Get started with Cloud Firewall to protect cloud assets - Cloud Firewall

Cloud Firewall is a Software-as-a-Service (SaaS) firewall that provides unified, efficient, and intelligent security for your cloud assets. This guide walks first-time users through the process, from service activation and automatic asset protection to security policy configuration and effectiveness verification, helping you quickly establish the first line of network defense in your cloud environment.

Step 1: Activate pay-as-you-go Cloud Firewall

Go to the Cloud Firewall purchase page, set Product Type to Pay-as-you-go 2.0, and configure the following settings.

Parameter	Description
Auto Protection for Internet Assets	Select Yes to automatically add all public assets to the firewall and enable protection for any new assets. You can modify this setting later in the console.
Log Analysis and Log Analysis and Storage Capacity	We recommend keeping the default settings to store access logs. This feature enables real-time collection, querying, analysis, and processing of traffic logs for your protected assets to help meet compliance requirements.
Service-linked Role	To provide features such as traffic access control and monitoring, Cloud Firewall requires access to your cloud resources. Click Create Service-linked Role. The system automatically creates the AliyunServiceRoleForCloudFW service-linked role. Do not modify this role.

Read and agree to the Cloud Firewall (Pay-as-you-go) Service Agreement, then click Buy Now and complete the payment.

Step 2: View public assets and protection status

Log on to the Cloud Firewall console. In the left-side navigation pane, click Firewall.
On the Internet Firewall tab, you can view the public assets in your Alibaba Cloud account and their protection status. Because you enabled Auto Protection for Internet Assets during the purchase, the Firewall Status column for all public assets is set to Protected by default.

Step 3: Review intrusion prevention system (IPS)

The built-in intrusion prevention system (IPS) in Cloud Firewall detects and blocks a wide range of known threats in real time, including network attacks, vulnerability exploits, brute-force attempts, worm propagation, cryptomining activities, backdoor communications, and denial-of-service (DoS) attacks.

Follow these steps to view the IPS rules.

In the left-side navigation pane, choose Prevention Configuration > IPS Configuration.
By default, the system enables the Basic Protection and Virtual Patching features and sets the Threat Engine Mode to Block - Medium, which is suitable for most use cases.

Step 4: Configure access control list (ACL) policies

Cloud Firewall lets you configure independent access control policies for different assets, providing granular control over their inbound and outbound traffic.

By default, Cloud Firewall includes several policies with the Action set to Allow. You can view them by choosing Prevention Configuration > Access Control > Policy Configuration > Internet Border in the left-side navigation pane.

Direction	Source	Destination	Protocol	Port	Description
Outbound	0.0.0.0/0	0.0.0.0/0	ICMP	-	Allows cloud assets to send outbound ICMP requests, such as `ping`, for network connectivity testing.
Outbound	0.0.0.0/0	0.0.0.0/0	UDP	53	Allows cloud assets to send DNS query requests for domain name resolution, such as for accessing websites or service discovery.
Outbound	0.0.0.0/0	0.0.0.0/0	UDP	123	Allows cloud assets to connect to NTP servers for time synchronization to ensure accurate system time.
Inbound	0.0.0.0/0	0.0.0.0/0	ICMP	-	Allows external networks to perform `ping` operations on cloud assets for connectivity checks and diagnostics.

Since most cyberattacks originate from public networks, you must configure security policies that align with your business needs. We recommend using an allowlist approach: create a lowest-priority deny all catch-all policy, and then add specific allow policies with a higher priority.

Important

Risk of Misconfiguration: The following policy examples are for general reference and include a deny all rule. Applying them directly to a production environment may cause service disruptions. Traffic that does not match an explicit allow rule will be blocked by the catch-all policy.
Configuration Recommendations:
1. Order Matters: Always place allowlist rules before the catch-all deny rule. Before deploying, ensure that you have added allow rules for all necessary business traffic above the deny rule.
2. Phased Validation: Initially, set the action of the catch-all policy to Monitor. Analyze the traffic in Log Audit and gradually refine your policies to allow only trusted, business-critical traffic. After you verify that all legitimate traffic is allowed, change the action to Deny.
3. Environment Isolation: You can enable the catch-all deny rule in a test environment. For production environments, if you cannot define a complete allowlist immediately, restrict the source address of the catch-all policy to a test IP range to avoid disrupting production services.

