Perimeter Policies
A Perimeter Policy filters traffic at the edge of your VDC, before it reaches your VNets. While the firewall handles fine-grained rules by protocol and port, a Perimeter Policy applies broader protection and is attached to one or more VNets.
Policy types
A Perimeter Policy uses one filtering strategy:
- Geo Guard: block traffic by country. You pick the countries to block, and traffic from them is rejected.
- Custom List: block (or allow) specific IP ranges, defined as CIDRs.
- Threat Defense: automated filtering based on threat intelligence, with no manual list to maintain.
Scope and exceptions
A policy also defines:
- Global exceptions: whitelisted CIDRs that bypass the policy, no matter what.
- Scope: the protocol and destination ports the policy applies to.
- VNets: which VNets the policy protects.
A policy can be enabled or disabled, and the change applies immediately.
When to use it
Use a Perimeter Policy for coarse, VDC-wide protection: keeping out entire regions, known-bad IP ranges, or automated threats. Use the firewall for precise rules about which resources may talk to each other. The two work together.