ACOS HCI supports enabling a cluster firewall on cluster hosts to restrict ingress traffic from outside the cluster to host services. The cluster firewall and distributed firewall protect different targets: the distributed firewall is mainly used to protect virtual machine traffic, while the cluster firewall is used to protect service ports exposed by cluster nodes themselves.
The cluster firewall can be enabled or disabled. Newly deployed clusters have the cluster firewall enabled by default. When enabled, the system controls access to ingress traffic based on service ports and source IP addresses; when disabled, host service ports are no longer restricted by the cluster firewall. The cluster firewall also supports configuring a default rule to allow or deny other ingress traffic that does not match any service rule.
The cluster firewall abstracts host port access into two categories: internal services and external services.
Internal services: Services required for the cluster to run, such as the ports used by storage, management, monitoring, cluster coordination, and other components. These services are automatically maintained by the system based on the current cluster version and platform. They are also registered by system services as needed. Manual configuration is neither required nor recommended.
External services: Host services that need to be exposed outside the cluster, such as SSH, SNMP, HTTP, HTTPS, IPMI, Ping, VNC, and some external storage access ports. You can configure an external IP allowlist for these services as needed. The default policy is Allow all.
The same port may be used by both internal services and external services. For example, HTTP and HTTPS may be used for external access and may also be depended on by system components. In this case, access allowed for internal services takes precedence over manually configured external allowlists, preventing tightened external access restrictions from affecting the cluster's normal operation.
Internal service ports come from the cluster's built-in service list and system service registrations. Because the ports used can vary across different products and their versions, the port list is shipped with the installation or upgrade package and automatically synced to all nodes by the system after deployment or upgrade. This mechanism ensures normal communication between cluster components while avoiding exposure of unrelated ports to all internal networks.
External services handle access to hosts by users, operations and management systems, or external clients. When the cluster firewall is enabled, external services allow access by default. You can adjust this based on your security requirements to deny all access, or to allow access only from specified IP addresses, CIDRs, or IP ranges.
For services intended for external use only, the configured allowlist directly determines whether external sources can access them. For services also used by internal components, the configured allowlist affects only the external access. Source addresses required by internal services are still automatically allowed by the system.
On each node of a cluster, the cluster firewall uses iptables and ipset to manage ingress rules. iptables organizes rule chains and defines final actions, while ipset efficiently stores port sets and IP sets.
When the rules take effect, ingress traffic on a node enters the firewall rule chain. Established connections and the local loopback address are allowed first, followed by matching against internal services and then external services, in order. Traffic that does not match any service rule is ultimately allowed or denied based on the cluster-level default rule.
The cluster firewall only restricts ingress traffic accessing services on ACOS HCI cluster hosts; it does not restrict egress traffic initiated by hosts, nor is it used to control traffic between virtual machines. The host's local address 127.0.0.1 and the link-local address 169.254.0.0/16 are always allowed and are not subject to firewall allowlist restrictions.
For active-active clusters, firewall rules primarily apply to cluster nodes. The witness node is not exposed as an independently controlled node in the firewall configuration. Service ports used for cross-cluster hot migration are protected separately by the system and are automatically allowed when hot migration needs to be performed, avoiding long-term exposure of these ports outside migration scenarios.
