | | | | - | | - **Inbound**: Inbound rules control incoming traffic to instances in the security group. | | - | | - **Outbound**: Outbound rules control outgoing traffic from instances in the security group. | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ - | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | - | | | | - | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ - | | **Port**: The port or port range over which traffic can reach your ECS. The value can be from 1 to 65535. | 22, or 22-30 | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ - | Source | Source of the security group rule. The value can be an IP address or a security group to allow access from IP addresses or instances in the security group. For example: | sg-test[96a8a93f-XXX-d7872990c314] | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ - | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example: | sg-test[96a8a93f-XXX-d7872990c314] | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ - | Description | Supplementary information about the security group rule. This parameter is optional. | ``-`` | - | | | | - | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ + | Parameter | Description | Example Value | + +=======================+====================================================================================================================================================================================================================================================================================================================================================================================================================+====================================+ + | Direction | The direction in which the security group rule takes effect. | Inbound | + | | | | + | | - **Inbound**: Inbound rules control incoming traffic to instances in the security group. | | + | | - **Outbound**: Outbound rules control outgoing traffic from instances in the security group. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ + | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | + | | | | + | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ + | | **Port**: The port or port range over which traffic can reach your ECS. The value can be from 1 to 65535. | 22, or 22-30 | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ + | Source | Source of the security group rule. The value can be an IP address, a security group, or an IP address group to allow access from IP addresses or instances in the security group. For example: | sg-test[96a8a93f-XXX-d7872990c314] | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - **Security group**: The source is from another security group. You can select a security group in the same region under the current account from the drop-down list. Instance A is in security group A and instance B is in security group B. If security group A has an inbound rule with **Action** set to **Allow** and **Source** set to security group B, access from instance B is allowed to instance A. | | + | | - **IP address group**: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ + | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example: | sg-test[96a8a93f-XXX-d7872990c314] | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ + | Description | Supplementary information about the security group rule. This parameter is optional. | ``-`` | + | | | | + | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------+ .. |image1| image:: /_static/images/en-us_image_0141273034.png .. |image2| image:: /_static/images/en-us_image_0000001675254013.png diff --git a/umn/source/access_control/security_group/index.rst b/umn/source/access_control/security_group/index.rst index d3a2872..65b3757 100644 --- a/umn/source/access_control/security_group/index.rst +++ b/umn/source/access_control/security_group/index.rst @@ -14,6 +14,7 @@ Security Group - :ref:`Deleting a Security Group ` - :ref:`Adding a Security Group Rule ` - :ref:`Fast-Adding Security Group Rules ` +- :ref:`Allowing Common Ports with A Few Clicks ` - :ref:`Modifying a Security Group Rule ` - :ref:`Replicating a Security Group Rule ` - :ref:`Importing and Exporting Security Group Rules ` @@ -35,6 +36,7 @@ Security Group deleting_a_security_group adding_a_security_group_rule fast-adding_security_group_rules + allowing_common_ports_with_a_few_clicks modifying_a_security_group_rule replicating_a_security_group_rule importing_and_exporting_security_group_rules diff --git a/umn/source/access_control/security_group/security_groups_and_security_group_rules.rst b/umn/source/access_control/security_group/security_groups_and_security_group_rules.rst index 1879e47..b22032a 100644 --- a/umn/source/access_control/security_group/security_groups_and_security_group_rules.rst +++ b/umn/source/access_control/security_group/security_groups_and_security_group_rules.rst @@ -8,9 +8,9 @@ Security Groups and Security Group Rules Security Groups --------------- -A security group is a collection of access control rules for cloud resources, such as cloud servers, containers, and databases, that have the same security protection requirements and that are mutually trusted. After a security group is created, you can create various access rules for the security group, these rules will apply to all cloud resources added to this security group. +A security group is a collection of access control rules for cloud resources, such as cloud servers, containers, and databases, that have the same security protection requirements and that are mutually trusted. After a security group is created, you can create various access rules for the security group and these rules will apply to all cloud resources added to this security group. -If you have not created any security group yet, the system automatically creates a default security group for you and associates it with the instance (such as an ECS) when you create it. For details about the default security group, see :ref:`Default Security Group and Its Rules `. +If you have not created any security groups yet, the system automatically creates a default security group for you and associates it with the instance (such as an ECS) when you create it. For details about the default security group, see :ref:`Default Security Group and Its Rules `. Security groups are stateful. If you send a request from your instance and the outbound traffic is allowed, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Similarly, if inbound traffic is allowed, responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules. @@ -29,42 +29,46 @@ A security group has inbound and outbound rules to control traffic that's allowe .. table:: **Table 1** Security group rule information - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Parameter | Description | - +===================================+========================================================================================================================================================================================================================+ - | Protocol | The network protocol used to match traffic in a security group rule. Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Port | Destination port used to match traffic in a security group rule. The value can be from 1 to 65535. | - | | | - | | - Inbound rules control incoming traffic over specific ports to instances in the security group. | - | | - Outbound rules control outgoing traffic over specific ports from instances in the security group. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Source (Inbound) | The source in an inbound rule is used to match the IP address or address range of an external request. The source can be: | - | | | - | | - IP address: | - | | | - | | - Example IPv4 address: 192.168.10.10/32 | - | | - Example IPv6 address: 2002:50::44/128 | - | | - Example IPv4 address range: 192.168.52.0/24 All IPv4 addresses: 0.0.0.0/0 | - | | - Example IPv6 address range: 2407:c080:802:469::/64 All IPv6 addresses: ::/0 | - | | | - | | - Security group: You can select another security group in the same region under the current account as the source. | - | | | - | | For example, instance A is in security group A and instance B is in security group B. If security group A has a rule with **Source** set to security group B, access from instance B is allowed to instance A. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Destination (Outbound) | The destination in an outbound rule is used to match the IP address or address range of an internal request. The destination can be: | - | | | - | | - IP address: | - | | | - | | - Example IPv4 address: 192.168.10.10/32 | - | | - Example IPv6 address: 2002:50::44/128 | - | | - Example IPv4 address range: 192.168.52.0/24 All IPv4 addresses: 0.0.0.0/0 | - | | - Example IPv6 address range: 2407:c080:802:469::/64 All IPv6 addresses: ::/0 | - | | | - | | - Security group: You can select another security group in the same region under the current account as the destination. | - | | | - | | For example, instance A is in security group A and instance B is in security group B. If security group A has a rule with **Destination** set to security group B, access from instance A is allowed to instance B. