Cloud Firewall:Protect specific traffic between VPCs connected by using a CEN transit router

Application scope

Cloud Firewall can protect the traffic between network instances that are connected by using CEN transit routers. The network instances include VPCs, VBRs, and Cloud Connect Network (CCN) instances.

If you want to protect the traffic between VPCs in the same region by using a VPC firewall, you can follow the procedure in this topic.

Step 1: Connect FW VPC to a transit router

This step establishes a connection between FW VPC and a transit router.

1. Log on to the CEN console.

2. On the Instances page, find the CEN instance whose traffic you want to forward to a VPC firewall and click the ID of the instance.

3. On the Basic Settings tab, find your CEN transit router and click Create Connection in the Actions column. Alternatively, click the icon to the right of VPC in the upper part of the tab.

4. On the Connection with Peer Network Instance page, configure the parameters to connect FW VPC to your CEN transit router.

   The following table describes the important parameters.

   Parameter	Description
   Network Type	The type of the network instance that you want to connect to the CEN instance. In this example, select VPC.
   Region	The region in which the network instance resides. In this example, select the region that you specify when you create FW VPC.
   Network Instance	The network instance that you want to connect to the CEN instance. In this example, select the ID of FW VPC.
   VSwitch	The vSwitches that you can bind to the network instance. In this example, select TR-Vswitch-01 as the primary vSwitch and TR-VSwitch-02 as the secondary vSwitch.

   For more information about other parameters, see Use an Enterprise Edition transit router to connect VPCs.

Step 2: Connect the VPCs and VBRs to the transit router

This step separately establishes a connection between the transit router and each of the following network instances: VPC1, VPC2, DMZ VPC, IDC-1, and IDC-2. This way, the VPCs and VBRs are connected to the CEN instance.

For more information, see Use an Enterprise Edition transit router to connect VPCs.

Step 3: Create a VPC firewall

This step creates a VPC firewall for FW VPC.

To create a VPC firewall, log on to the Cloud Firewall console, go to the Firewall Settings page, and then click the VPC Firewall tab. On the VPC Firewall tab, click the CEN tab, find FW VPC, and then click Create in the Actions column. In the Create VPC Firewall panel, select Manual for Traffic Redirection Mode, FW VPC for VPC, and Cfw-Vswitch for vSwitch.

For more information, see Configure a VPC firewall for an Enterprise Edition transit router.

Step 4: Create routes for VPC1, VPC2, and DMZ VPC

This step creates routes between the CEN instance and FW VPC.

1. Log on to the CEN console.

2. On the Instances page, find the CEN instance whose traffic you want to forward to a VPC firewall and click the ID of the instance.

3. On the Transit Router tab, find your transit router and click the number in the Route Table column.

   

4. Create route tables named Cfw-Untrust-RouteTable and Cfw-Trust-RouteTable.

   1. On the Route Table tab, click Create Route Table.

   2. In the Create Route Table dialog box, configure the parameters for the Cfw-Untrust-RouteTable and Cfw-Trust-RouteTable route tables.

      Transit Router: Retain the default value.

      Note

      • The Cfw-Untrust-RouteTable route table is used to forward traffic from VPC1, IDC-1, and IDC-2 to FW VPC.

      • The Cfw-Trust-RouteTable route table is used to forward traffic from FW VPC to VPC1, VPC2, DMZ VPC, IDC-1, and IDC-2.

5. Configure the Cfw-Trust-RouteTable route table.

   After this operation is complete, the Cfw-Trust-RouteTable route table automatically learns routes from VPC1, VPC2, DMZ VPC, IDC-1, and IDC-2, and the traffic from FW VPC is forwarded based on the Cfw-Trust-RouteTable route table.

   1. Click the Cfw-Trust-RouteTable route table that you created. In the right-side section, click the Route Propagation tab.

   2. On the Route Propagation tab, click Enable Route Propagation.

   3. In the Enable Route Propagation dialog box, select VPC1, VPC2, DMZ VPC, IDC-1, and IDC-2 for Attachment. Then, click OK.

      After route learning is enabled, you can view the information about the routes that the system learns on the Route Entry tab.

   4. On the Route Table tab, click the system route table in the left-side route table list. In the Route Table Details section, click the Route Table Association tab.

   5. On the Route Table Association tab, click the Cfw-Trust-RouteTable route table that you created. On the Route Table Association tab, click Create Association.

