Skip to main content

Network tags

A network tag is a label you apply to a VM's network adapter (NIC). Tags let you group adapters by role, such as web, database, or prod, and then write firewall rules that target the group instead of individual IPs.

How they work​

  • A tag is a simple text label, scoped to the VDC.
  • One adapter can carry several tags, and one tag can be used by many adapters.
  • You add and remove tags on a VM's network adapter at any time.

Why they are useful​

Network tags make firewall rules readable and stable:

  • Instead of "allow 10.0.1.5, 10.0.1.6, 10.0.1.7", you write "allow the web tag".
  • When you add a new web server and give it the web tag, existing rules cover it automatically. There is no IP list to update.

In a firewall rule, a network tag can be used as the source or the destination.