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================================+=====================================================================================================================================================================================================================================+ + | Protocol | The network protocol used to match traffic in a security group rule. Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Port | Destination port used to match traffic in a security group rule. The value can be from 1 to 65535. | + | | | + | | - Inbound rules control incoming traffic over specific ports to instances in the security group. | + | | - Outbound rules control outgoing traffic over specific ports from instances in the security group. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Source (Inbound) | The source in an inbound rule is used to match the IP address or address range of an external request. The source can be: | + | | | + | | - IP address: | + | | | + | | - Example IPv4 address: 192.168.10.10/32 | + | | - Example IPv6 address: 2002:50::44/128 | + | | - Example IPv4 address range: 192.168.52.0/24 All IPv4 addresses: 0.0.0.0/0 | + | | - Example IPv6 address range: 2407:c080:802:469::/64 All IPv6 addresses: ::/0 | + | | | + | | - Security group: You can select another security group in the same region under the current account as the source. | + | | | + | | For example, instance A is in security group A and instance B is in security group B. If security group A has a rule with **Source** set to security group B, access from instance B is allowed to instance A. | + | | | + | | - IP address group: If you have multiple IP address ranges and IP addresses with same security requirements, add them to an IP address group and select the group as the source to help you manage them in a more simple way. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Destination (Outbound) | The destination in an outbound rule is used to match the IP address or address range of an internal request. The destination can be: | + | | | + | | - IP address: | + | | | + | | - Example IPv4 address: 192.168.10.10/32 | + | | - Example IPv6 address: 2002:50::44/128 | + | | - Example IPv4 address range: 192.168.52.0/24 All IPv4 addresses: 0.0.0.0/0 | + | | - Example IPv6 address range: 2407:c080:802:469::/64 All IPv6 addresses: ::/0 | + | | | + | | - Security group: You can select another security group in the same region under the current account as the destination. | + | | | + | | For example, instance A is in security group A and instance B is in security group B. If security group A has a rule with **Destination** set to security group B, access from instance A is allowed to instance B. | + | | | + | | - IP address group: If you have multiple IP address ranges and IP addresses with same security requirements, add them to an IP address group and select the group as the destination to help you manage them in a more simple way. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ Like whitelists, security group rules work as follows: diff --git a/umn/source/change_history.rst b/umn/source/change_history.rst index de4e8b9..1c35211 100644 --- a/umn/source/change_history.rst +++ b/umn/source/change_history.rst @@ -8,6 +8,30 @@ Change History +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Released On | Description | +===================================+====================================================================================================================================================================================================================================================================================================================================+ +| 2023-12-19 | This release incorporates the following changes: | +| | | +| | Added screenshots in :ref:`How Do I Configure a Security Group for Multi-Channel Protocols? `. | +| | | +| | Modified the table in :ref:`Why Can't I Delete My VPCs and Subnets? `. | ++-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| 2023-12-18 | This release incorporates the following changes: | +| | | +| | Added IPv6-related content. | ++-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| 2023-12-12 | This release incorporates the following changes: | +| | | +| | Added descriptions about security group and IP address group as source or destination in :ref:`Adding a Security Group Rule `. | ++-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| 2023-11-30 | This release incorporates the following changes: | +| | | +| | Added descriptions about IP address groups as source and destination in :ref:`Adding a Firewall Rule `. | ++-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| 2023-11-14 | This release incorporates the following changes: | +| | | +| | Added the following content: | +| | | +| | Added description about allowing common ports with a few clicks in :ref:`Allowing Common Ports with A Few Clicks `. | ++-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2023-10-10 | This release incorporates the following changes: | | | | | | - Added the figure for configuring route tables in :ref:`Route Table `. | diff --git a/umn/source/elastic_ip/managing_eip_tags.rst b/umn/source/elastic_ip/managing_eip_tags.rst index 5a9873e..e62d3a3 100644 --- a/umn/source/elastic_ip/managing_eip_tags.rst +++ b/umn/source/elastic_ip/managing_eip_tags.rst @@ -49,7 +49,7 @@ Procedure #. Click |image2| in the upper left corner and choose **Network** > **Elastic IP**. -#. Click the search box and then click **Tag** in the drop-down list. +#. Click the search box above the EIP list. #. Select the tag key and value of the EIP. diff --git a/umn/source/faq/security/how_do_i_configure_a_security_group_for_multi-channel_protocols.rst b/umn/source/faq/security/how_do_i_configure_a_security_group_for_multi-channel_protocols.rst index c6737e6..48dd160 100644 --- a/umn/source/faq/security/how_do_i_configure_a_security_group_for_multi-channel_protocols.rst +++ b/umn/source/faq/security/how_do_i_configure_a_security_group_for_multi-channel_protocols.rst @@ -18,7 +18,7 @@ You can configure port 69 and configure data channel ports used by TFTP for the The following figure provides an example of the security group rule configuration if the ports used by data channels range from 60001 to 60100. -.. figure:: /_static/images/en-us_image_0129473334.png +.. figure:: /_static/images/en-us_image_0000001796404809.png :alt: **Figure 1** Security group rules **Figure 1** Security group rules diff --git a/umn/source/faq/vpcs_and_subnets/why_cant_i_delete_my_vpcs_and_subnets.rst b/umn/source/faq/vpcs_and_subnets/why_cant_i_delete_my_vpcs_and_subnets.rst index 97a7da5..8781a9e 100644 --- a/umn/source/faq/vpcs_and_subnets/why_cant_i_delete_my_vpcs_and_subnets.rst +++ b/umn/source/faq/vpcs_and_subnets/why_cant_i_delete_my_vpcs_and_subnets.rst @@ -98,6 +98,8 @@ Before deleting a VPC, ensure that all subnets in the VPC have been deleted. You +---------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------+ | Delete the virtual gateway that is using the VPC and then delete the VPC. | The VPC is being used by a Direct Connect virtual gateway. | On the Direct Connect console, locate the virtual gateway and delete it. | +---------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------+ + | Delete the VPN gateway that is using the VPC and then delete the VPC. | The VPC is being used by a VPN gateway. | On the VPN console, locate the VPN gateway and delete it. | + +---------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------+ | Delete all custom security groups in this region and then delete this last VPC. | In the current region, this is the last VPC and there are custom security groups. | Delete all custom security groups and then delete the VPC. | | | | | | | .. important:: | :ref:`Deleting a Security Group ` | diff --git a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/index.rst b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/index.rst index 4efe30f..1f20d28 100644 --- a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/index.rst +++ b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/index.rst @@ -56,7 +56,11 @@ Configuring a VPC for ECSs That Access the Internet Using EIPs | | | | | | | | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ - | Default Subnet | CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + | Default Subnet | IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ + | Default Subnet | IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` | + | | | | | + | | | After the IPv6 function is enabled, the system automatically assigns an IPv6 CIDR block to the created subnet. Currently, the IPv6 CIDR block cannot be customized. IPv6 cannot be disabled after the subnet is created. | | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ | Default Subnet | Associated Route Table | The default route table to which the subnet will be associated. You can change the route table to a custom route table on the **Subnets** page. | Default | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ diff --git a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_1_create_a_vpc.rst b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_1_create_a_vpc.rst index e2cda31..99efccf 100644 --- a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_1_create_a_vpc.rst +++ b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_1_create_a_vpc.rst @@ -66,7 +66,11 @@ Procedure | | | | | | | | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ - | Default Subnet | CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + | Default Subnet | IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ + | Default Subnet | IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` | + | | | | | + | | | After the IPv6 function is enabled, the system automatically assigns an IPv6 CIDR block to the created subnet. Currently, the IPv6 CIDR block cannot be customized. IPv6 cannot be disabled after the subnet is created. | | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ | Default Subnet | Associated Route Table | The default route table to which the subnet will be associated. You can change the route table to a custom route table on the **Subnets** page. | Default | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ diff --git a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_2_create_a_subnet_for_the_vpc.rst b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_2_create_a_subnet_for_the_vpc.rst index da22c06..96ec641 100644 --- a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_2_create_a_subnet_for_the_vpc.rst +++ b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_2_create_a_subnet_for_the_vpc.rst @@ -48,7 +48,11 @@ Procedure | | | | | | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + | IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` | + | | | | + | | If you select this option, the system automatically assigns an IPv6 CIDR block to the created subnet. Currently, the IPv6 CIDR block cannot be customized. IPv6 cannot be disabled after the subnet is created. | | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ | Associated Route Table | The default route table to which the subnet will be associated. You can change the route table to a custom route table on the **Subnets** page. | Default | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ diff --git a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_5_add_a_security_group_rule.rst b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_5_add_a_security_group_rule.rst index b984ecf..35995f1 100644 --- a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_5_add_a_security_group_rule.rst +++ b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_access_the_internet_using_eips/step_5_add_a_security_group_rule.rst @@ -65,36 +65,37 @@ Procedure .. table:: **Table 1** Inbound rule parameter description - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +=======================+==========================================================================================================================================================================+=======================+ - | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | - | | | | - | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | | **Port**: The port or port range over which traffic can reach your ECS. The value can be from 1 to 65535. | 22, or 22-30 | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Type | Source IP address version. You can select: | IPv4 | - | | | | - | | - IPv4 | | - | | - IPv6 | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Source | Source of the security group rule. The value can be an IP address or a security group to allow access from IP addresses or instances in the security group. For example: | 0.0.0.0/0 | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - | | | | - | | If the source is a security group, this rule will apply to all instances associated with the selected security group. | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | - | | | | - | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +=======================+====================================================================================================================================================================================================================================================================================================================================================================================================================+=======================+ + | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | + | | | | + | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | | **Port**: The port or port range over which traffic can reach your ECS. The value can be from 1 to 65535. | 22, or 22-30 | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Source | Source of the security group rule. The value can be an IP address, a security group, or an IP address group to allow access from IP addresses or instances in the security group. For example: | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - **Security group**: The source is from another security group. You can select a security group in the same region under the current account from the drop-down list. Instance A is in security group A and instance B is in security group B. If security group A has an inbound rule with **Action** set to **Allow** and **Source** set to security group B, access from instance B is allowed to instance A. | | + | | - **IP address group**: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + | | | | + | | If the source is a security group, this rule will apply to all instances associated with the selected security group. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | + | | | | + | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ #. Click **OK**. @@ -116,34 +117,35 @@ Procedure .. table:: **Table 2** Outbound rule parameter description - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +=======================+=============================================================================================================================================================================+=======================+ - | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | - | | | | - | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | | **Port**: The port or port range over which traffic can leave your ECS. The value can be from 1 to 65535. | 22, or 22-30 | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Type | Source IP address version. You can select: | IPv4 | - | | | | - | | - IPv4 | | - | | - IPv6 | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example: | 0.0.0.0/0 | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | - | | | | - | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +=======================+====================================================================================================================================================================================================================================================================================================================================================================================================================+=======================+ + | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | + | | | | + | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | | **Port**: The port or port range over which traffic can leave your ECS. The value can be from 1 to 65535. | 22, or 22-30 | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example: | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - **Security group**: The source is from another security group. You can select a security group in the same region under the current account from the drop-down list. Instance A is in security group A and instance B is in security group B. If security group A has an inbound rule with **Action** set to **Allow** and **Source** set to security group B, access from instance B is allowed to instance A. | | + | | - **IP address group**: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | + | | | | + | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ #. Click **OK**. diff --git a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_1_create_a_vpc.rst b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_1_create_a_vpc.rst index c0f7f98..697dc5e 100644 --- a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_1_create_a_vpc.rst +++ b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_1_create_a_vpc.rst @@ -66,7 +66,11 @@ Procedure | | | | | | | | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ - | Default Subnet | CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + | Default Subnet | IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ + | Default Subnet | IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` | + | | | | | + | | | After the IPv6 function is enabled, the system automatically assigns an IPv6 CIDR block to the created subnet. Currently, the IPv6 CIDR block cannot be customized. IPv6 cannot be disabled after the subnet is created. | | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ | Default Subnet | Associated Route Table | The