Share via

Allow and block VM traffic using SDN port ACLs

  • Article

In System Center Virtual Machine Manager (VMM), you can centrally configure and manage software defined network (SDN) port access control lists (ACLs).

  • A port ACL is a set of port ACL rules that filter the traffic at layer 2 port level.
  • A port ACL in VMM filters access to a specific VMM network object.
  • Each VMM network object can have only one port ACL attached.
  • An ACL contains rules and can be attached to any number of VMM network objects. You can create an ACL without rules and add the rules later.
  • If an ACL has multiple rules, they're applied based on the priority. After a rule matches the criteria and is applied, no other rules are processed.
  • SDN Port ACLs can be applied to virtual subnets and virtual network adapters.

Note

Port ACL settings are exposed only through PowerShell cmdlets in VMM and can't be configured in the VMM console.

Using VMM PowerShell, you can also configure Hyper-V port ACLs. For more information, see Hyper-V port ACLs.

This article provides information on how to create and manage SDN port ACLs by using the VMM PowerShell cmdlets.

Before you start

Ensure that SDN network controller is deployed.

Create a port ACL

  1. Open PowerShell in VMM.

  2. Create a port ACL.

    PowerShell 
    PS C:\> New-SCPortACL -Name "RDPAccess" -Description "PortACL to control RDP access" -ManagedByNC

    Note

    The parameter -ManagedByNC ensures that the port ACL is managed by Network Controller (NC) and can only be attached to NC managed objects. The cmdlets provided here use example values.

Create a port ACL rule

  1. Get an existing port ACL.

    PowerShell 
    PS C:\> $portACL = Get-SCPortACL -Name "RDPAccess"

  2. Create a port ACL rule.

    PowerShell 
    PS C:\> New-SCPortACLRule -Name "AllowRDPAccess" -PortACL $portACL -Description "Allow RDP Rule from a subnet" -Action Allow -Type Inbound -Priority 110 -Protocol Tcp -LocalPortRange 3389 -RemoteAddressPrefix 10.184.20.0/24

    Note

    • Priority range for SDN port ACL rules: 1 – 64500.
    • Only TCP/UDP/Any protocol parameters are supported for creating ACL rules.

Attach an ACL to a virtual network adapter

  1. Get the virtual network adapter.

    PowerShell 
    PS C:\> $vm = Get-SCVirtualMachine -Name “TenantVM”
PS C:\> $adapter = Get-SCvirtualNetworkAdapter -VM $vm"

  2. Attach an existing port ACL to the virtual network adapter.

    PowerShell 
    PS C:\> $portACL = Get-SCPortACL -Name "RDPAccess"
PS C:\> Set-SCVirtualNetworkAdapter -VirtualNetworkAdapter $adapter -PortACL $portACL

    Note

    You can also attach a port ACL while creating the virtual network adapter through New-SCVirtualNetworkAdapter cmdlet. Learn more.

Detach a port ACL from a virtual network adapter

  1. Get the virtual network adapter that you want to detach the port ACL from.

    PowerShell 
    PS C:\> $vm = Get-SCVirtualMachine -Name “TenantVM”
PS C:\> $adapter = Get-SCvirtualNetworkAdapter -VM $vm

  2. Detach the port ACL from the virtual network adapter.

    PowerShell 
    PS C:\> Set-SCVirtualNetworkAdapter -VirtualNetworkAdapter $adapter -RemovePortACL

Attach an ACL to a VM subnet

  1. Get the VM subnet to attach the ACL.

    PowerShell 
    PS C:\> $vmSubnet = Get-SCVMSubnet -Name “Tenant Subnet”

  2. Attach an existing port ACL to the VM subnet.

    PowerShell 
    PS C:\> Set-SCVMSubnet -VMSubnet $vmSubnet -PortACL $portACL

    Note

    You can also attach a port ACL while creating VM subnet through New-SCVMSubnet cmdlet. Learn more.

Detach a port ACL from a VM subnet

  1. Get the VM subnet that you want to detach the port ACL from.

    PowerShell 
    PS C:\> $vmSubnet = Get-SCVMSubnet -Name “Tenant Subnet”

  2. Detach the port ACL from the VM subnet.

    PowerShell 
    PS C:\> Set-SCVMSubnet –VMSubnet $vmSubnet -RemovePortACL

Remove a port ACL rule

  1. Get the port ACL rule that you want to remove.

    PowerShell 
    PS C:\> $portACLRule = Get-SCPortACLRule –Name “AllowRDPAccess”

  2. Remove the port ACL rule.

    PowerShell 
    PS C:\> Remove-SCPortACLRule -PortACLRule $portACLRule

Remove a port ACL

  1. Get the port ACL that you want to remove.

    PowerShell 
    PS C:\> $portACL = Get-SCPortACL -Name “RDPAccess”

  2. Remove the port ACL.

    PowerShell 
    PS C:\> Remove-SCPortACL -PortACL $portACL