11.4 OCI Network Firewall: Policies, Inspection Routing, Tunnel Inspection & Private NAT
Key Takeaways
OCI Network Firewall is powered by Palo Alto Networks and inspects north-south and east-west traffic that you route to its private IP address.
If a firewall policy has no rules, the firewall denies all traffic, and traffic that matches no security rule is dropped.
Decryption rules are evaluated before security rules, and within each rule type the first match in priority order wins.
Tunnel inspection rules inspect VXLAN traffic mirrored by a Virtual Test Access Point and return the scanned traffic to the source tunnel endpoint.
Network Firewall NAT rules perform private, many-to-one source NAT for IPv4 only; destination NAT, static one-to-one NAT, and public NAT are not supported.
What the Service Provides
OCI Network Firewall is a managed firewall service powered by Palo Alto Networks. It gives visibility into traffic entering the cloud environment (north-south) and traffic between subnets and VCNs (east-west). A firewall is a highly available, scalable instance created in a subnet. You decide which traffic it inspects by pointing route tables at the firewall's private IP address.
Features documented by Oracle include:
- Stateful network filtering by source and destination IP (IPv4 and IPv6), port, and protocol.
- URL and FQDN filtering, including wildcards and custom URLs.
- Intrusion detection and prevention (IDPS).
- SSL inspection: decryption and inspection of TLS traffic, with Encrypted Server Name Indication (ESNI) support.
- Intra-VCN subnet inspection and inter-VCN inspection.
- VXLAN tunnel inspection of traffic mirrored by a Virtual Test Access Point (VTAP).
- NAT rules for private source NAT.
The service provides a throughput rate of 4 Gbps per firewall (Oracle's NAT guidance also references a 25 Gbps firewall option).
Placement and Availability
When you create a firewall you choose regional (the default) or availability domain-specific:
- A regional firewall's instances are distributed across all availability domains in the region, which reduces the risk from an AD failure. Traffic from a client in a different AD than the firewall instance can add milliseconds of latency.
- An AD-specific firewall's instances are spread across fault domains within one AD. It can cause traffic redirection when the traffic comes from a regional subnet.
You do not build active-standby pairs or failover scripts; Oracle manages the firewall's availability.
Policies and Their Components
A firewall policy holds the rules that control how a firewall inspects, allows, or denies traffic. One policy can be associated with one or more firewalls, and you need a policy to create a firewall. Policies are built from reusable components:
| Component | Purpose |
|---|---|
| Lists | Groups of addresses, applications, services, or URLs used in rule match conditions |
| Mapped secrets | Vault secrets mapped to inbound or outbound SSL keys and certificates |
| Decryption profiles | Settings for session, server, and failure checks during decryption |
The rule types are decryption rules, security rules, tunnel inspection rules, and NAT rules.
How Rules Are Evaluated
- If a policy has no rules, the firewall denies all traffic.
- Decryption rules are always applied before security rules.
- Within each rule type, rules are evaluated in priority order, and the first matching rule is applied; no later rules of that type are evaluated.
- If a packet matches no decryption rule, it is not decrypted. If it matches no security rule, it is dropped.
- A new rule becomes first in the priority list by default, and you can reorder rules at any time.
- An empty match list in a security rule matches any value.
Security Rule Actions
| Action | Result |
|---|---|
| Allow | Traffic proceeds |
| Drop | Traffic is silently dropped |
| Reject | Traffic is dropped and a reset is sent |
| Intrusion detection | Traffic is logged |
| Intrusion prevention | Traffic is blocked |
To use intrusion detection and prevention, you must enable logging for the firewall. A policy can hold up to 10,000 security rules.
SSL Inspection With Vault
Decryption rules can decrypt with SSL forward proxy (outbound traffic from your clients to external servers), decrypt with SSL inbound inspection (traffic to your own servers), or not decrypt. Decryption uses mapped secrets: certificates and keys stored as secrets in OCI Vault and mapped into the policy, so private keys are not pasted into the firewall configuration. A policy can have up to 300 mapped secrets but only one SSL forward proxy mapped secret. Decryption profiles control checks such as blocking sessions when a certificate status check times out.