default route table to which the subnet will be associated. You can change the route table to a custom route table on the **Subnets** page. | Default | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ diff --git a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_2_create_a_subnet_for_the_vpc.rst b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_2_create_a_subnet_for_the_vpc.rst index 686be34..7435a6c 100644 --- a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_2_create_a_subnet_for_the_vpc.rst +++ b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_2_create_a_subnet_for_the_vpc.rst @@ -48,7 +48,11 @@ Procedure | | | | | | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + | IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` | + | | | | + | | If you select this option, the system automatically assigns an IPv6 CIDR block to the created subnet. Currently, the IPv6 CIDR block cannot be customized. IPv6 cannot be disabled after the subnet is created. | | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ | Associated Route Table | The default route table to which the subnet will be associated. You can change the route table to a custom route table on the **Subnets** page. | Default | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ diff --git a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_4_add_a_security_group_rule.rst b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_4_add_a_security_group_rule.rst index 2b023a7..7061242 100644 --- a/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_4_add_a_security_group_rule.rst +++ b/umn/source/getting_started/configuring_a_vpc_for_ecss_that_do_not_require_internet_access/step_4_add_a_security_group_rule.rst @@ -65,36 +65,37 @@ Procedure .. table:: **Table 1** Inbound rule parameter description - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +=======================+==========================================================================================================================================================================+=======================+ - | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | - | | | | - | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | | **Port**: The port or port range over which traffic can reach your ECS. The value can be from 1 to 65535. | 22, or 22-30 | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Type | Source IP address version. You can select: | IPv4 | - | | | | - | | - IPv4 | | - | | - IPv6 | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Source | Source of the security group rule. The value can be an IP address or a security group to allow access from IP addresses or instances in the security group. For example: | 0.0.0.0/0 | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - | | | | - | | If the source is a security group, this rule will apply to all instances associated with the selected security group. | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | - | | | | - | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +=======================+====================================================================================================================================================================================================================================================================================================================================================================================================================+=======================+ + | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | + | | | | + | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | | **Port**: The port or port range over which traffic can reach your ECS. The value can be from 1 to 65535. | 22, or 22-30 | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Source | Source of the security group rule. The value can be an IP address, a security group, or an IP address group to allow access from IP addresses or instances in the security group. For example: | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - **Security group**: The source is from another security group. You can select a security group in the same region under the current account from the drop-down list. Instance A is in security group A and instance B is in security group B. If security group A has an inbound rule with **Action** set to **Allow** and **Source** set to security group B, access from instance B is allowed to instance A. | | + | | - **IP address group**: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + | | | | + | | If the source is a security group, this rule will apply to all instances associated with the selected security group. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | + | | | | + | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ #. Click **OK**. @@ -116,34 +117,35 @@ Procedure .. table:: **Table 2** Outbound rule parameter description - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Parameter | Description | Example Value | - +=======================+=============================================================================================================================================================================+=======================+ - | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | - | | | | - | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | | **Port**: The port or port range over which traffic can leave your ECS. The value can be from 1 to 65535. | 22, or 22-30 | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Type | Source IP address version. You can select: | IPv4 | - | | | | - | | - IPv4 | | - | | - IPv6 | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example: | 0.0.0.0/0 | - | | | | - | | - IP address: | | - | | | | - | | - Single IP address: 192.168.10.10/32 | | - | | - All IP addresses: 0.0.0.0/0 | | - | | - IP address range: 192.168.1.0/24 | | - | | | | - | | - Security group: sg-A | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | - | | | | - | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | - +-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Parameter | Description | Example Value | + +=======================+====================================================================================================================================================================================================================================================================================================================================================================================================================+=======================+ + | Protocol & Port | The network protocol used to match traffic in a security group rule. | TCP | + | | | | + | | Currently, the value can be **All**, **TCP**, **UDP**, **GRE**, **ICMP**, or more. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | | **Port**: The port or port range over which traffic can leave your ECS. The value can be from 1 to 65535. | 22, or 22-30 | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Type | Source IP address version. You can select: | IPv4 | + | | | | + | | - IPv4 | | + | | - IPv6 | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Destination | Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example: | 0.0.0.0/0 | + | | | | + | | - IP address: | | + | | | | + | | - Single IP address: 192.168.10.10/32 | | + | | - All IP addresses: 0.0.0.0/0 | | + | | - IP address range: 192.168.1.0/24 | | + | | | | + | | - **Security group**: The source is from another security group. You can select a security group in the same region under the current account from the drop-down list. Instance A is in security group A and instance B is in security group B. If security group A has an inbound rule with **Action** set to **Allow** and **Source** set to security group B, access from instance B is allowed to instance A. | | + | | - **IP address group**: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in a more simple way. | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | Description | Supplementary information about the security group rule. This parameter is optional. | N/A | + | | | | + | | The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >). | | + +-----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ #. Click **OK**. diff --git a/umn/source/permissions_management/vpc_custom_policies.rst b/umn/source/permissions_management/vpc_custom_policies.rst index 242655d..b34ca41 100644 --- a/umn/source/permissions_management/vpc_custom_policies.rst +++ b/umn/source/permissions_management/vpc_custom_policies.rst @@ -12,7 +12,7 @@ You can create custom policies in either of the following ways: - Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax. - JSON: Edit JSON policies from scratch or based on an existing policy. -For operation details, see `Creating a Custom Policy `__. The following section contains examples of common VPC custom policies. +For operation details, see `Creating a Custom Policy `__. The following section contains examples of common VPC custom policies. Example Custom Policies ----------------------- diff --git a/umn/source/route_tables/configuring_an_snat_server.rst b/umn/source/route_tables/configuring_an_snat_server.rst index 2b7c6f5..622ef19 100644 --- a/umn/source/route_tables/configuring_an_snat_server.rst +++ b/umn/source/route_tables/configuring_an_snat_server.rst @@ -60,7 +60,7 @@ Procedure .. code-block:: console [root@localhost ~]# ping www.google.com - PING www.XXX.com (xxx.xxx.xxx.xxx) 56(84) bytes of data. + PING www.google.com (xxx.xxx.xxx.xxx) 56(84) bytes of data. 