   6. In the Add Association dialog box, select FW VPC for Association. Then, click OK.

6. Configure the Cfw-Untrust-RouteTable route table.

   After this operation is complete, traffic is forwarded to FW VPC based on the Cfw-Untrust-RouteTable route table.

   1. Click the Cfw-Untrust-RouteTable route table that you created. In the right-side section, click the Route Entry tab.

   2. On the Route Entry tab, click Add Route Entry.

   3. In the Add Route Entry dialog box, configure the parameters.

      Parameter description:

      • Destination CIDR: Retain the default value 10.0.0.0/8.

      • Blackhole Route: Retain the default value No.

      • Next Hop: Select FW VPC.

   4. Repeat the preceding steps to add the following routes:

      • The route whose Destination CIDR is 172.16.0.0/12 and Next Hop is FW VPC.

      • The route whose Destination CIDR is 192.168.0.0/16 and Next Hop is FW VPC.

      • The route whose Destination CIDR is 61.20.0.0/16 and Next Hop is FW VPC.

      • The route whose Destination CIDR is 0.0.0.0/0 and Next Hop is DMZ VPC.

7. Configure the system route table.

   1. On the Route Table tab, click the system route table in the left-side route table list. In the right-side section, click the Route Propagation tab.

   2. On the Route Propagation tab, delete the route learning correlations that are created for VPC1, IDC-1, FW VPC, and IDC-2.

      After this operation is complete, the system route table retains only the route learning correlations that are created for VPC2 and DMZ VPC. You can view the information about the routes that the system automatically learns on the Route Entry tab.

   3. On the Route Entry tab, click Add Route Entry.

   4. In the Add Route Entry dialog box, add the following routes:

      • The route whose Destination CIDR is 10.0.0.0/24 (VPC1) and Next Hop is FW VPC.

      • The route whose destination CIDR is 172.16.0.0/12 (IDC-1) and Next Hop is FW VPC.

      • The route whose Destination CIDR is 61.20.0.0/16 (IDC-2) and Next Hop is FW VPC.

   5. On the Route Table Association tab, delete the associated forwarding correlations that are created for VPC1, IDC-1, and IDC-2.

8. Configure the Cfw-Untrust-RouteTable route table.

   After this operation is complete, the traffic from VPC1, IDC-1, and IDC-2 is forwarded based on the Cfw-Untrust-RouteTable route table.

   1. Click the Cfw-Untrust-RouteTable route table that you created. In the right-side section, click the Route Table Association tab.

   2. On the Route Table Association tab, click Create Association.

   3. In the Add Association dialog box, select VPC1, IDC-1, and IDC-2 for Association. Then, click OK.

After this step is complete, the routes between the CEN instance and FW VPC are created, and traffic can be forwarded to FW VPC.

Step 5: Configure route tables for the VPC firewall

This step forwards the traffic from FW VPC to the VPC firewall.

1. Log on to the VPC console. In the left-side navigation pane, click Route Tables.

2. On the Route Tables page, click the VPC-CFW-RouteTable route table. On the Associated vSwitch tab of the page that appears, click Associate vSwitch. Select Cfw-Vswitch for vSwitch. Then, click OK.

3. Click the Route Entry List tab. Then, click the Custom Route tab and click Add Route Entry. In the dialog box that appears, configure the parameters.

   Parameter description:

   • Destination CIDR Block: Specify 0.0.0.0/0.

   • Next Hop Type: Select Transit Router.

   • Transit Router: Retain the default value, which specifies the network instance connection of FW VPC.

   After this operation is complete, the outbound traffic of the VPC firewall is forwarded to the transit router.

4. On the Route Tables page, click the system route table that is created for FW VPC.

5. On the page that appears, click the Route Entry List tab and click the Custom Route tab.

6. Click Add Route Entry. In the Add Route Entry panel, configure the parameters.

   Parameter description:

   • Destination CIDR Block: Specify 0.0.0.0/0.

   • Next Hop Type: Select Secondary ENI.

   • Secondary ENI: Select Cfw-bonding-eni.

7. On the Custom Route tab, delete other custom routes. To delete a route, click Delete in the Actions column.

   After this step is complete, the traffic from FW VPC is forwarded to the VPC firewall.

Step 6: Check whether the forwarding configuration is successful

For more information, see Traffic logs.