Skip to content

Commit c29379e

Browse files
eedugoneedugon
committed
remote cluster filters updated
1 parent 7a28e29 commit c29379e

File tree

1 file changed

+110
-25
lines changed

1 file changed

+110
-25
lines changed

‎deploy-manage/security/remote-cluster-filtering.md‎

Lines changed: 110 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,17 @@ Because of [how network security works](/deploy-manage/security/network-security
2222

2323
Refer to [Remote clusters and network security](/deploy-manage/remote-clusters.md#network-security) for more information about the remote clusters functionality, its relationship to network security, and the supported use cases.
2424

25-
## Create remote cluster filter [create-remote-cluster-filter]
25+
To apply a filter to a deployment, you must first create a security policy at the organization or platform level, and then apply it to your deployment.
26+
27+
This guide covers the following remote cluster filtering tasks:
28+
29+
* [Create a remote cluster filter](#create-remote-cluster-filter)
30+
* [Associate a remote cluster filter with your deployment](#apply-remote-cluster-filter)
31+
* [Remove a filter association from your deployment](#remove-association)
32+
* [Edit a remote cluster filter](#edit-remote-cluster-filter)
33+
* [Delete a remote cluster filter](#delete-remote-cluster-filter)
34+
35+
## Create a remote cluster filter [create-remote-cluster-filter]
2636

2737
:::::{tab-set}
2838

@@ -35,8 +45,8 @@ Remote cluster filters are presented in {{ecloud}} as a type of Private Connecti
3545
4. Select **Create** > **Private connection**.
3646
5. Select the cloud provider and region for the remote cluster filter.
3747

38-
:::{tip}
39-
Network security policies are bound to a single region, and can be assigned only to deployments or projects in the same region. If you want to associate an IP filter with resources in multiple regions, then you have to create the same filter in all the regions you want to apply it to.
48+
:::{note}
49+
Network security policies are bound to a single region, and can be assigned only to deployments or projects in the same region. If you want to associate a policy with resources in multiple regions, then you have to create the same policy in all the regions you want to apply it to.
4050
:::
4151

4252
6. In the **Connectivity** section, select **Remote cluster**.
@@ -47,27 +57,16 @@ Remote cluster filters are presented in {{ecloud}} as a type of Private Connecti
4757
Find the organization ID on the organization page in the top-right menu, and the {{es}} ID of a deployment by selecting **Copy cluster ID** on the deployment management page.
4858
::::
4959

50-
% Not sure if we want any of this
51-
::::{important}
52-
Network security filtering for remote cluster traffic from ECE to ECH is not supported. These filters apply only to {{ecloud}} resources, so the values must be {{ecloud}} IDs.
53-
54-
If you require network security policies in the remote deployment for remote cluster connections coming from ECE, consider configuring the remote clusters with the deprecated [TLS certificate–based authentication model](/deploy-manage/remote-clusters/ece-remote-cluster-ece-ess.md). Traffic with this model is authenticated through mTLS and is not subject to network security filters.
55-
56-
Refer to [Remote clusters and network security](/deploy-manage/remote-clusters.md#network-security) for more information.
57-
::::
58-
5960
9. Optional: Under **Apply to resources**, associate the new filter with one or more deployments. After you associate the filter with a deployment, it will allow remote cluster traffic coming from the organization or {{es}} IDs defined in the rules.
6061

61-
:::{tip}
62+
:::{note}
6263
You can apply multiple policies to a single deployment. For {{ech}} deployments, you can apply both IP filter policies and private connection policies. In case of multiple policies, traffic can match any associated policy to be forwarded to the resource. If none of the policies match, the request is rejected with `403 Forbidden`.
6364

6465
[Learn more about how network security policies affect your deployment](network-security-policies.md).
6566
:::
6667

6768
8. To automatically attach this filter to new deployments, select **Apply by default**.
6869
9. Click **Create**.
69-
70-
7170
::::
7271

7372
::::{tab-item} {{ece}}
@@ -104,23 +103,109 @@ Because this type of filter operates at the proxy level, if the local deployment
104103

105104
:::::
106105

107-
## Associate a remote filter to a deployment
108-
109-
(Work in progress)
106+
## Associate a remote cluster filter with your deployment [apply-remote-cluster-filter]
110107

111-
On ECE:
108+
After you've created the network security policy or rule set, you'll need to associate it with your deployment. To do that:
112109

113-
After you’ve created the policy or rule set, you’ll need to associate it with your deployment:
110+
:::::::{tab-set}
114111