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=1 ttl=51 time=9.34 ms 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=2 ttl=51 time=9.11 ms 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=3 ttl=51 time=8.99 ms diff --git a/umn/source/route_tables/route_tables_and_routes.rst b/umn/source/route_tables/route_tables_and_routes.rst index 66519e9..c7255a9 100644 --- a/umn/source/route_tables/route_tables_and_routes.rst +++ b/umn/source/route_tables/route_tables_and_routes.rst @@ -23,7 +23,7 @@ A route table contains a set of routes that are used to determine where network - Custom route table: If you do not want to use the default route table, you can create a custom route table and associate it with the subnet. Custom route tables can be deleted if they are no longer required. - The custom route table associated with a subnet affects only the outbound traffic. The default route table controls the inbound traffic. + The custom route table associated with a subnet affects only the outbound traffic. The default route table of a subnet controls the inbound traffic. Route ----- @@ -35,8 +35,14 @@ You can add routes to default and custom route tables and configure the destinat After a route table is created, the system automatically adds the following system routes to the route table, so that instances in a VPC can communicate with each other. - Routes whose destination is 100.64.0.0/10 or 198.19.128.0/20. + - Routes whose destination is a subnet CIDR block. + If you enable IPv6 when creating a subnet, the system automatically assigns an IPv6 CIDR block to the subnet. Then, you can view IPv6 routes in its route table. Example destinations of subnet CIDR blocks are as follows: + + - IPv4: 192.168.2.0/24 + - IPv6: 2407:c080:802:be7::/64 + .. note:: In addition to the preceding system routes, the system automatically adds a route whose destination is 127.0.0.0/8. This is the local loopback address. diff --git a/umn/source/service_overview/basic_concepts/route_table.rst b/umn/source/service_overview/basic_concepts/route_table.rst index 02588c9..99cd92a 100644 --- a/umn/source/service_overview/basic_concepts/route_table.rst +++ b/umn/source/service_overview/basic_concepts/route_table.rst @@ -23,7 +23,7 @@ A route table contains a set of routes that are used to determine where network - Custom route table: If you do not want to use the default route table, you can create a custom route table and associate it with the subnet. Custom route tables can be deleted if they are no longer required. - The custom route table associated with a subnet affects only the outbound traffic. The default route table controls the inbound traffic. + The custom route table associated with a subnet affects only the outbound traffic. The default route table of a subnet controls the inbound traffic. Route ----- @@ -35,8 +35,14 @@ You can add routes to default and custom route tables and configure the destinat After a route table is created, the system automatically adds the following system routes to the route table, so that instances in a VPC can communicate with each other. - Routes whose destination is 100.64.0.0/10 or 198.19.128.0/20. + - Routes whose destination is a subnet CIDR block. + If you enable IPv6 when creating a subnet, the system automatically assigns an IPv6 CIDR block to the subnet. Then, you can view IPv6 routes in its route table. Example destinations of subnet CIDR blocks are as follows: + + - IPv4: 192.168.2.0/24 + - IPv6: 2407:c080:802:be7::/64 + .. note:: In addition to the preceding system routes, the system automatically adds a route whose destination is 127.0.0.0/8. This is the local loopback address. diff --git a/umn/source/service_overview/basic_concepts/security_group.rst b/umn/source/service_overview/basic_concepts/security_group.rst index aa59a7c..6955fd8 100644 --- a/umn/source/service_overview/basic_concepts/security_group.rst +++ b/umn/source/service_overview/basic_concepts/security_group.rst @@ -5,7 +5,7 @@ Security Group ============== -A security group is a collection of access control rules for cloud resources, such as cloud servers, containers, and databases, that have the same security protection requirements and that are mutually trusted. After a security group is created, you can create various access rules for the security group, these rules will apply to all cloud resources added to this security group. +A security group is a collection of access control rules for cloud resources, such as cloud servers, containers, and databases, that have the same security protection requirements and that are mutually trusted. After a security group is created, you can create various access rules for the security group and these rules will apply to all cloud resources added to this security group. Like whitelists, security group rules work as follows: diff --git a/umn/source/service_overview/basic_concepts/vpc_peering_connection.rst b/umn/source/service_overview/basic_concepts/vpc_peering_connection.rst index af08b72..6abc9dc 100644 --- a/umn/source/service_overview/basic_concepts/vpc_peering_connection.rst +++ b/umn/source/service_overview/basic_concepts/vpc_peering_connection.rst @@ -5,7 +5,7 @@ VPC Peering Connection ====================== -A VPC peering connection is a networking connection between two VPCs and enables them to communicate using private IP addresses. The VPCs to be peered can be in the same account or different accounts, but must be in the same region. +A VPC peering connection is a networking connection that connects two VPCs for them to communicate using private IP addresses. The VPCs to be peered can be in the same account or different accounts, but must be in the same region. - You can use VPC peering connections to build networks in different scenarios. For details, see :ref:`VPC Peering Connection Usage Examples `. diff --git a/umn/source/virtual_ip_address/assigning_a_virtual_ip_address.rst b/umn/source/virtual_ip_address/assigning_a_virtual_ip_address.rst index 7ee8266..c3ea821 100644 --- a/umn/source/virtual_ip_address/assigning_a_virtual_ip_address.rst +++ b/umn/source/virtual_ip_address/assigning_a_virtual_ip_address.rst @@ -27,6 +27,11 @@ Procedure #. Click the **IP Addresses** tab and click **Assign Virtual IP Address**. +#. Select an IP address type. This parameter is available only in regions supporting IPv6. + + - IPv4 + - IPv6 + #. Select a virtual IP address assignment mode. - **Automatic**: The system assigns an IP address automatically. diff --git a/umn/source/virtual_ip_address/binding_a_virtual_ip_address_to_an_eip_or_ecs.rst b/umn/source/virtual_ip_address/binding_a_virtual_ip_address_to_an_eip_or_ecs.rst index e67f597..2a394b3 100644 --- a/umn/source/virtual_ip_address/binding_a_virtual_ip_address_to_an_eip_or_ecs.rst +++ b/umn/source/virtual_ip_address/binding_a_virtual_ip_address_to_an_eip_or_ecs.rst @@ -8,15 +8,17 @@ Binding a Virtual IP Address to an EIP or ECS Scenarios --------- -You can bind a virtual IP address to an EIP so that you can access the ECSs bound with the same virtual IP address from the Internet. These ECSs can work in the active/standby mode to improve fault tolerance. +You can use a virtual IP address and an EIP together. + +If you bind a virtual IP address to ECSs that work in active/standby pairs and bind an EIP to the virtual IP address, you can access the ECSs over the Internet. Notes and Constraints --------------------- - Each virtual IP address can be bound to only one EIP. -Procedure ---------- +Binding a Virtual IP Address to an EIP or ECS on the Console +------------------------------------------------------------ #. Log in to the management console. @@ -28,7 +30,11 @@ Procedure #. In the navigation pane on the left, choose **Virtual Private Cloud** > **Subnets**. -#. In the subnet list, click the name of the subnet that the virtual IP address belongs to. + The **Subnets** page is displayed. + +#. Click the name with a hyperlink of the subnet that the virtual IP address belongs to. + + The subnet details page is displayed. #. Click the **IP Addresses** tab. @@ -39,106 +45,236 @@ Procedure .. note:: - - If the ECS has multiple NICs, bind the virtual IP address to the primary NIC. - - Multiple virtual IP addresses can be bound to an ECS NIC. + - If an ECS has multiple NICs, bind the virtual IP address to the primary NIC. + - An ECS NIC can have multiple virtual IP addresses bound. #. Click **OK**. -9. Manually configure the virtual IP address bound to an ECS. + .. important:: - After a virtual IP address is bound to an ECS NIC, you need to manually configure the virtual IP address on the ECS. + After a virtual IP address is bound to an ECS NIC, you need to manually configure the virtual IP address on the ECS. For details, see :ref:`Configuring a Virtual IP Address for an ECS `. - **Linux OS** (CentOS 7.2 64bit is used as an example.) +.. _en-us_topic_0067802474__section480517024620: - a. .. _en-us_topic_0067802474__li528316578916: +Configuring a Virtual IP Address for an ECS +------------------------------------------- - Run the following command to obtain the NIC to which the virtual IP address is to be bound and the connection of the NIC: +Manually configure the virtual IP address bound to an ECS. - **nmcli connection** +This following OSs are used as examples here. For other OSs, see the help documents on their official websites. - Information similar to the following is displayed: +- Linux: CentOS 7.2 64bit and Ubuntu 22.04 server 64bit +- Windows: Windows Server - |image3| +**Linux (CentOS 7.2 64bit is used as an example.)