This topic compares the features of Cloud Firewall editions and helps you choose the right one.
Effective October 15, 2025, Cloud Firewall billable items have been upgraded to Billing 2.0. New purchases use Billing 2.0 by default. Existing users can continue with Billing 1.0 and can optionally upgrade to Billing 2.0.
This document describes Billing 2.0. If you are on Billing 1.0, see Billing 1.0 and upgrade instructions for information about Billing 1.0 billable items and how to upgrade to Billing 2.0.
Quick selection
Use cases | Recommended edition |
| pay-as-you-go |
| Premium Edition (subscription) |
| Enterprise Edition or Ultimate Edition (subscription) |
Feature comparison
The following tables list the features supported by each Cloud Firewall edition in Billing 2.0.
Note: These tables compare features only and do not include pricing details. For detailed billing rules, refer to Subscription 2.0 and Pay-as-you-go 2.0.
Core features
Feature | Premium Edition (subscription) | Enterprise Edition (subscription) | Ultimate Edition (subscription) | Pay-as-you-go |
Number of included firewall instances. For calculation details, refer to How to calculate the number of firewall instances. | 1 | 3 | 5 | Available for an additional fee |
Included bandwidth (subscription) or traffic (pay-as-you-go) | 30 Mbps | 200 Mbps | 800 Mbps | Available for an additional fee |
Additional instances | Available for an additional fee | Available for an additional fee | Available for an additional fee | Not applicable (Billed based on the actual number of instances) |
Additional bandwidth | Available for an additional fee | Available for an additional fee | Available for an additional fee | Not applicable |
Temporary bandwidth expansion | Available for an additional fee | Available for an additional fee | Available for an additional fee | Not applicable |
If your actual traffic exceeds the purchased bandwidth, the overage is billed on a pay-as-you-go basis. | Enabled by default and cannot be disabled | Enabled by default and cannot be disabled | Enabled by default and cannot be disabled | Not applicable (Billed based on actual traffic) |
Access control policy quota | 10,000 | 50,000 | 100,000 (Contact your account manager for a custom quota) | 10,000 |
Maximum number of member accounts for multi-account management. To increase the quota, contact your account manager. | 1,000 | 1,000 | 1,000 | 1,000 |
Data leaks | Available for an additional fee | Available for an additional fee | Available for an additional fee | Available for an additional fee |
Log analysis | Available for an additional fee | Available for an additional fee | Available for an additional fee | Available for an additional fee |
Firewall instance calculation
Internet firewall: One instance is required for each protected region. Within the same region, only one instance specification is consumed, regardless of the number of protected public IP addresses or whether the IP addresses are IPv4 or IPv6.
NAT firewall: One instance is required for each NAT Gateway instance.
VPC firewall:
In a Cloud Enterprise Network (CEN) Enterprise Edition architecture, one instance is required for each Transit Router (TR).
In a CEN Basic Edition architecture, one instance is required for each VPC.
In a VPC peering connection architecture, one instance is required for each pair of VPCs.
Multi-account Management: If you enable this feature, the assets of each member account consume a Cloud Firewall instance specification and incur a separate instance fee.
Boundary firewalls
Feature | Premium Edition (subscription) | Enterprise Edition (subscription) | Ultimate Edition (subscription) | Pay-as-you-go |
Traffic analysis
Feature | Premium Edition (subscription) | Enterprise Edition (subscription) | Ultimate Edition (subscription) | Pay-as-you-go |
Protection configuration
Feature | Premium Edition (subscription) | Enterprise Edition (subscription) | Ultimate Edition (subscription) | Pay-as-you-go |
Supported. You can configure up to 2 synchronization nodes each for ACK and DNS. | Supported. You can configure up to 5 synchronization nodes each for ACK and DNS. | Supported. You can configure up to 10 synchronization nodes each for ACK and DNS. | Supported. You can configure up to 5 synchronization nodes each for ACK and DNS. | |
Detection and response
Feature | Premium Edition (subscription) | Enterprise Edition (subscription) | Ultimate Edition (subscription) | Pay-as-you-go |
System settings
Feature | Premium Edition (subscription) | Enterprise Edition (subscription) | Ultimate Edition (subscription) | Pay-as-you-go |
Overview
Feature | Premium Edition (subscription) | Enterprise Edition (subscription) | Ultimate Edition (subscription) | Pay-as-you-go |