--- title: Using Network Protect summary: null url: >- https://www.fastly.com/documentation/guides/security/network-protect/using-network-protect --- In the Fastly control panel, use the Network Protect menu to access the pages associated with [Fastly Network Protect](https://www.fastly.com/documentation/guides/security/network-protect/about-network-protect): 1. Log in to the [Fastly control panel](https://manage.fastly.com). 2. Go to **Security** > **Network Protect** and then select the link to one of the following pages: - **Overview**, where you can monitor inbound, delivered, and dropped traffic across all of your protected networks. - **Networks**, where you can add and manage the networks you're protecting. - **Tunnels**, where you can manage the tunnel endpoints that deliver traffic to your infrastructure. - **IP Lists**, where you can manage the prefix lists you reference in firewall rules. ## Monitoring your traffic The Overview page displays aggregate traffic metrics for all of your protected networks, including the total inbound traffic arriving at Fastly's network and the total traffic dropped before delivery to your network. The traffic graph breaks these metrics down over time as inbound, delivered, and dropped traffic. You can view the same metrics for a single network by selecting that network on the Networks page and reviewing its Overview tab, where you can also change the date range for the displayed data. ## Working with networks The Networks page displays the networks associated with your account, including each network's routing policy, the number of tunnels and firewall rules associated with it, and its status. A network's status indicates whether it's operating normally or waiting on an authorization step (e.g., a pending Letter of Authorization or a missing Route Origin Authorization) before Fastly can advertise its prefix. ### Adding a network To add a network, follow these steps: 1. Go to **Security** > **Network Protect** > **Networks**. 2. Click **Add Network**. 3. In the **Name** field, enter a human-readable name for the network. 4. In the **Network prefix** field, enter the IP address prefix you want Fastly to protect (e.g., `192.0.2.0/24`). 5. _(Optional)_ In the **Health check IP** field, enter an IP address to use as a target for health checks. When a health check fails, Network Protect will fail over to the next specified route. 6. Click **Submit**. The network is created and appears on the Networks page. Fastly can't advertise the prefix until your Letter of Authorization has been processed. Until then, the network's status indicates that the LOA is pending. ### Viewing network details Selecting a network on the Networks page takes you to the details page for that network, which displays the network's prefix and status along with the following tabs: - the **Overview** tab displays the network's inbound, delivered, and dropped traffic over a selectable date range, along with a summary of the tunnels currently carrying the network's traffic and their health. - the **Routing** tab displays the network's [routing policy](https://www.fastly.com/documentation/guides/security/network-protect/using-network-protect#managing-routing). - the **Firewall rules** tab displays the network's [firewall rules](https://www.fastly.com/documentation/guides/security/network-protect/using-network-protect#managing-firewall-rules). ## Working with tunnels The Tunnels page displays the tunnel endpoints associated with your account. Fastly uses Generic Routing Encapsulation (GRE) tunnels to deliver traffic from Fastly's network to your infrastructure. Each tunnel has a name and an endpoint IP address on your network. Your router must decapsulate the GRE traffic that arrives on a tunnel and forward it to your applications. To add a tunnel, follow these steps: 1. Go to **Security** > **Network Protect** > **Tunnels**. 2. Click **Add tunnel**. 3. In the **Name** field, enter a human-readable name for the tunnel (e.g., `us-tunnel-01`). 4. In the **IP Address** field, enter the IP address on your network that the tunnel delivers traffic to. 5. Click **Continue**. The tunnel is created and appears on the Tunnels page. ## Managing routing Each network has a routing policy that controls which tunnel Fastly uses to deliver the network's traffic. Each route in the policy associates a tunnel with a preference value and a region: - **Region** controls which region of Fastly's network the route applies to. Routes can apply to a specific region (e.g., EU, NA, or APAC) or to the default region. - **Preference** sets the priority of the route relative to the other routes in its region. Traffic is delivered through the healthy tunnel with the lowest preference value. If that tunnel becomes unhealthy, traffic automatically fails over to the healthy tunnel with the next lowest preference value. If no tunnels are healthy, traffic is delivered through the tunnel with the lowest preference value rather than being dropped. > **HINT:** Fastly determines the health of each tunnel by sending Internet Control Message Protocol (ICMP) health checks through it, so your network must respond to these health checks for a tunnel to be considered healthy. The Routing tab displays the health of each tunnel. To add a route to a network's routing policy, follow these steps: 1. Go to **Security** > **Network Protect** > **Networks** and then select the network you want to modify. 