** - The command output in this example is described as follows: +#. .. _en-us_topic_0067802474__li528316578916: - - **eth0** in the **DEVICE** column indicates the NIC to which the virtual IP address is to be bound. - - **Wired connection 1** in the **NAME** column indicates the connection of the NIC. + Obtain the NIC that the virtual IP address is to be bound and the connection of the NIC: - b. Run the following command to add the virtual IP address for the target connection: + **nmcli connection** - **nmcli connection modify "**\ *CONNECTION*\ **" ipv4.addresses** *VIP* + Information similar to the following is displayed: - Configure the parameters as follows: + |image3| - - CONNECTION: connection of the NIC obtained in :ref:`9.a `. - - VIP: virtual IP address to be added. + The command output in this example is described as follows: - - If you add multiple virtual IP addresses at a time, separate them with commas (,). - - If a virtual IP address already exists and you need to add a new one, the command must contain both the new and original virtual IP addresses. + - **eth0** in the **DEVICE** column indicates the NIC that the virtual IP address is to be bound. + - **Wired connection 1** in the **NAME** column indicates the connection of the NIC. - Example commands: +#. .. _en-us_topic_0067802474__li20283257695: - - Adding a single virtual IP address: **nmcli connection modify "Wired connection 1" ipv4.addresses** **172.16.0.125** - - Adding multiple virtual IP addresses: **nmcli connection modify "Wired connection 1" ipv4.addresses** **172.16.0.125,172.16.0.126** + Add the virtual IP address for the connection: - c. Run the following command to make the configuration take effect: + **nmcli connection modify "**\ *Connection name of the NIC*\ **"** **+ipv4.addresses** *Virtual IP address* - **nmcli connection up "**\ *CONNECTION*\ **"** + Configure the parameters as follows: - In this example, run the following command: + - *Connection name of the NIC*: The connection name of the NIC obtained in :ref:`1 `. In this example, the connection name is **Wired connection 1**. + - *Virtual IP address*: Enter the virtual IP address to be added. If you add multiple virtual IP addresses at a time, separate every two with a comma (,). - **nmcli connection up "Wired connection 1"** + Example commands: - Information similar to the following is displayed: + - Adding a single virtual IP address: **nmcli connection modify "Wired connection 1" +ipv4.addresses** **172.16.0.125** + - Adding multiple virtual IP addresses: **nmcli connection modify "Wired connection 1" +ipv4.addresses** **172.16.0.125,172.16.0.126** - |image4| +#. .. _en-us_topic_0067802474__li11209933188: - d. Run the following command to check whether the virtual IP address has been bound: + Make the configuration in :ref:`2 ` take effect: - **ip a** + **nmcli connection up "**\ *Connection name of the NIC*\ **"** - Information similar to the following is displayed. In the command output, the virtual IP address 172.16.0.125 is bound to NIC eth0. + In this example, run the following command: - |image5| + **nmcli connection up "Wired connection 1"** - **Windows OS** (Windows Server is used as an example here.) + Information similar to the following is displayed: - a. In **Control Panel**, click **Network and Sharing Center**, and click the corresponding local connection. + |image4| - b. On the displayed page, click **Properties**. +#. Check whether the virtual IP address has been bound: - c. On the **Network** tab page, select **Internet Protocol Version 4 (TCP/IPv4)**. + **ip a** - d. Click **Properties**. + Information similar to the following is displayed. In the command output, the virtual IP address 172.16.0.125 is bound to NIC eth0. - e. Select **Use the following IP address** and set **IP address** to the private IP address of the ECS, for example, 10.0.0.101. + |image5| + + .. note:: + + To delete an added virtual IP address, perform the following steps: + + a. Delete the virtual IP address from the connection of the NIC: + + **nmcli connection modify "**\ *Connection name of the NIC*\ **"** **-ipv4.addresses** *Virtual IP address* + + To delete multiple virtual IP addresses at a time, separate every two with a comma (,). Example commands are as follows: + + - Deleting a single virtual IP address: **nmcli connection modify "Wired connection 1" -ipv4.addresses** **172.16.0.125** + - Deleting multiple virtual IP addresses: **nmcli connection modify "Wired connection 1" -ipv4.addresses** **172.16.0.125,172.16.0.126** + + b. Make the deletion take effect by referring to :ref:`3 `. + +**Linux (Ubuntu 22.04 server 64bit is used as an example.)** + +If an ECS runs Ubuntu 22 or Ubuntu 20, perform the following operations: + +#. Obtain the NIC that the virtual IP address is to be bound: + + **ifconfig** + + Information similar to the following is displayed. In this example, the NIC bound to the virtual IP address is **eth0**. + + .. code-block:: + + root@ecs-X-ubantu:~# ifconfig + eth0: flags=4163 mtu 1500 + inet 172.16.0.210 netmask 255.255.255.0 broadcast 172.16.0.255 + inet6 fe80::f816:3eff:fe01:f1c3 prefixlen 64 scopeid 0x20 + ether fa:16:3e:01:f1:c3 txqueuelen 1000 (Ethernet) + RX packets 43915 bytes 63606486 (63.6 MB) + RX errors 0 dropped 0 overruns 0 frame 0 + TX packets 3364 bytes 455617 (455.6 KB) + TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 + ... + +#. Switch to the **/etc/netplan** directory: + + **cd /etc/netplan** + +#. .. _en-us_topic_0067802474__li1244016171484: + + Add a virtual IP address to the NIC. + + a. Open the configuration file **01-netcfg.yaml**: + + **vim 01-netcfg.yaml** + + b. Press **i** to enter the editing mode. + + c. In the NIC configuration area, add a virtual IP address. + + In this example, add a virtual IP address for **eth0**: + + **addresses:** + + **- 172.16.0.26/32** + + The file content is as follows: + + .. code-block:: + + network: + version: 2 + renderer: NetworkManager + ethernets: + eth0: + dhcp4: true + addresses: + - 172.16.0.26/32 + eth1: + dhcp4: true + eth2: + dhcp4: true + eth3: + dhcp4: true + eth4: + dhcp4: true + + d. Press **Esc**, enter **:wq!**, save the configuration, and exit. + +#. .. _en-us_topic_0067802474__li1071922334218: + + Make the configuration in :ref:`3 ` take effect: + + **netplan apply** + +#. Check whether the virtual IP address has been bound: + + **ip a** + + Information similar to the following is displayed. In the command output, the virtual IP address 172.16.0.26 is bound to NIC eth0. + + .. code-block:: + + root@ecs-X-ubantu:/etc/netplan# ip a + ... + 2: eth0: mtu 1500 qdisc fq_codel state UP group default qlen 1000 + link/ether fa:16:3e:01:f1:c3 brd ff:ff:ff:ff:ff:ff + altname enp0s3 + altname ens3 + inet 172.16.0.26/32 scope global noprefixroute eth0 + valid_lft forever preferred_lft forever + inet 172.16.0.210/24 brd 172.16.0.255 scope global dynamic noprefixroute eth0 + valid_lft 107999971sec preferred_lft 107999971sec + inet6 fe80::f816:3eff:fe01:f1c3/64 scope link + valid_lft forever preferred_lft forever + + .. note:: + + To delete an added virtual IP address, perform the following steps: + + a. Open the configuration file **01-netcfg.yaml** and delete the virtual IP address of the corresponding NIC by referring to :ref:`3 `. + b. Make the deletion take effect by referring to :ref:`4 `. + +**Windows OS** **(Windows Server is used as an example here.)