Create a routing policy for a VPC firewall for a transit router with CreateTrFirewallV2RoutePolicy - Cloud Firewall - Alibaba Cloud - Cloud Firewall

Creates a routing rule for a VPC firewall for a transit router. **[Prerequisites]** Activate Cloud Firewall → Create a Cloud Enterprise Network (CEN) instance → Create an Enterprise Edition transit router → Add VPCs to the transit router route table → Call CreateTrFirewallV2 to create a VPC firewall for the transit router.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-cloudfirewall:CreateTrFirewallV2RoutePolicy

create

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language of the content within the response. Valid values: zh (default): Chinese en: English	zh
PolicyType	string	No	The traffic redirection scenario type for the virtual private cloud (VPC) firewall for a CEN Enterprise Edition transit router. Valid values: fullmesh: multi-point interconnection one_to_one: point-to-point end_to_end: point-to-multipoint Note PolicyType is required. If this parameter is not specified, ErrorParameters(400) is returned.	fullmesh
PolicyName	string	No	The name of the traffic redirection scenario.	Singapore Point to Multipoint
PolicyDescription	string	No	The description of the traffic redirection scenario.	Singapore Point to Multipoint
FirewallId	string	No	The instance ID of the virtual private cloud (VPC) firewall. Note FirewallId is required. If this parameter is not specified, ErrorParameters(400) is returned. You can call DescribeTrFirewallsV2List to obtain instance ID.	vfw-tr-f8ce36689b224f77****
SrcCandidateList	array<object>	No	The list of primary traffic redirection instances. Note SrcCandidateList is required. If this parameter is not specified, ErrorParameters(400) is returned.
	object	No	The traffic redirection instance.
CandidateId	string	No	The ID of the traffic redirection instance.	vpc-2ze9epancaw8t4sha****
CandidateType	string	No	The type of the traffic redirection instance. Valid values: VPC, VBR, TR, VPN, and ECR. Valid values: VBR : VBR TR : TR VPN : VPN VPC : VPC	VPC
DestCandidateList	array<object>	No	The list of secondary traffic redirection instances. Note DestCandidateList is required. If this parameter is not specified, ErrorParameters(400) is returned.
	object	No	The secondary traffic redirection instance.
CandidateId	string	No	The ID of the traffic redirection instance.	vpc-2ze9epancaw8t4sha****
CandidateType	string	No	The type of the traffic redirection instance. Valid values: VPC, VBR, TR, ALL, VPN, and ECR.	VPC

Response elements

Element	Type	Description	Example
	object
TrFirewallRoutePolicyId	string	The ID of the firewall routing policy.	policy-8ebed27e13e14ce2****
RequestId	string	The request ID.	C91D68BA-A0BE-51BF-A0F1-1CB5C57FE58D

Examples

Success response

JSON format

{
  "TrFirewallRoutePolicyId": "policy-8ebed27e13e14ce2****",
  "RequestId": "C91D68BA-A0BE-51BF-A0F1-1CB5C57FE58D"
}

Error codes

HTTP status code	Error code	Error message	Description
200	ErrorDBUpdateError	A database update error occurred.	A database update error occurred.
400	ErrorAliUid	Aliuid invalid.	The aliuid is invalid.
400	ErrorParameters	Error Parameters	The parameter is invalid.
400	ErrorAuthentication	authentication error	The authentication failed.
400	ErrorDBNoRow	No rows in database.	No data found.
400	ErrorDBSelectError	A database select error occurred.	The error message returned because an internal error has occurred in querying the database.
400	ErrorPolicySrcAndDestConflict	Policy has same destination candidate as source candidtes.	The main drainage instance conflicts with the sub-drainage instance in the drainage template.
400	ErrorUserCredentials	User credentials failed.	Unauthorized, not accessible, please first authorize firewall permissions.
400	ErrorTrFirewallEndToEndTrToAll	Parameter error, point-to-multipoint scenario, TR instance does not support configuration ALL.	Parameter error. In point-to-multipoint scenarios, the TR instance does not support ALL configuration.
400	ErrorDBInsertError	A database insert error occurred.	An error occurred while performing an insert operation in the database.
400	ErrorCandidateNoRouteTable	Please attach candidate with transit router before create routing template.	Before creating a drainage template, bind the drainage instance to a routing table of a forwarding router.
400	ErrorTrFirewallRouteMapConflict	Cen TR firewall route table has route map conflict.	The CEN routing table and the cloud firewall have routing policy conflicts.
400	ErrorTrFirewallCenManegedRouteMapConflict	Cen TR firewall route table has cen managed route map conflict.	if a routing policy of the old version of cen enterprise edition with a priority of 5000 exists, contact after-sales service to update the routing policy.
400	ErrorCandidateHasStaticRoute	Tr firewall don't support candidate which associated with transit router route table contains custom route. Please retry after deleted the route.	There are custom routes in the routing table of the forwarding router bound to the drainage instance. Cloud Firewall does not support this type of drainage instance. Delete the corresponding route and try again.
400	ErrorFirewallUpdating	Can not modify firewall, firewall is updating. Please check if there is a routing policy updating.	The firewall cannot be operated. The firewall is in an updated state. Please check whether any drainage templates are being created, deleted, updated, opened or closed.
400	ErrorDuplicateTrFwPolicyName	Duplicate firewall policy Name.	Duplicate drainage scene name.
400	ErrorCandidateAlreadyInToALlPolicy	Candidate already in to aLl policy.	a drainage instance already exists in a drainage template with type all.
400	ErrorFirewallCandidateReference	Firewall Candidate referrence count greater than one.	Drainage instances exist in multiple drainage scenarios.
400	ErrorDBTxError	A database transaction error occurred.	The error message returned because an internal error has occurred in the database transaction.
400	ErrorRecordLog	record operation log error.	Update operation log error.
400	ErrorTrFirewallOnlyContainsEcrAndTrCandidate	TR firewall cannot only contain both ECR and TR.	TR firewall cannot only contain both ECR and TR.
400	ErrorTrFirewallDoNotSupportPrefixList	Cen TR firewall do not support prefix list.	Cloud Firewall of CEN Enterprise Edition does not support prefix lists.
400	ErrorTrFirewallNotExist	Cen TR firewall not exist
400	ErrorCrossRegionCloudServiceStaticRoute	The CEN-TR routing table contains cross-region cloud service static routes. Please delete them and try again.	The CEN-TR routing table contains cross-region cloud service static routes. Please delete them and try again.
400	ErrorTrRouteTableContainsRejectRoutes	There are routes conflict in transit router route table. Please resolve route conflict before create route policy.	There is a routing conflict in the routing table of the forwarding router. Resolve the routing conflict before creating a firewall drainage scenario.
400	ErrorCandidateHasIPv6Route	Cloud Enterprise Network TR enterprise firewall don't support ipv6 route.	Cloud Enterprise Network TR Enterprise Firewall does not support Ipv6 routing
400	ErrorTrFirewallEcmpRouteMiss	The next hop of the equivalent route must also be added to the cloud firewall traffic redirection scenario. The missing traffic redirection instance is %s.	The next hop of the equivalent route must be added to the cloud firewall drainage scenario at the same time, and the drainage object% s is missing.
400	ErrorTrFirewallRouteMapMiss	Route table %s contains a route map with priority %s, while route table %s does not contain a route map with priority %s.	Route table %s contains a route map with priority %s, while route table %s does not contain a route map with priority %s.
400	ErrorTrFirewallRouteMapDifferent	The RouteMap with priority %s has inconsistent configurations between the route table %s and the route table %s.	The RouteMap with priority %s has inconsistent configurations between the route table %s and the route table %s.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.