Configure policies: Go to the Prevention Configuration > Access Control > Policy Configuration > Internet Border page and configure the following rules:

Inbound (sorted by priority from high to low):

Source	Destination	Protocol	Application	Port	Action
Alibaba Cloud trusted IPs	Public IP of cloud asset	All	ANY	All	Allow
Back-to-origin IP addresses of cloud services (for example, WAF, Anti-DDoS)	Public IP of cloud asset	All	ANY	All	Allow
IP addresses of trusted remote O&M staff or bastion host	Public IP of cloud asset	TCP	RDP, SSH	3389, 22	Allow
IP addresses of trusted O&M staff	Public IP of cloud asset	ICMP	ANY	-	Allow
All	Public IP of cloud asset for web services	TCP	HTTPS	443	Allow
All	Public IP of cloud asset for API services	TCP	HTTP	Respective API port	Allow
All	All	All	All	All	Deny

Outbound (sorted by priority from high to low):

Source	Destination	Protocol	Application	Port	Action
All	Alibaba Cloud trusted IPs, Alibaba Cloud trusted domains	All	ANY	All	Allow
All	Software repositories, certificate services	All	ANY	All	Allow
All	Trusted domains (for example, Microsoft, Google, and Windows)	TCP	HTTPS, HTTP	All	Allow
All	All	UDP	ANY	53, 123	Allow
All	All	ICMP	ANY	-	Allow
All	All	All	All	All	Deny

Adjust the ACL engine mode: The default mode allows traffic from unrecognized applications or domains to prevent false positives during initial setup. After you confirm your policies are correct, click ACL Engine Management in the upper-right corner and change the ACL Engine Mode for your assets to Strict Mode.
Verify and test: Wait 3 to 5 minutes after configuring the policies. Use commands like ping or curl to test connectivity. Then, refresh the Cloud Firewall console and click the number in the Hits/Last Hit At column to view the corresponding logs on the Log Audit page.

You have now completed this quick start guide. Choose one of the following options based on your needs:

(Recommended) Continue using Cloud Firewall: Go to Advanced optimization to refine your configuration for enterprise-grade security and compliance.
Stop using Cloud Firewall: Go to Release resources to stop billing.

Advanced optimization

Use address books

When access control policies become complex, using an address book can greatly simplify management. You can predefine groups of business-related IP addresses, such as office egress IPs or trusted partner IPs, and then reference the address book in your policies.

Go to the Prevention Configuration > Address Book page.
Click the Cloud Service IP Address Book tab to view address books provided by Alibaba Cloud.
Click the Custom IP Address Book tab, then click Create Address Book to define a collection of frequently used IP addresses. For more information, see Address Book.

IPS configuration

The default Block - Medium mode is suitable for most scenarios. However, you may need to adjust the IPS configuration in the following situations:

High-risk protection scenarios (such as during frequent attacks or critical security periods):
- Add trusted IP addresses to the Allowlist.
- Change the Threat Engine Mode to Block - Strict.
- Enable the Threat Intelligence feature.
High rate of false positives:
- Add trusted IP addresses to the Allowlist.
- Change the Threat Engine Mode to Block - Loose.
- If the issue persists, change the mode to Monitor.

Enable VPC Firewall

If you use multiple Virtual Private Cloud (VPC) networks or have connected your on-premises assets by using Cloud Enterprise Network, you can enable VPC Firewall. It inspects and controls east-west traffic between VPCs connected via a Transit Router, and between VPCs and on-premises data centers connected via Express Connect, securing your internal network traffic.

Use a subscription plan

If you plan to use Cloud Firewall for an extended period, we recommend purchasing a subscription. Alternatively, you can combine the pay-as-you-go model with a savings plan to lower your costs.

Release resources and stop billing

If you no longer need the Cloud Firewall instance created in this guide, go to the Overview page and, in the upper-right corner, choose More > Self-service Release.