** + +#. In **Control Panel**, click **Network and Sharing Center**, and click the corresponding local connection. + +#. On the displayed page, click **Properties**. + +#. On the **Network** tab page, select **Internet Protocol Version 4 (TCP/IPv4)**. + +#. Click **Properties**. + +#. Select **Use the following IP address** and set **IP address** to the private IP address of the ECS, for example, 10.0.0.101. - .. figure:: /_static/images/en-us_image_0000001179761510.png - :alt: **Figure 1** Configuring private IP address + .. figure:: /_static/images/en-us_image_0000001179761510.png + :alt: **Figure 1** Configuring private IP address - **Figure 1** Configuring private IP address + **Figure 1** Configuring private IP address - f. Click **Advanced**. +#. Click **Advanced**. - g. On the **IP Settings** tab, click **Add** in the **IP addresses** area. +#. On the **IP Settings** tab, click **Add** in the **IP addresses** area. - Add the virtual IP address. For example, 10.0.0.154. + Add the virtual IP address, for example, 10.0.0.154. - .. figure:: /_static/images/en-us_image_0000001225081545.png - :alt: **Figure 2** Configuring virtual IP address + .. figure:: /_static/images/en-us_image_0000001225081545.png + :alt: **Figure 2** Configuring virtual IP address - **Figure 2** Configuring virtual IP address + **Figure 2** Configuring virtual IP address - h. Click **OK**. +#. Click **OK**. - i. In the **Start** menu, open the Windows command line window and run the following command to check whether the virtual IP address has been configured: +#. In the **Start** menu, open the Windows command line window and run the following command to check whether the virtual IP address has been configured: - **ipconfig /all** + **ipconfig /all** - In the command output, **IPv4 Address** is the virtual IP address 10.0.0.154, indicating that the virtual IP address of the ECS NIC has been correctly configured. + In the command output, **IPv4 Address** is the virtual IP address 10.0.0.154, indicating that the virtual IP address of the ECS NIC has been correctly configured. .. |image1| image:: /_static/images/en-us_image_0141273034.png .. |image2| image:: /_static/images/en-us_image_0000001626738526.png diff --git a/umn/source/vpc_and_subnet/index.rst b/umn/source/vpc_and_subnet/index.rst index ca02e96..786d127 100644 --- a/umn/source/vpc_and_subnet/index.rst +++ b/umn/source/vpc_and_subnet/index.rst @@ -7,6 +7,7 @@ VPC and Subnet - :ref:`VPC ` - :ref:`Subnet ` +- :ref:`IPv4 and IPv6 Dual-Stack Network ` .. toctree:: :maxdepth: 1 @@ -14,3 +15,4 @@ VPC and Subnet vpc/index subnet/index + ipv4_and_ipv6_dual-stack_network diff --git a/umn/source/vpc_and_subnet/ipv4_and_ipv6_dual-stack_network.rst b/umn/source/vpc_and_subnet/ipv4_and_ipv6_dual-stack_network.rst new file mode 100644 index 0000000..fcd107e --- /dev/null +++ b/umn/source/vpc_and_subnet/ipv4_and_ipv6_dual-stack_network.rst @@ -0,0 +1,101 @@ +:original_name: vpc_0002.html + +.. _vpc_0002: + +IPv4 and IPv6 Dual-Stack Network +================================ + +What Is an IPv4/IPv6 Dual-Stack Network? +---------------------------------------- + +IPv4 and IPv6 dual-stack allows your resources, such as ECSs, to use both IPv4 and IPv6 addresses for private and public network communications. For example, if ECSs use the IPv4/IPv6 dual-stack network: + +- ECSs can communicate with each other using private IPv4 addresses. +- ECSs can communicate with the Internet after they are bound with EIPs. +- ECSs can communicate with each other using IPv6 addresses. +- ECSs can communicate with the Internet after their IPv6 addresses are added to shared bandwidths. + +.. note:: + + If you select **Enable** for **IPv6 CIDR Block** when creating a subnet, an IPv6 CIDR block will be automatically assigned to the subnet. + + Basic operations on IPv4 and IPv6 dual-stack networks are the same as those on IPv4 networks, except some parameters. Check the console pages for details. + +Notes and Constraints +--------------------- + +- Only certain ECS specifications support IPv6 networks and can use IPv4/IPv6 dual-stack networks. You need to select such ECSs in supported regions. + + To check which ECSs support IPv6: + + - On the ECS console, click **Buy ECS**. On the displayed page, view the ECS specifications. + + If there is the **IPv6** parameter with the value of **Yes**, the ECS specifications support IPv6. + +IPv6 Application Scenarios +-------------------------- + +If your ECS supports IPv6, you can use the IPv4/IPv6 dual-stack network. :ref:`Table 1 ` shows the example application scenarios. + +.. _vpc_0002__table20563744105916: + +.. table:: **Table 1** Application scenarios of IPv4/IPv6 dual stack + + +--------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------+--------------------+---------------------------------------------------------------------------+ + | Application Scenario | Description | Subnet | ECS | + +============================================+=========================================================================================================================================================+====================+===========================================================================+ + | Private communication using IPv6 addresses | Your applications deployed on ECSs need to communicate with other systems (such as databases) through private networks using IPv6 addresses. | - IPv4 CIDR block | - Private IPv4 address: used for private communication | + | | | - IPv6 CIDR block | - IPv6 address: used for private communication. | + +--------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------+--------------------+---------------------------------------------------------------------------+ + | Public communication using IPv6 addresses | Your applications deployed on ECSs need to provide services accessible from the Internet using IPv6 addresses. | - IPv4 CIDR block | - Private IPv4 address + IPv4 EIP: used for public network communication | + | | | - IPv6 CIDR block | - IPv6 address + shared bandwidth: used for public network communication | + +--------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------+--------------------+---------------------------------------------------------------------------+ + | | Your applications deployed on ECSs need to both provide services accessible from the Internet and analyze the access request data using IPv6 addresses. | | | + +--------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------+--------------------+---------------------------------------------------------------------------+ + +Basic Operations +---------------- + +**Creating an IPv6 Subnet** + +Create an IPv6 subnet by following the instructions in :ref:`Creating a Subnet for the VPC `. Select **Enable** for **IPv6 CIDR Block**. An IPv6 CIDR block will be automatically assigned to the subnet. IPv6 cannot be disabled after the subnet is created. Currently, customizing IPv6 CIDR block is not supported. + +**Viewing In-Use IPv6 Addresses** + +In the subnet list, click the subnet name. On the displayed page, view in-use IPv4 and IPv6 addresses on the **IP Addresses** tab. + +**Adding a Security Group Rule (IPv6)** + +Add a security group rule with **Type** set to **IPv6** and **Source** or **Destination** set to an IPv6 address or IPv6 CIDR block. + +**Adding a Network ACL Rule (IPv6)** + +Add a network ACL rule with **Type** set to **IPv6** and **Source** or **Destination** set to an IPv6 address or IPv6 CIDR block. + +**Adding a Route (IPv6)** + +Add a route with **Destination** and **Next Hop** set to an IPv4 or IPv6 CIDR block. For details about how to add a route, see :ref:`Adding a Custom Route `. If the destination is an IPv6 CIDR block, the next hop can only be an IP address in the same VPC as the IPv6 CIDR block. + +.. note:: + + If the destination is an IPv6 CIDR block, the next hop type can only be an ECS, extension NIC, or virtual IP address. The next hop must also have IPv6 addresses. + +**Assigning an IPv6 Virtual IP Address** + +Assign a virtual IPv4 or IPv6 address by referring to :ref:`Assigning a Virtual IP Address `. + +.. note:: + + Each virtual IPv6 address can only be bound to one dual-stack NIC. + +**Dynamically Assigning IPv6 Addresses** + +After an ECS is created successfully, you can view the assigned IPv6 address on the ECS details page. You can also log in to the ECS and run the **ifconfig** command to view the assigned IPv6 address. + +If an IPv6 address fails to be automatically assigned or the selected image does not support the function of automatic IPv6 address assignment, manually obtain the IPv6 address by referring to "Dynamically Assigning IPv6 Addresses" in *Elastic Cloud Server User Guide*. + +.. note:: + + If an ECS is created from a public image: + + Before enabling dynamic IPv6 address assignment for a Linux public image, check whether IPv6 is supported and then check whether dynamic IPv6 address assignment has been enabled. Currently, all Linux public images support IPv6, and dynamic IPv6 address assignment is enabled for Ubuntu 16 by default. You do not need to configure dynamic IPv6 address assignment for the Ubuntu 16 OS. For other Linux public images, you need to enable this function. diff --git a/umn/source/vpc_and_subnet/subnet/creating_a_subnet_for_the_vpc.rst b/umn/source/vpc_and_subnet/subnet/creating_a_subnet_for_the_vpc.rst index 0f6214d..cb17574 100644 --- a/umn/source/vpc_and_subnet/subnet/creating_a_subnet_for_the_vpc.rst +++ b/umn/source/vpc_and_subnet/subnet/creating_a_subnet_for_the_vpc.rst @@ -48,7 +48,11 @@ Procedure | | | | | | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + | IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ + | IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` | + | | | | + | | If you select this option, the system automatically assigns an IPv6 CIDR block to the created subnet. Currently, the IPv6 CIDR block cannot be customized. IPv6 cannot be disabled after the subnet is created. | | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ | Associated Route Table | The default route table to which the subnet will be associated. You can change the route table to a custom route table on the **Subnets** page. | Default | +--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ diff --git a/umn/source/vpc_and_subnet/subnet/managing_subnet_tags.rst b/umn/source/vpc_and_subnet/subnet/managing_subnet_tags.rst index 81a6a3e..b793d0f 100644 --- a/umn/source/vpc_and_subnet/subnet/managing_subnet_tags.rst +++ b/umn/source/vpc_and_subnet/subnet/managing_subnet_tags.rst @@ -57,14 +57,14 @@ Procedure The **Subnets** page is displayed. -#. Click **+** to add another tag key and value. - - You can add multiple tag keys and values to refine your search results. If you add more than one tag to search for subnets, the subnets containing all specified tags will be displayed. - #. In the search box above the subnet list, click the search box. Click the tag key and then the value as required. The system filters resources based on the tag you select. + Click anywhere in the search box to add the next tag key and value. + + You can add multiple tag keys and values to refine your search results. If you add more than one tag to search for VPCs, the VPCs containing all specified tags will be displayed. + **Add, delete, edit, and view tags on the Tags tab of a subnet.