Cloud Firewall:Features supported by each Cloud Firewall edition

Feature name

Function overview

Free Edition

Pay-as-you-go Edition

Pro Edition

Enterprise Edition

Ultimate Edition

References

Overview

Provides an overview of Cloud Firewall's defense capabilities, displaying statistics on protected assets, traffic statistics for the last 7 days, and statistics on prevented security risks.

Data overview

Displays a visual traffic topology of cloud assets protected by Cloud Firewall.

Traffic topology

Firewall switch

Internet firewall protects inbound and outbound traffic between the Internet and public IP assets (including IPv4 and IPv6).

Internet firewall

NAT firewall protects traffic from private IP assets accessing the Internet through NAT Gateway.

NAT firewall

The VPC firewall protects traffic between virtual private clouds (VPCs) and traffic between a VPC and a data center.

VPC firewall

Traffic analysis

Outbound connection monitoring: monitors outbound connections from public and private cloud assets to the Internet in real time, and detects unusual traffic promptly.

Outbound connection activities

Internet exposure: detects in real time the IP addresses, ports, and applications of cloud assets protected by Cloud Firewall that are exposed to the Internet, and provides visual analytics reports.

Internet exposure

VPC access: monitors traffic between interconnected VPCs in real time, helping you obtain VPC network traffic data in real time and detect and troubleshoot unusual traffic promptly.

VPC access

Attack prevention

Intrusion prevention: actively detects and blocks malicious attacks, exploit attempts, brute-force attacks, worms, mining programs, backdoors, DoS attacks, and other malicious traffic in real time to protect cloud-based enterprise information systems and network architectures.

Intrusion prevention

Vulnerability protection: automatically synchronizes vulnerabilities detected by Security Center in public-facing assets connected to Cloud Firewall, and provides protection against these vulnerabilities, creating a closed loop of vulnerability detection and protection.

Vulnerability protection

Breach awareness: helps you detect server intrusion events to prevent significant business losses.

Breach awareness

Data breach: helps you promptly detect sensitive data leaks and risky payloads during outbound connections from cloud assets, preventing business losses.

Data breach

The feature provides the built-in threat detection engine and allows you to configure prevention rules. This helps you detect and block intrusions in a more accurate manner.

IPS configuration

Access control

Internet border: supports Layer 4-7 access control for inbound and outbound traffic of public IP assets (north-south traffic), effectively preventing external malicious attacks and strictly controlling outbound traffic to prevent untrusted external connections.

Configure Internet firewall access control policies

NAT border: supports Layer 4-7 access control (north-south traffic) for private IP addresses accessing the Internet through NAT, effectively blocking unauthorized access from internal networks to the Internet.

Configure NAT firewall access control policies

VPC border: supports access control for traffic between different VPCs, and between VPCs and data centers or third-party clouds (east-west traffic), blocking unauthorized internal traffic while allowing trusted traffic.

Configure VPC firewall access control policies

Internal firewall: supports access control for inbound and outbound traffic between ECS instances, limiting unauthorized access between ECS instances.

Internal firewall

Security group check: detects high-risk rules in ECS server security groups and provides remediation suggestions, helping you use security groups more securely and efficiently.

Security group check

Address book management: supports custom address books, cloud service address books, and threat intelligence address books. You can add multiple IP addresses, ports, or domain names to an address book and reference and automatically update them in access control policies with one click, improving access control policy efficiency.

Address book management

Synchronization nodes

ACK cluster synchronization node: Specially designed for ACK container environments, supports dynamic collection of pod IP addresses and updates them to address books, solving access control challenges caused by frequent IP changes, significantly reducing manual configuration workload, and improving security and management efficiency.

ACK cluster

Private DNS synchronization node: Suitable for enterprises using Private Zone or self-built DNS servers with internal domain name resolution records configured for PaaS or host service applications. Cloud Firewall can automatically obtain the corresponding domain name and IP mapping relationships through the private DNS synchronization node, and use them for domain name application access control policies.

Private DNS

Log monitoring

Log audit: provides 7-day log audit by default, facilitating event tracing and troubleshooting.

Log audit

Log analysis: automatically collects, stores, and performs advanced analysis on all traffic logs connected to Cloud Firewall in real time. Storage duration can be customized from 7 to 730 days, and delivery switches can be customized. Supports customized real-time monitoring and alerting based on specific metrics to ensure timely response when critical business anomalies occur.

Log analysis

Business visualization

The feature allows you to create custom groups to build relationships between the applications of your cloud assets and application groups or business groups.

Provides information and access relationships of your cloud assets.

Custom grouping

Security group visualization

Application group visualization

Multi-account centralized management

The feature supports centralized management of multiple accounts. You can share resources and protect access across multiple accounts.

Multi-account centralized management

Alert notification

Notifies you of exceptions that are detected by Cloud Firewall by text message or email at the earliest opportunity. The exceptions include unusual traffic, compromised hosts, suspicious outbound connections, vulnerabilities, unprotected public IP addresses, and disabled intrusion prevention.

Alert notification