Orka 3.2 Required URL Rules for Filtering

About

Orka Cluster was designed with minimal internet access to increase security, however, users must set up some restricted internet access. This document lists the required URLs that must be enabled to use Orka Cluster. These are rulesets tested on a Cisco virtual Firepower appliance, running the Firepower Threat Defense operating system.

These rulesets permit the minimum amount of traffic required for Orka Cluster functionality.

🗒️

NOTE

• Orka Cluster customers must manage these URLs to support Orka Cluster functionality.
• This only applies to customers who have security requirements that filter URLs - either from the MacStadium side or through tunneling traffic to another firewall.
• Traffic: Client-Side vs LAN-Side Rulesets.

Overview

The ruleset are divided into two sections:

• Client-Side Traffic

The client-side traffic is any traffic whose destination is the ORKA API controller, the ORKA physical hosts, the ORKA virtual machines, and the single sign-on (SSO).

• URL LAN-Side Traffic

The LAN-side traffic is any traffic originating from the ORKA network that exist behind the firewall.

🚧

CAUTION:

The document assumes that the Orka network is on 10.221.188.x.

License Requirements

• Tier, FTDv10 - 4 vCPU cores and 8 GB of vRAM
• URL (Filtering) License
• RA VPN License (PLUS)
• Base License

Rulesets

# Client-Side Ruleset

# LAN-Side Ruleset