Cloud Firewall:FAQ about the Cloud Firewall settings

• Why can't I enable Cloud Firewall with my current account?

• How do I disable Cloud Firewall?

• What do I do if my service traffic exceeds the bandwidth supported by Cloud Firewall?

• Internet firewall

  • What is the impact of enabling the firewall on my services?

  • What does the Internet firewall do?

  • Does the Internet firewall protect IPv6 assets?

  • Does the Internet firewall affect network traffic?

  • What is the impact of disabling the Internet firewall?

  • Why do I see an SLB network restriction message when I enable the Internet firewall?

  • Why are some of my public IP assets not displayed after I sync assets in the Free Edition?

  • If I enable the Internet, NAT, and DNS firewalls at the same time, how is outbound traffic matched?

  • How can I efficiently enable and configure access control policies for the Internet firewall?

• NAT firewall

  • What is the impact of enabling the firewall on my services?

  • Why does the NAT firewall need to create a route table and add a 0.0.0.0/0 static route?

  • If I enable the Internet, NAT, and DNS firewalls at the same time, how is outbound traffic matched?

  • Why can I still use telnet commands to access resources after I configure an access control policy for the NAT firewall?

  • Why does some traffic from a transit router (TR) bypass the NAT firewall?

• VPC firewall

  • What is the impact of enabling the firewall on my services?

  • Does enabling the VPC firewall affect ECS security group rules?

  • Why do I see a message about an unauthorized network instance when I create a VPC firewall?

  • Why is a deny routing policy added after I enable a VPC firewall for a Basic Edition transit router?

What is the impact of enabling the firewall switch on my services?

How do I disable Cloud Firewall?

If you determine that your services do not require Cloud Firewall protection, you can release the instance to avoid further charges.

Why can't I enable Cloud Firewall with my current account?

What does the Internet firewall do?

The Internet firewall protects various public assets, such as public IP addresses of Elastic Compute Service (ECS) instances, public IP addresses of SLB instances, and EIPs. After you enable the Internet firewall, traffic to and from your assets at the Internet border is forwarded to Cloud Firewall. Cloud Firewall inspects and filters the traffic, allowing only traffic that meets the specified conditions to pass. For more information, see Internet firewall.

Does the Internet firewall protect IPv6 assets?

Yes. As of January 8, 2025, Cloud Firewall fully supports protection for IPv6 addresses.

• Announcement: [Announcement] Cloud Firewall Subscription and Pay-As-You-Go Editions Commercially Support Public IPv6

• Protection principles and asset types: How the Internet firewall works

For more information about the assets that the Internet firewall can protect, see Protection scope.

Does the Internet firewall affect network traffic?

If you enable the Internet firewall without configuring access control or intrusion prevention policies, Cloud Firewall only inspects traffic and generates alerts. It does not block traffic.

After you purchase Cloud Firewall, the Internet firewall is enabled for all assets by default.

What is the impact of disabling the Internet firewall?

If you disable the Internet firewall, traffic no longer passes through it. This has the following impacts:

• The protection capabilities of the Internet firewall become ineffective. This includes access control policies and intrusion prevention for inbound and outbound traffic at the Internet border.

• Internet border traffic statistics are not updated. This includes network traffic analysis reports and traffic logs.

Why do I see an SLB network restriction message when I enable the Internet firewall?

Why are some of my public IP assets not displayed after I sync assets in the Free Edition?

The Free Edition of Cloud Firewall syncs only EIP assets. New assets are synced to Cloud Firewall on the following day (T+1). It cannot sync public IP addresses of ECS instances or SLB instances.

Does enabling the VPC firewall affect ECS security group rules?

No, it does not.

After you enable the VPC firewall, Cloud Firewall automatically creates a security group named `Cloud_Firewall_Security_Group` and corresponding allow policies to permit traffic to pass through to the VPC firewall. The `Cloud_Firewall_Security_Group` security group controls traffic only within that VPC. The ECS security group rules that you created previously remain effective and are not affected. Therefore, you do not need to migrate or modify your ECS security group rules.

Why do I see a message about an unauthorized network instance when I create a VPC firewall?

Why is a deny routing policy added after I enable a VPC firewall for a Basic Edition transit router?

After you enable a VPC firewall for a VPC (for example, `VPC-test`) connected through a Basic Edition transit router, Cloud Firewall creates a VPC named `Cloud_Firewall_VPC` under that transit router. It also advertises a static route to redirect traffic from other VPCs (without a firewall enabled) under the same transit router to Cloud Firewall.

At the same time, Cloud Firewall adds a static route in `VPC-test` that points to the Cloud Firewall ENI to redirect outbound traffic from `VPC-test` to Cloud Firewall. It also creates a deny routing policy to prevent `VPC-test` from learning routes advertised by the CEN instance.

Why does the NAT firewall need to create a route table and add a 0.0.0.0/0 static route?

After you enable a NAT firewall, Cloud Firewall automatically creates a custom route table named `Cloud_Firewall_ROUTE_TABLE` and adds a `0.0.0.0/0` route that points to the NAT Gateway. It also modifies the `0.0.0.0/0` route entry in the system route table to set its next hop to the Cloud Firewall ENI. This redirects outbound traffic from the NAT Gateway to Cloud Firewall.

