Using Network Protect

In the Fastly control panel, use the Network Protect menu to access the pages associated with Fastly Network Protect:

1. Log in to the Fastly control panel.

2. Go to Security > Network Protect and then select the link to one of the following pages:

   • Overview, where you can monitor inbound, delivered, and dropped traffic across all of your protected networks.
   • Networks, where you can add and manage the networks you're protecting.
   • Tunnels, where you can manage the tunnel endpoints that deliver traffic to your infrastructure.
   • IP Lists, where you can manage the prefix lists you reference in firewall rules.

Monitoring your traffic

The Overview page displays aggregate traffic metrics for all of your protected networks, including the total inbound traffic arriving at Fastly's network and the total traffic dropped before delivery to your network. The traffic graph breaks these metrics down over time as inbound, delivered, and dropped traffic. You can view the same metrics for a single network by selecting that network on the Networks page and reviewing its Overview tab, where you can also change the date range for the displayed data.

Working with networks

The Networks page displays the networks associated with your account, including each network's routing policy, the number of tunnels and firewall rules associated with it, and its status. A network's status indicates whether it's operating normally or waiting on an authorization step (e.g., a pending Letter of Authorization or a missing Route Origin Authorization) before Fastly can advertise its prefix.

Adding a network

To add a network, follow these steps:

1. Go to Security > Network Protect > Networks.
2. Click Add Network.
3. In the Name field, enter a human-readable name for the network.
4. In the Network prefix field, enter the IP address prefix you want Fastly to protect (e.g., 192.0.2.0/24).
5. (Optional) In the Health check IP field, enter an IP address to use as a target for health checks. When a health check fails, Network Protect will fail over to the next specified route.
6. Click Submit. The network is created and appears on the Networks page.

Fastly can't advertise the prefix until your Letter of Authorization has been processed. Until then, the network's status indicates that the LOA is pending.

Viewing network details

Selecting a network on the Networks page takes you to the details page for that network, which displays the network's prefix and status along with the following tabs:

• the Overview tab displays the network's inbound, delivered, and dropped traffic over a selectable date range, along with a summary of the tunnels currently carrying the network's traffic and their health.
• the Routing tab displays the network's routing policy.
• the Firewall rules tab displays the network's firewall rules.

Working with tunnels

The Tunnels page displays the tunnel endpoints associated with your account. Fastly uses Generic Routing Encapsulation (GRE) tunnels to deliver traffic from Fastly's network to your infrastructure. Each tunnel has a name and an endpoint IP address on your network. Your router must decapsulate the GRE traffic that arrives on a tunnel and forward it to your applications.

To add a tunnel, follow these steps:

1. Go to Security > Network Protect > Tunnels.
2. Click Add tunnel.
3. In the Name field, enter a human-readable name for the tunnel (e.g., us-tunnel-01).
4. In the IP Address field, enter the IP address on your network that the tunnel delivers traffic to.
5. Click Continue. The tunnel is created and appears on the Tunnels page.

Managing routing

Each network has a routing policy that controls which tunnel Fastly uses to deliver the network's traffic. Each route in the policy associates a tunnel with a preference value and a region:

• Region controls which region of Fastly's network the route applies to. Routes can apply to a specific region (e.g., EU, NA, or APAC) or to the default region.
• Preference sets the priority of the route relative to the other routes in its region. Traffic is delivered through the healthy tunnel with the lowest preference value. If that tunnel becomes unhealthy, traffic automatically fails over to the healthy tunnel with the next lowest preference value. If no tunnels are healthy, traffic is delivered through the tunnel with the lowest preference value rather than being dropped.

To add a route to a network's routing policy, follow these steps:

1. Go to Security > Network Protect > Networks and then select the network you want to modify.
2. Click the Routing tab.
3. Click Add route.
4. From the Tunnel menu, select the tunnel the route delivers traffic to.
5. From the Region menu, select the region the route applies to.
6. In the Preference field, enter a preference value for the route.
7. Click Add route. The route appears in the network's routing policy.

Managing firewall rules

Each network has a set of up to 64 firewall rules that filter traffic before it gets delivered to your infrastructure. Rules are evaluated in order from top to bottom, and the first rule that matches a packet determines how that packet is handled. Traffic that doesn't match any rule is handled by the network's default action. When the default action is set to block, only the traffic your rules explicitly allow gets delivered to your network.

Each rule matches traffic using the following attributes:

• IP Protocol. The protocol the rule applies to (e.g., TCP or UDP).
• Source IP list. The source IP address or prefix the rule applies to. You can specify a single address or prefix, select an IP list, or apply the rule to any source.
• Destination address. The destination IP address the rule applies to, or any destination.
• Source ports. The source port or port range the rule applies to, or any port.
• Destination ports. The destination port or port range the rule applies to, or any port.
• Action. What happens to traffic that matches the rule.

To add a firewall rule to a network, follow these steps:

1. Go to Security > Network Protect > Networks and then select the network you want to modify.
2. Click the Firewall rules tab.
3. Click Add rule.
4. From the IP protocol menu, select the protocol the rule applies to.
5. From the Source IP list menu, select an IP list.
6. In the Destination address field, enter a destination address or leave the field set to any destination.
7. In the Source ports and Destination Ports fields, enter the ports or port ranges the rule applies to.
8. From the Action menu, select the action to apply to matching traffic.
9. Click Add. The rule appears in the list of firewall rules.

To change the order in which rules are evaluated, drag a rule to a new position in the list.

Working with IP lists

The IP Lists page displays the prefix lists associated with your account. A prefix list is a named list of IP address prefixes that you can reference as the source address in your firewall rules, allowing you to manage groups of addresses in one place instead of duplicating them across rules.

To add a prefix list, follow these steps:

1. Go to Security > Network Protect > IP Lists.
2. Click Add prefix list.
3. In the Name field, enter a human-readable name for the list.
4. In the Addresses field, enter the IP address prefixes you want to include in the list.
5. Click Add. The prefix list appears on the IP Lists page and can be referenced in your firewall rules.

Security products note

No security product, such as a WAF or DDoS mitigation product, including those security services offered by Fastly, will detect or prevent all possible attacks or threats. As a subscriber, you should maintain appropriate security controls on all web applications and origins. The use of Fastly's security products does not relieve you of this obligation. As a subscriber, you should test and validate the effectiveness of Fastly's security services to the extent possible prior to deploying these services in production, continuously monitor their performance, and adjust these services as appropriate to address changes in your web applications, origin services, and configurations of the other aspects of your Fastly services.

Related content

• About Network Protect