This topic describes how to create a firewall policy for the Grafana instance in your Healthwatch™ for VMware Tanzu (Healthwatch) installation.

Overview of Firewall Policies for the Grafana Instance

In the Healthwatch tile, allowing external access to individual VMs is disallowed by default. Creating a firewall policy for the Grafana instance allows users to access the Grafana UI more easily from outside your BOSH network, including from the links to the Grafana UI that Alertmanager provides in alert messages.

You create firewall policies in the console for your Tanzu Operations Manager deployment’s IaaS. To create a firewall policy for the Grafana instance, see the section for your IaaS:

• AWS: Create a Firewall Policy in AWS

• Azure: Create a Firewall Policy in Azure

• GCP: Create a Firewall Policy in GCP

• vSphere: Create a Firewall Policy in vSphere NSX-V

Create a Firewall Policy in AWS

To create a firewall policy in AWS:

1. Log in to the Amazon EC2 dashboard.

2. Select Security Group.

3. Click Create Security Group.

4. For Security group name, enter the name you want to give the security group. For example, grafana-port-access.

5. For Description, enter a description for your security group.

6. For VPC, select from the dropdown the VPC where the Grafana instance is deployed.

7. Select the Inbound tab.

8. To create the first rule:

   1. Click Add rule.
   2. For Type, select HTTPS from the dropdown.
   3. For Protocol, select TCP from the dropdown.
   4. For Port Range, enter 443.
   5. For Source, enter 0.0.0.0/0.
   6. Click Save rules.

9. To create the second rule:

   1. Click Add rule.
   2. For Type, select HTTP from the dropdown.
   3. For Protocol, select TCP from the dropdown.
   4. For Port Range, enter 80.
   5. For Source, enter 0.0.0.0/0.
   6. Click Save rules.

10. Click Create.

11. Select Instances.

12. Click the Grafana instance.

13. Click Actions.

14. Under Security, click Change security groups.

15. Activate the checkbox next to the security group you created for the Grafana instance.

16. Click Add security group.

17. Click Save.

For more information about creating a firewall policy in AWS for a Linux instance, see the AWS documentation for Linux instances of Amazon EC2. For more information about creating a firewall policy in AWS for a Windows instance, see the AWS documentation for Windows instances of Amazon EC2.

Create a Firewall Policy in Azure

To create a firewall policy in Azure:

1. Log in to the Azure portal.

2. Select Resource groups.

3. Click Add.

4. Create a resource group for the Grafana instance. For more information, see the Azure documentation.

5. Select the Network rule collection tab.

6. Click Add network rule collection.

7. For Name, enter the name you want to give the rule collection. For example, grafana-port-access.

8. For Priority, enter 1000.

9. For Action, select Allow.

10. Click Rules.

11. Under IP addresses, configure the following fields for your first rule:

    1. For Name, enter a name for the first rule.
    2. For Protocol, select TCP from the dropdown.
    3. For Source type, select IP address from the dropdown.
    4. For Source, enter (*).
    5. For Destination type, select IP address from the dropdown.
    6. For Destination address, enter the public IP address of the Grafana instance or the load balancer for the Grafana instance.
    7. For Destination Ports, enter 443.

12. Under IP addresses, configure the following fields for your second rule:

    1. For Name, enter a name for the second rule.
    2. For Protocol, select TCP from the dropdown.
    3. For Source type, select IP address from the dropdown.
    4. For Source, enter (*).
    5. For Destination type, select IP address from the dropdown.
    6. For Destination address, enter the public IP address of the Grafana instance or the load balancer for the Grafana instance.
    7. For Destination Ports, enter 80.

13. Click Add.

14. Click Review + create.

15. Click Save.

For more information about creating a firewall policy in Azure, see the Azure documentation.

Create a Firewall Policy in GCP

To create a firewall policy in GCP:

1. Log in to the Google Cloud console.

2. Under VPC, select Firewall.

3. To create the first rule:

   1. Click Create firewall rule.
   2. For Name, enter a name for the first rule.
   3. For Network, select from the dropdown the network where the Grafana instance is deployed.
   4. For Priority, enter 1000.
   5. For Target tags, enter grafana.
   6. For Source IP ranges, enter 0.0.0.0/0.
   7. Under Protocols and ports, select Specified protocols and ports.
   8. Activate the tcp checkbox.
   9. For tcp, enter 443.
   10. Click Create.

4. To create the second rule:

   1. Click Create firewall rule.
   2. For Name, enter a name for the second rule.
   3. For Network, select from the dropdown the network where the Grafana instance is deployed.
   4. For Priority, enter 1000.
   5. For Target tags, enter grafana.
   6. For Source IP ranges, enter 0.0.0.0/0.
   7. Under Protocols and ports, select Specified protocols and ports.
   8. Activate the tcp checkbox.
   9. For tcp, enter 80.
   10. Click Create.

For more information about creating a firewall policy in GCP, see the GCP documentation.

Create a Firewall Policy in vSphere NSX-V

To create a firewall policy in vSphere NSX-V:

1. Log in to vSphere.

2. Click Networking & Security.

3. Select NSX Edges.

4. Double-click the Edge for your Tanzu Platform for CF deployment.

5. Select Manage.

6. Select Firewall.

7. To create the first rule:

   1. Click the Add icon.
   2. For Name, enter a name for the first rule.
   3. For Source, select Any.
   4. For Destination, enter the public IP address for the Grafana instance or the load balancer for the Grafana instance.
   5. For Service, select Any.

8. To create the second rule:

   1. Click the Add icon.
   2. For Name, enter a name for the first rule.
   3. For Source, select Any.
   4. For Destination, enter the public IP address for the Grafana instance or the load balancer for the Grafana instance.
   5. For Service, select Any.

9. Click Publish Changes.

For more information about adding an NSX Edge firewall rule, see the vSphere documentation.