Tunnel Inspection
Tunnel inspection rules inspect traffic mirrored to the firewall by the Virtual Test Access Point (VTAP) service. Mirrored traffic arrives encapsulated in VXLAN. When a rule matches, the firewall applies a fixed Palo Alto Networks tunnel inspection profile named VXLAN, which returns the scanned packets to the originating VXLAN tunnel endpoint (VTEP). This lets you inspect a copy of traffic, for example from a sensitive subnet, without placing the firewall inline. A policy can hold up to 500 tunnel inspection rules.
Private NAT With NAT Rules
NAT rules perform many-to-one source NAT (SNAT) on traffic that matches the rule, replacing internal source addresses with addresses from a pool allocated from the firewall's subnet. Key constraints:
- Private NAT only; public NAT is not supported.
- Source NAT only; destination NAT is not supported.
- Dynamic many-to-one NAT/PAT is supported; static one-to-one NAT is not.
- IPv4 only.
- The firewall subnet needs spare IPs: at least 4 for a 4 Gbps firewall and 5 for a 25 Gbps firewall.
- NAT rules are applied after decryption, security, and tunnel inspection rules.
- In the Console, NAT is enabled automatically when you associate a policy with NAT rules; with the CLI or API you must enable it explicitly. While the attached policy contains NAT rules, NAT cannot be turned off.
A common use is hiding overlapping or internal address ranges when traffic leaves for a partner network.
Routing Traffic Through the Firewall
The firewall only inspects traffic that route tables send to it. Oracle's documented patterns:
| Scenario | Routing |
|---|---|
| On-premises to a VCN | The DRG's route table sends traffic to the firewall's private IP; the firewall subnet routes onward to the private subnet, and the private subnet routes return traffic back to the firewall |
| Internet to a VCN | An internet gateway route table sends traffic for the VCN to the firewall; the public subnet's route table sends return traffic (0.0.0.0/0) to the firewall; the firewall subnet routes 0.0.0.0/0 to the internet gateway |
| Between subnets | Each subnet's route table sends traffic for the other subnet to the firewall |
In a hub-and-spoke design, the firewall sits in a hub VCN, spokes attach to a DRG, and DRG route tables send spoke-to-spoke and spoke-to-internet traffic through the hub's firewall.
Symmetric Routing
The firewall is stateful. It must see both directions of a connection. If the forward path goes through the firewall but the return path bypasses it, the firewall cannot match the return packets to a session and the connection fails. Every route table on the path, in both directions, must send the traffic through the same firewall.
Network Firewall vs. Other Controls
| Control | Layer | Strength |
|---|---|---|
| Security lists and NSGs | L3/L4 | Simple, distributed, no extra cost |
| ZPR | L4, attribute-based | Intent-based segmentation inside OCI |
| Network Firewall | L3 to L7 | IDPS, URL filtering, TLS inspection, tunnel inspection |
| WAF | L7 HTTP | OWASP protections in front of web applications |
A team attaches a new Network Firewall policy that contains address lists and decryption profiles but no rules yet. What happens to the traffic routed through the firewall?
All traffic is allowed until the first security rule is added to the policy
All traffic is denied, because a policy with no rules denies everything
Only TLS traffic is denied, because the policy has no decryption rule
Traffic is allowed but logged as intrusion detection events
A company must hide its internal source addresses when traffic from several workload subnets leaves through a hub firewall to a partner network over a private connection. The partner accepts only a small set of addresses. Which Network Firewall feature fits?
A destination NAT rule that maps the partner's address to each workload
A static one-to-one NAT rule for each workload instance in the spoke VCNs
A many-to-one source NAT rule using addresses from the firewall's subnet
A public NAT rule that translates the traffic to a reserved public IP
The security team wants the firewall to inspect a copy of all traffic from a sensitive subnet without placing the firewall in the traffic path. Which configuration fits?
A VTAP that mirrors the traffic, plus a tunnel inspection rule in the policy
An SSL inbound inspection decryption rule for the monitored subnet
A security rule with the Intrusion prevention action on the subnet's CIDR
A route table entry that sends the subnet's traffic to the firewall's private IP
Sections you finish are checked off in the contents.