nsg
=======

Description
-----------
A *network security group* (NSG) provides virtual firewall rules for a specific set of `VNICs <https://docs.cloud.oracle.com/api/#/en/iaas/latest/Vnic/>`__ in a VCN. Compare NSGs with `SecurityLists <https://docs.cloud.oracle.com/api/#/en/iaas/latest/SecurityList/>`__, which provide virtual firewall rules to all the VNICs in a *subnet*.

A network security group consists of two items:

  * The set of `VNICs <https://docs.cloud.oracle.com/api/#/en/iaas/latest/Vnic/>`__ that all have the same security rule needs (for     example, a group of Compute instances all running the same application)   * A set of NSG `SecurityRules <https://docs.cloud.oracle.com/api/#/en/iaas/latest/SecurityRule/>`__ that apply to the VNICs in the group

After creating an NSG, you can add VNICs and security rules to it. For example, when you create an instance, you can specify one or more NSGs to add the instance to (see `CreateVnicDetails <https://docs.cloud.oracle.com/api/#/en/iaas/latest/CreateVnicDetails/>`__). Or you can add an existing instance to an NSG with `UpdateVnic <https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/network/vnic/update.html>`__.

To add security rules to an NSG, see `AddNetworkSecurityGroupSecurityRules <https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/network/nsg/rules/add.html>`__.

To list the VNICs in an NSG, see `ListNetworkSecurityGroupVnics <https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/network/nsg/vnics/list.html>`__.

To list the security rules in an NSG, see `ListNetworkSecurityGroupSecurityRules <https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/network/nsg/rules/list.html>`__.

For more information about network security groups, see `Network Security Groups <https://docs.cloud.oracle.com/iaas/Content/Network/Concepts/networksecuritygroups.htm>`__.

**Important:** Oracle Cloud Infrastructure Compute service images automatically include firewall rules (for example, Linux iptables, Windows firewall). If there are issues with some type of access to an instance, make sure all of the following are set correctly:

  * Any security rules in any NSGs the instance's VNIC belongs to   * Any `SecurityLists <https://docs.cloud.oracle.com/api/#/en/iaas/latest/SecurityList/>`__ associated with the instance's subnet   * The instance's OS firewall rules

To use any of the API operations, you must be authorized in an IAM policy. If you're not authorized, talk to an administrator. If you're an administrator who needs to write policies to give users access, see `Getting Started with Policies <https://docs.cloud.oracle.com/iaas/Content/Identity/Concepts/policygetstarted.htm>`__.

Available Commands
------------------
* :doc:`change-compartment </cmdref/network/nsg/change-compartment>`
* :doc:`create </cmdref/network/nsg/create>`
* :doc:`delete </cmdref/network/nsg/delete>`
* :doc:`get </cmdref/network/nsg/get>`
* :doc:`list </cmdref/network/nsg/list>`
* :doc:`rules </cmdref/network/nsg/rules>`

  * :doc:`add </cmdref/network/nsg/rules/add>`
  * :doc:`list </cmdref/network/nsg/rules/list>`
  * :doc:`remove </cmdref/network/nsg/rules/remove>`
  * :doc:`update </cmdref/network/nsg/rules/update>`

* :doc:`update </cmdref/network/nsg/update>`
* :doc:`vnics </cmdref/network/nsg/vnics>`

  * :doc:`list </cmdref/network/nsg/vnics/list>`


.. toctree::
    :hidden:

    /cmdref/network/nsg/change-compartment
    /cmdref/network/nsg/create
    /cmdref/network/nsg/delete
    /cmdref/network/nsg/get
    /cmdref/network/nsg/list
    /cmdref/network/nsg/rules
    /cmdref/network/nsg/update
    /cmdref/network/nsg/vnics