** #. Log in to the management console. diff --git a/umn/source/vpc_and_subnet/vpc/creating_a_vpc.rst b/umn/source/vpc_and_subnet/vpc/creating_a_vpc.rst index fe8e312..4d11f6e 100644 --- a/umn/source/vpc_and_subnet/vpc/creating_a_vpc.rst +++ b/umn/source/vpc_and_subnet/vpc/creating_a_vpc.rst @@ -66,7 +66,11 @@ Procedure | | | | | | | | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ - | Default Subnet | CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + | Default Subnet | IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 | + +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ + | Default Subnet | IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` | + | | | | | + | | | After the IPv6 function is enabled, the system automatically assigns an IPv6 CIDR block to the created subnet. Currently, the IPv6 CIDR block cannot be customized. IPv6 cannot be disabled after the subnet is created. | | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ | Default Subnet | Associated Route Table | The default route table to which the subnet will be associated. You can change the route table to a custom route table on the **Subnets** page. | Default | +-------------------------------------+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+ diff --git a/umn/source/vpc_and_subnet/vpc/managing_vpc_tags.rst b/umn/source/vpc_and_subnet/vpc/managing_vpc_tags.rst index de98619..7cc5f02 100644 --- a/umn/source/vpc_and_subnet/vpc/managing_vpc_tags.rst +++ b/umn/source/vpc_and_subnet/vpc/managing_vpc_tags.rst @@ -53,7 +53,7 @@ Procedure The **Virtual Private Cloud** page is displayed. -#. In the search box above the subnet list, click the search box. +#. In the search box above the VPC list, click anywhere in the search box. Click the tag key and then the value as required. The system filters resources based on the tag you select. diff --git a/umn/source/vpc_flow_log/creating_a_vpc_flow_log.rst b/umn/source/vpc_flow_log/creating_a_vpc_flow_log.rst index 67a95c7..0597445 100644 --- a/umn/source/vpc_flow_log/creating_a_vpc_flow_log.rst +++ b/umn/source/vpc_flow_log/creating_a_vpc_flow_log.rst @@ -62,7 +62,7 @@ Procedure | | - **Accepted traffic**: specifies that only accepted traffic of the specified resource will be logged. Accepted traffic refers to the traffic permitted by the security group or firewall. | | | | - **Rejected traffic**: specifies that only rejected traffic of the specified resource will be logged. Rejected traffic refers to the traffic denied by the firewall. | | +-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ - | Log Group | The log group created in LTS. | lts-group-wule | + | Log Group | The log group created in LTS. | lts-group-abc | +-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ | Log Topic | The log topic created in LTS. | LogTopic1 | +-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+ diff --git a/umn/source/vpc_flow_log/enabling_or_disabling_vpc_flow_log.rst b/umn/source/vpc_flow_log/enabling_or_disabling_vpc_flow_log.rst index ba414d1..1a80a56 100644 --- a/umn/source/vpc_flow_log/enabling_or_disabling_vpc_flow_log.rst +++ b/umn/source/vpc_flow_log/enabling_or_disabling_vpc_flow_log.rst @@ -8,7 +8,13 @@ Enabling or Disabling VPC Flow Log Scenarios --------- -After a VPC flow log is created, the VPC flow log is automatically enabled. If you do not need to record traffic data, you can disable the corresponding VPC flow log. The disabled VPC flow log can be enabled again. +After a VPC flow log is created, the VPC flow log is automatically enabled. If you do not need to record flow log data, you can disable the corresponding VPC flow log. A disabled VPC flow log can be enabled again. + +Notes and Constraints +--------------------- + +- After a VPC flow log is enabled, the system starts to collect flow logs in the next log collection period. +- After a VPC flow log is disabled, the system stops collecting flow logs in the next log collection period. Generated flow logs will still be reported. Procedure --------- diff --git a/umn/source/vpc_flow_log/vpc_flow_log_overview.rst b/umn/source/vpc_flow_log/vpc_flow_log_overview.rst index 2a58ce2..1945087 100644 --- a/umn/source/vpc_flow_log/vpc_flow_log_overview.rst +++ b/umn/source/vpc_flow_log/vpc_flow_log_overview.rst @@ -5,6 +5,9 @@ VPC Flow Log Overview ===================== +What Is a VPC Flow Log? +----------------------- + A VPC flow log records information about the traffic going to and from a VPC. VPC flow logs help you monitor network traffic, analyze network attacks, and determine whether security group and firewall rules require modification. VPC flow logs must be used together with the Log Tank Service (LTS). Before you create a VPC flow log, you need to create a log group and a log topic in LTS. :ref:`Figure 1 ` shows the process for configuring VPC flow logs. diff --git a/umn/source/vpc_peering_connection/creating_a_vpc_peering_connection_with_a_vpc_in_another_account.rst b/umn/source/vpc_peering_connection/creating_a_vpc_peering_connection_with_a_vpc_in_another_account.rst index 4e3428b..d127300 100644 --- a/umn/source/vpc_peering_connection/creating_a_vpc_peering_connection_with_a_vpc_in_another_account.rst +++ b/umn/source/vpc_peering_connection/creating_a_vpc_peering_connection_with_a_vpc_in_another_account.rst @@ -14,10 +14,13 @@ This following describes how to create a VPC peering connection between VPC-A in Procedure: -#. :ref:`Step 1: Create a VPC Peering Connection ` -#. :ref:`Step 2: Peer Account Accepts the VPC Peering Connection Request ` -#. :ref:`Step 3: Add Routes for the VPC Peering Connection ` -#. :ref:`Step 4: Verify Network Connectivity ` +:ref:`Step 1: Create a VPC Peering Connection ` + +:ref:`Step 2: Peer Account Accepts the VPC Peering Connection Request ` + +:ref:`Step 3: Add Routes for the VPC Peering Connection ` + +:ref:`Step 4: Verify Network Connectivity ` .. figure:: /_static/images/en-us_image_0000001464757610.png diff --git a/umn/source/vpc_peering_connection/creating_a_vpc_peering_connection_with_another_vpc_in_your_account.rst b/umn/source/vpc_peering_connection/creating_a_vpc_peering_connection_with_another_vpc_in_your_account.rst index ce77edf..b5edd78 100644 --- a/umn/source/vpc_peering_connection/creating_a_vpc_peering_connection_with_another_vpc_in_your_account.rst +++ b/umn/source/vpc_peering_connection/creating_a_vpc_peering_connection_with_another_vpc_in_your_account.rst @@ -14,9 +14,11 @@ This following describes how to create a VPC peering connection between VPC-A an Procedure: -#. :ref:`Step 1: Create a VPC Peering Connection ` -#. :ref:`Step 2: Add Routes for the VPC Peering Connection ` -#. :ref:`Step 3: Verify Network Connectivity ` +:ref:`Step 1: Create a VPC Peering Connection ` + +:ref:`Step 2: Add Routes for the VPC Peering Connection ` + +:ref:`Step 3: Verify Network Connectivity ` .. figure:: /_static/images/en-us_image_0000001512876289.png diff --git a/umn/source/vpc_peering_connection/vpc_peering_connection_overview.rst b/umn/source/vpc_peering_connection/vpc_peering_connection_overview.rst index 41b0c55..dd832e5 100644 --- a/umn/source/vpc_peering_connection/vpc_peering_connection_overview.rst +++ b/umn/source/vpc_peering_connection/vpc_peering_connection_overview.rst @@ -8,7 +8,7 @@ VPC Peering Connection Overview What Is a VPC Peering Connection? --------------------------------- -A VPC peering connection is a networking connection between two VPCs and enables them to communicate using private IP addresses. The VPCs to be peered can be in the same account or different accounts, but must be in the same region. +A VPC peering connection is a networking connection that connects two VPCs for them to communicate using private IP addresses. The VPCs to be peered can be in the same account or different accounts, but must be in the same region. - You can use VPC peering connections to build networks in different scenarios. For details, see :ref:`VPC Peering Connection Usage Examples `.