115-
1. Go to the deployment.
116-
2. On the **Security** page, under **Traffic filters**, select **Apply filter**.
112+
::::::{tab-item} {{ech}}
113+
1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body).
114+
2. On the **Hosted deployments** page, select your deployment.
115+
3. Select the **Security** tab on the left-hand side menu bar.
116+
4. Under **Network security**, select **Apply policies** > **Private connection**.
117+
5. Choose the security policy you want to apply and select **Apply**.
118+
::::::
119+
120+
::::::{tab-item} {{ece}}
121+
1. Open the deployment management page in the Cloud UI.
122+
2. Select the **Security** tab on the left-hand side menu bar.
123+
3. Under **Traffic filters**, select **Apply filter**.
117124
3. Choose the filter you want to apply and select **Apply filter**.
125+
::::::
126+
127+
:::::::
128+
129+
## Remove a filter association from your deployment [remove-association]
130+
131+
To remove a network security policy or rule set association from your deployment:
132+
133+
:::::::{tab-set}
118134

135+
::::::{tab-item} {{ech}}
119136

120-
On Cloud:
137+
You can remove associations from your deployments directly from the policy settings or from the deployment security page.
121138

139+
#### From your deployment security page
122140
1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body).
123141
2. On the **Hosted deployments** page, select your deployment.
124142
3. Select the **Security** tab on the left-hand side menu bar.
125-
4. Under **Network security**, select **Apply policies** > **IP filter**.
126-
5. Choose the IP filter you want to apply and select **Apply**.
143+
4. Under **Network security**, find the security policy you want to disconnect.
144+
5. Under **Actions**, click the **Delete** icon.
145+
146+
#### From the network security policy settings
147+
:::{include} _snippets/network-security-page.md
148+
:::
149+
4. Find the remote cluster policy you want to edit, then select the **Edit** {icon}`pencil` button.
150+
5. Under **Apply to resources**, click the `x` beside the resource that you want to disconnect.
151+
6. Click **Update** to save your changes.
152+
153+
154+
::::::
155+
156+
::::::{tab-item} {{ece}}
157+
1. Open the deployment management page in the Cloud UI.
158+
2. Select the **Security** tab on the left-hand side menu bar.
159+
3. Under **Traffic filters**, select **Remove**.
160+
3. Choose the filter you want to remove.
161+
::::::
162+
163+
:::::::
164+
165+
## Edit a remote cluster filter [edit-remote-cluster-filter]
166+
167+
You can edit a remote cluster filter policy name or change the list of allowed Organization IDs and {{es}} cluster IDs. To do that:
168+
169+
:::::::{tab-set}
170+
171+
::::::{tab-item} {{ech}}
172+
:::{include} _snippets/network-security-page.md
173+
:::
174+
4. Find the remote cluster policy you want to edit, then select the **Edit** {icon}`pencil` button.
175+
5. Select **Update** to save your changes.
176+
::::::
177+
178+
::::::{tab-item} {{ece}}
179+
1. [Log into the Cloud UI](/deploy-manage/deploy/cloud-enterprise/log-into-cloud-ui.md).
180+
2. From the **Platform** menu, select **Security**.
181+
3. Find the rule set you want to edit.
182+
4. Select the **Edit** {icon}`pencil` button.
183+
5. Click **Update** to save your changes.
184+
::::::
185+
186+
:::::::
187+
188+
## Delete a remote cluster filter [delete-remote-cluster-filter]
189+
190+
If you need to remove a remote cluster filter policy, you must first [remove any associations](#remove-association) with deployments.
191+
192+
To delete a filter:
193+
194+
:::::::{tab-set}
195+
196+
::::::{tab-item} {{ech}}
197+
:::{include} _snippets/network-security-page.md
198+
:::
199+
4. Find the rule set you want to edit, then select the **Delete** {icon}`trash` button. The icon is inactive if there are deployments associated with the filter.
200+
::::::
201+
202+
::::::{tab-item} {{ece}}
203+
1. [Log into the Cloud UI](/deploy-manage/deploy/cloud-enterprise/log-into-cloud-ui.md).
204+
2. From the **Platform** menu, select **Security**.
205+
3. Find the rule set you want to edit.
206+
4. Click the **Delete** {icon}`trash` button. The button is inactive if there are deployments assigned to the rule set.
207+
::::::
208+
209+
:::::::
210+
211+

0 commit comments

Comments
 (0)