2. Click the **Routing** tab. 3. Click **Add route**. 4. From the **Tunnel** menu, select the tunnel the route delivers traffic to. 5. From the **Region** menu, select the region the route applies to. 6. In the **Preference** field, enter a preference value for the route. 7. Click **Add route**. The route appears in the network's routing policy. ## Managing firewall rules Each network has a set of up to 64 firewall rules that filter traffic before it gets delivered to your infrastructure. Rules are evaluated in order from top to bottom, and the first rule that matches a packet determines how that packet is handled. Traffic that doesn't match any rule is handled by the network's default action. When the default action is set to block, only the traffic your rules explicitly allow gets delivered to your network. Each rule matches traffic using the following attributes: - **IP Protocol.** The protocol the rule applies to (e.g., TCP or UDP). - **Source IP list.** The source IP address or prefix the rule applies to. You can specify a single address or prefix, select an [IP list](https://www.fastly.com/documentation/guides/security/network-protect/using-network-protect#working-with-ip-lists), or apply the rule to any source. - **Destination address.** The destination IP address the rule applies to, or any destination. - **Source ports.** The source port or port range the rule applies to, or any port. - **Destination ports.** The destination port or port range the rule applies to, or any port. - **Action.** What happens to traffic that matches the rule. To add a firewall rule to a network, follow these steps: 1. Go to **Security** > **Network Protect** > **Networks** and then select the network you want to modify. 2. Click the **Firewall rules** tab. 3. Click **Add rule**. 4. From the **IP protocol** menu, select the protocol the rule applies to. 5. From the **Source IP list** menu, select an IP list. 6. In the **Destination address** field, enter a destination address or leave the field set to any destination. 7. In the **Source ports** and **Destination Ports** fields, enter the ports or port ranges the rule applies to. 8. From the **Action** menu, select the action to apply to matching traffic. 9. Click **Add**. The rule appears in the list of firewall rules. To change the order in which rules are evaluated, drag a rule to a new position in the list. ## Working with IP lists The IP Lists page displays the prefix lists associated with your account. A prefix list is a named list of IP address prefixes that you can reference as the source address in your [firewall rules](https://www.fastly.com/documentation/guides/security/network-protect/using-network-protect#managing-firewall-rules), allowing you to manage groups of addresses in one place instead of duplicating them across rules. To add a prefix list, follow these steps: 1. Go to **Security** > **Network Protect** > **IP Lists**. 2. Click **Add prefix list**. 3. In the **Name** field, enter a human-readable name for the list. 4. In the **Addresses** field, enter the IP address prefixes you want to include in the list. 5. Click **Add**. The prefix list appears on the IP Lists page and can be referenced in your firewall rules. ## Security products note No security product, such as a WAF or DDoS mitigation product, including those security services offered by Fastly, will detect or prevent all possible attacks or threats. As a subscriber, you should maintain appropriate security controls on all web applications and origins. The use of Fastly's security products does not relieve you of this obligation. As a subscriber, you should test and validate the effectiveness of Fastly's security services to the extent possible prior to deploying these services in production, continuously monitor their performance, and adjust these services as appropriate to address changes in your web applications, origin services, and configurations of the other aspects of your Fastly services. ## Related content - [About Network Protect](https://www.fastly.com/documentation/guides/security/network-protect/about-network-protect)