Network ServicesSecurity Group

AddSecurityGroupRule

POST/zstack/v1/security-groups/{securityGroupUuid}/rules

Headers

Authorization: OAuth the-session-uuid

Body

{
  "params": {
    "rules": [
      {
        "type": "Ingress",
        "state": "Enabled",
        "description": "test",
        "remoteSecurityGroupUuid": "7d4337c2b18339ffb6f5d1023fc2ea42",
        "ipVersion": 4,
        "protocol": "TCP",
        "srcIpRange": "10.0.0.1,10.0.0.2-10.0.0.200,10.1.1.0/24",
        "dstIpRange": "10.0.0.1,10.0.0.2-10.0.0.200,10.1.1.0/24",
        "dstPortRange": "1000,1001,1002-1005,1008",
        "action": "ACCEPT"
      }
    ],
    "priority": -1
  },
  "systemTags": [],
  "userTags": []
}

In the preceding sample, both systemTags and userTags are optional. They are listed here to indicate that these two fields can be included in the body.

Curl Example

curl -H "Content-Type: application/json;charset=UTF-8"
-H "Authorization: OAuth b86c9016b4f24953a9edefb53ca0678c"
-X POST -d '{"params":{"rules":[{"type":"Ingress","state":"Enabled","description":"test","remoteSecurityGroupUuid":"7d4337c2b18339ffb6f5d1023fc2ea42","ipVersion":4,"protocol":"TCP","srcIpRange":"10.0.0.1,10.0.0.2-10.0.0.200,10.1.1.0/24","dstIpRange":"10.0.0.1,10.0.0.2-10.0.0.200,10.1.1.0/24","dstPortRange":"1000,1001,1002-1005,1008","action":"ACCEPT"}],"priority":-1}}'
http://localhost:8080/zstack/v1/security-groups/00fdf47ec62b316a8f17c80d0ee59a01/rules

Parameter List

NameTypeLocationDescriptionAllowed ValuesStarting Version
securityGroupUuidStringurlThe security group UUID 0.6
rulesListbody (included in the params structure)The rules in the security group 0.6
remoteSecurityGroupUuids (Optional)Listbody (included in the params structure)The remote security group UUIDs for inter-group policies 2.1
priority (Optional)Integerbody (included in the params structure)The rule priority 4.7.21
systemTags (Optional)ListbodySystem tags 0.6
userTags (Optional)ListbodyUser tags 0.6

API Response

Response Example

{
  "inventory": {
    "uuid": "5949aece9cd64d5a939d6dc5e2c1f327",
    "name": "web",
    "description": "for test",
    "state": "Enabled",
    "createDate": "Sep 22, 2017 12:24:11 PM",
    "lastOpDate": "Sep 22, 2017 12:24:11 PM",
    "internalId": 0
  }
}
NameTypeDescriptionStarting Version
successboolean 0.6
errorErrorCodeError code. If not null, the operation failed. If null, the operation succeeded. See error0.6
inventorySecurityGroupInventorySee inventory0.6

error

NameTypeDescriptionStarting Version
codeStringError code number, a globally unique identifier for the error, for example SYS.1000, HOST.10010.6
descriptionStringBrief description of the error0.6
detailsStringDetailed error information0.6
elaborationStringReserved field, defaults to null0.6
opaqueLinkedHashMapReserved field, defaults to null0.6
causeErrorCodeRoot error: the source error that caused the current error. If there is no original error, this field is null0.6

inventory

NameTypeDescriptionStarting Version
uuidStringThe UUID of the resource, uniquely identifying the resource0.6
nameStringThe resource name0.6
descriptionStringThe detailed description of the resource0.6
stateString 0.6
ipVersionIntegerThe IP version number3.1.0
createDateTimestampThe creation time0.6
lastOpDateTimestampThe last modification time0.6
attachedL3NetworkUuidsSet 0.6
rulesListSee rules0.6

rules

Name

Type

Description

Starting Version

uuid

String

The UUID of the resource, uniquely identifying the resource

0.6

securityGroupUuid

String

The security group UUID

0.6

type

String

The traffic type

0.6

ipVersion

Integer

The IP version number

3.1.0

protocol

String

The traffic protocol type

0.6

state

String

The availability state of the rule

0.6

priority

Integer

The rule priority

4.7.21

description

String

The rule description

4.7.21

srcIpRange

String

The source IP range

4.7.21

dstIpRange

String

The destination IP range

4.7.21

srcPortRange

String

The source port range, not implemented in the current version

4.7.21

dstPortRange

String

The destination port range

4.7.21

action

String

The default action of the rule

4.7.21

remoteSecurityGroupUuid

String

 

0.6

allowedCidr

String

The allowed CIDR. The meaning of the allowed CIDR varies depending on the traffic type- For Ingress traffic, the allowed CIDR is the source CIDR that is permitted to access the VM NIC

  • For Egress traffic, the allowed CIDR is the destination CIDR that traffic from the VM NIC is permitted to reach

0.6

startPort

Integer

  • For TCP/UDP, it is the start port number of the port range
  • For ICMP, it is the ICMP type

0.6

endPort

Integer

  • For TCP/UDP, it is the end port number of the port range
  • For ICMP, it is the ICMP type

0.6

createDate

Timestamp

The creation time

0.6

lastOpDate

Timestamp

The last modification time

0.6

SDK Examples

Java SDK

AddSecurityGroupRuleAction action = new AddSecurityGroupRuleAction();
action.securityGroupUuid = "00fdf47ec62b316a8f17c80d0ee59a01";
action.rules = asList([type:Ingress, state:Enabled, description:test, remoteSecurityGroupUuid:7d4337c2b18339ffb6f5d1023fc2ea42, ipVersion:4, protocol:TCP, srcIpRange:10.0.0.1,10.0.0.2-10.0.0.200,10.1.1.0/24, dstIpRange:10.0.0.1,10.0.0.2-10.0.0.200,10.1.1.0/24, dstPortRange:1000,1001,1002-1005,1008, action:ACCEPT]);
action.priority = -1;
action.sessionId = "b86c9016b4f24953a9edefb53ca0678c";
AddSecurityGroupRuleAction.Result res = action.call();

Python SDK

AddSecurityGroupRuleAction action = AddSecurityGroupRuleAction()
action.securityGroupUuid = "00fdf47ec62b316a8f17c80d0ee59a01"
action.rules = [[type:Ingress, state:Enabled, description:test, remoteSecurityGroupUuid:7d4337c2b18339ffb6f5d1023fc2ea42, ipVersion:4, protocol:TCP, srcIpRange:10.0.0.1,10.0.0.2-10.0.0.200,10.1.1.0/24, dstIpRange:10.0.0.1,10.0.0.2-10.0.0.200,10.1.1.0/24, dstPortRange:1000,1001,1002-1005,1008, action:ACCEPT]]
action.priority = -1
action.sessionId = "b86c9016b4f24953a9edefb53ca0678c"
AddSecurityGroupRuleAction.Result res = action.call()

QueryVmNicInSecurityGroup

Previous Page

DeleteSecurityGroupRule

Next Page