All Products
Search
Document Center

Cloud Firewall:Purchase Cloud Firewall

Last Updated:May 27, 2026

Cloud Firewall protects assets and traffic on the Internet boundary, between VPCs, and between VPCs and on-premises data centers (IDCs). Activate it as a Subscription or Pay-As-You-Go service.

Prerequisites

Before you begin, ensure that you have:

Choose a billing method

Cloud Firewall offers two billing methods:

Billing method

Best for

How it works

Subscription

Predictable, long-term protection

Pay upfront for a fixed term. Configure bandwidth, instances, and add-on features at purchase.

Pay-As-You-Go

Flexible, on-demand protection with minimal commitment

Activate the service and pay only for actual daily usage. No charge when the service is idle.

Activate the Subscription edition

  1. Go to the Cloud Firewall purchase page and set Product Type to Subscription 2.0.

  2. Configure the following specifications, then click Buy Now to complete the payment.

    Configuration item Description
    Edition Select the Cloud Firewall edition. After you select an edition, the page shows a feature summary for that edition.
    Auto Protection for Internet Assets Select whether to automatically protect all Internet assets with the firewall.
    Scalable Firewalls Purchase additional firewall instances for the Internet border, VPC border, and NAT border if the default quota is insufficient.
    Note

    Cloud Firewall Premium Edition does not support VPC firewalls.

    Scalable Bandwidth Purchase additional bandwidth for the Internet border, VPC border, and NAT border if the default bandwidth is insufficient.
    Note

    Cloud Firewall Premium Edition does not support VPC firewalls.

    Network Detection and Response (NDR) Select whether to enable Network Detection and Response (NDR).
    Elastic Traffic Enabled by default and cannot be disabled. If actual traffic exceeds the purchased bandwidth, excess traffic is billed on a pay-as-you-go basis at USD 0.06/GB.
    Sensitive Data Leak Detection Select whether to enable sensitive data detection for outbound connections.
    Log Analysis Select whether to enable the log analysis feature for extended log storage. By default, Cloud Firewall stores audit logs for the last 7 days. Enable this feature to store log data for a custom period of 7 to 730 days, meet compliance requirements, or export logs. For more information, see Log Analysis and Billing of the Log Analysis Feature.
    Log Storage Capacity Set the log storage capacity based on your log volume and retention requirements.
    Duration Select the subscription duration and specify whether to enable Auto Renewal. If you enable auto-renewal, the service is automatically renewed on a monthly basis. For example, a 6-month subscription renews for 1 month upon expiration.

Activate the Pay-As-You-Go edition

  1. Go to the Cloud Firewall purchase page and set Product Type to Pay-As-You-Go.

  2. On the Cloud Firewall (Pay-As-You-Go) page, configure the following specifications:

    • Automatic Protection for Assets: When enabled, Cloud Firewall automatically adds your public assets to its protection scope after activation, applying firewall and attack protection to reduce security risks.

    Note

    After activation, to disable automatic protection, go to the Cloud Firewall console and turn off Automatic Protection for New Assets. For more information, see Internet firewall.

    The service is billed on a daily basis.

  3. Read and accept the Cloud Firewall (Pay-As-You-Go) Terms of Service, then click Buy Now to complete the payment.

Alibaba Cloud settles the bill for the previous day at 18:00 every day based on actual usage. No charges apply when the service is idle.

Verify the purchase

After activation, go to the Overview page in the Cloud Firewall console. In the upper-right corner, confirm that the correct edition, protection status, and feature activation statuses are displayed.

Next steps

See Getting started with the Subscription edition to:

  • Configure intrusion prevention policies

  • View network traffic analysis

  • Set up access control policies

More operations

Operation

Description

Renew

When a Subscription edition expires, it stops providing protection. Renew before the expiration date to maintain continuous protection.

Upgrade and downgrade

Adjust the edition and specifications to match changing business requirements.

Change the billing method

Switch between Pay-As-You-Go and Subscription based on your needs.

Release an instance

Release the Cloud Firewall instance when you no longer need it.