If I enable the Internet, NAT, and DNS firewalls at the same time, how is outbound traffic matched?

If you enable the Internet, NAT, and DNS firewalls at the same time, when an ECS instance initiates a domain name access request (outbound traffic), the traffic is matched as follows:

1. The ECS instance initiates a DNS resolution request. The request passes through the DNS firewall and is matched against the access control policies of the DNS firewall.

2. The private network traffic initiated by the ECS instance passes through the NAT firewall and is matched against the access control policies of the NAT firewall.

3. Allowed private network traffic passes through the NAT Gateway, which translates the private source IP address into a public IP address of the NAT Gateway.

4. The NAT Gateway sends the public network traffic to the Internet firewall, where it is matched against the access control policies of the Internet firewall.

5. The traffic is matched against the threat intelligence, basic defense, intelligent defense, and virtual patching rules of Cloud Firewall.

If the traffic does not hit any deny policy during this process, the domain name is successfully accessed. If the traffic hits any deny policy, the traffic is denied, and the domain name cannot be accessed.

Why can I still use telnet commands to access resources after I configure an access control policy for the NAT firewall?

An EIP is bound to an SNAT entry and has a NAT firewall enabled. An access control policy is configured to allow an ECS instance to access a specific domain name only through the TCP protocol using HTTP or HTTPS. However, the ECS instance can still use telnet commands to access other domain names.

• Cause: When you use a telnet command for testing, it lacks application-layer protocol features, such as HTTP or HTTPS. Cloud Firewall cannot identify the specific application type through Deep Packet Inspection (DPI). In this case, the application is displayed as `Unknown` and does not match the HTTP or HTTPS policy. In loose mode, when matching application or domain name policies, Cloud Firewall allows unidentified traffic by default if the domain name or application is not recognized. To match subsequent policies, you must enable strict mode.

  Important

  Strict mode is a global configuration. Enabling it affects the matching logic for all traffic. Proceed with caution based on your service requirements.

• Solution: Do not use telnet for testing. Use the curl command instead.

Why does some traffic from a transit router (TR) bypass the NAT firewall?

This problem usually occurs when you associate the VPC connection of a TR with the dedicated vSwitch automatically created by the NAT firewall.

How it works:

The NAT firewall relies on specific route configurations to control traffic. In a standard configuration, the process is as follows:

1. Service traffic redirection: The route table of the service vSwitch in the VPC sets the next hop for routes to the Internet to the NAT firewall. This ensures that traffic first undergoes security inspection.

2. Firewall traffic forwarding: After the NAT firewall completes the inspection, the route table of the dedicated vSwitch where the firewall resides sets the next hop to the NAT Gateway to access the Internet.

Impact of incorrect configuration
If you attach the TR connection point to the dedicated vSwitch of the NAT firewall, public traffic from the TR directly enters this vSwitch. The traffic then matches the route entry whose next hop is set to the NAT Gateway, bypassing the NAT firewall's security inspection. As a result, some traffic is uncontrolled.

Recommended configuration
To ensure that all public traffic is processed by the NAT firewall, follow these best practices:

• vSwitch isolation: Do not use the dedicated vSwitch of the NAT firewall for other purposes, including as a connection point for a TR.

• Independent planning: Allocate a separate vSwitch for the TR's VPC connection.

• Route verification: Confirm that all relevant route tables, including the one associated with the vSwitch used by the TR connection, are correctly configured. The next hop for the public routes to be controlled must point to the NAT firewall.

How to efficiently enable and configure Cloud Firewall Internet Border access control policies?

What are the differences between the old and new versions of the VPC firewall created with automatic traffic redirection for an Enterprise Edition TR?

Cloud Firewall has adjusted some features of the VPC firewall for Enterprise Edition Cloud Enterprise Network (CEN) transit routers (TRs). For firewalls created with automatic traffic redirection, the ownership of the firewall VPC has been changed from the user's account to a managed cloud service account. The main differences are as follows:

1. Firewall VPC ownership: In the new version, the firewall VPC no longer belongs to your account but to a Cloud Firewall backend account. You cannot view or modify the resources and configurations of the firewall VPC. It also does not occupy your VPC region quota.

2. Billing method: In the old VPC firewall architecture, in addition to the data transfer fee between the transit router and the service VPC, a data transfer fee was also incurred between the transit router and the firewall VPC. This fee was paid by the user. In the new version, the firewall VPC belongs to Cloud Firewall, and the data transfer fee between the transit router and the firewall VPC is paid by Cloud Firewall. You no longer need to pay this fee.

3. Enabling the VPC firewall: When you create a VPC firewall, you no longer need to enter three vSwitch CIDR blocks. You need to enter only one CIDR block of at least /27 that does not conflict with your network planning. This CIDR block is allocated to the vSwitch required during the firewall creation process. For more information about how to configure an Enterprise Edition VPC firewall, see Configure a VPC firewall for an Enterprise Edition transit router.

   

Does using the VPC firewall add latency?

Yes, it does.

Latency increases by 4 ms to 8 ms for traffic between different availability zones (AZs) in the same region. Latency increases by 2 ms to 3 ms for traffic within the same AZ.