設定資料中心防火牆存取控制清單 (Acl)Configure Datacenter Firewall Access Control Lists (ACLs)

適用於:Windows Server(以每年次管道)、Windows Server 2016Applies To: Windows Server (Semi-Annual Channel), Windows Server 2016

您可以將特定 Acl 套用到網路介面。You can apply specific ACLs to network interfaces. Acl 也會在連接的網路介面 virtual 子網路設定,如果同時套用 Acl,但網路介面 Acl 的上述 Acl virtual 子網路的優先順序。If ACLs are also set on the virtual subnet to which the network interface is connected, both ACLs are applied, but the network interface ACLs are prioritized above the virtual subnet ACLs.

本主題包含下列各節。This topic contains the following sections.

範例︰ 將 ACL 新增到網路介面Example: Add an ACL to a network interface

主題中的使用存取控制清單 (Acl) 來管理 Datacenter 網路流量 Flow您如何建立 ACL 並指派給 virtual 子網路。In the topic Use Access Control Lists (ACLs) to Manage Datacenter Network Traffic Flow you learned how to create an ACL and assign it to a virtual subnet. 有時候,但是,您可能想要覆寫特定 ACL 個人網路介面 virtaul 子網路上的預設 ACL。In some cases, however, you might want to override that default ACL on the virtaul subnet with a specific ACL for an individual network interface. 您必須將 Acl 直接套用至已連接到 Vlan 而不是 virtual 網路的網路介面。You will also need to apply ACLs directly to network interfaces that are attached to VLANs instead of virtual networks.

此範例中示範如何將 ACL virtual 網路。This example demonstrates how to add an ACL to a virtual network.

注意

它也可在此同時,您建立網路介面新增 ACL。It is also possible to add an ACL at the same time that you create the network interface.

步驟 1: 取得或建立,您將會新增 ACL 網路介面Step 1: Get or create the network interface to which you will add the ACL

$nic = get-networkcontrollernetworkinterface -ConnectionUri $uri -ResourceId "MyVM_Ethernet1"

步驟 2: 取得或建立的 ACL 您將會新增到網路介面Step 2: Get or create the ACL you will add to the network interface

您可以使用下列命令的範例,以取得或建立 ACL。You can use the following example command to get or create the ACL.

$acl = get-networkcontrolleraccesscontrollist -ConnectionUri $uri -resourceid "AllowAllACL"

步驟 3: 指定 ACL 的 AccessControlList 屬性的網路介面Step 3: Assign the ACL to the AccessControlList property of the network interface

您可以使用下列命令範例 ACL 指派給 AccessControlList 屬性。You can use the following example command to assign the ACL to the AccessControlList property.

$nic.properties.ipconfigurations[0].properties.AccessControlList = $acl

步驟 4: Network Controller 中新增的網路介面Step 4: Add the network interface in Network Controller

您可以使用下列命令範例 Network Controller 中新增的網路介面。You can use the following example command to add the network interface in Network Controller.

new-networkcontrollernetworkinterface -ConnectionUri $uri -Properties $nic.properties -ResourceId $nic.resourceid

範例: 移除 ACL 網路介面使用 Windows Powershell 與網路控制器 REST APIExample: Remove an ACL from a network interface by using Windows Powershell and the Network Controller REST API

您可以使用此範例中,如果您想要移除 ACL。You can use this example if you want to remove an ACL. 當您移除 ACL 時,預設一組規則適用於的網路介面。When you remove an ACL, the default set of rules are applied to the network interface.

預設一組規則允許傳出所有的資料,但封鎖所有輸入的流量。The default set of rules allows all outbound traffic, but blocks all inbound traffic.

注意

如果您想要讓所有輸入的流量,您必須遵循加入 [允許所有輸入 / 輸出所有流量 ACL 前一個範例。If you want to allow all inbound traffic, you must follow the previous example to add an ACL that allows all inbound and all outbound traffic.

步驟 1: 取得,您將會移除 ACL 網路介面Step 1: Get the network interface from which you will remove the ACL

您可以使用下列命令範例擷取的網路介面。You can use the following example command to retrieve the network interface.

$nic = get-networkcontrollernetworkinterface -ConnectionUri $uri -ResourceId "MyVM_Ethernet1"

步驟 2: $NULL 指定 ipConfiguration AccessControlList 屬性Step 2: Assign $NULL to the AccessControlList property of the ipConfiguration

您可以使用下列命令範例 $NULL 指派給 AccessControlList 屬性。You can use the following example command to assign $NULL to the AccessControlList property.

$nic.properties.ipconfigurations[0].properties.AccessControlList = $null

步驟 3: Network Controller 中新增的網路介面物件Step 3: Add the network interface object in Network Controller

您可以使用下列命令範例新增網路介面物件網路控制器,請在You can use the following example command to add the network interface object in Network Controller,

new-networkcontrollernetworkinterface -ConnectionUri $uri -Properties $nic.properties -ResourceId $nic.resourceid