Cloud Firewall:Features supported by different Cloud Firewall editions

Feature name

Overview

Pay-as-you-go

Premium Edition

Enterprise Edition

Ultimate Edition

References

Overview

Outlines the protection capabilities of Cloud Firewall. It displays statistics about protected assets, access traffic over the last 7 days, and defended security risks.

Data overview

Displays a visual traffic topology graph of the cloud assets that are protected by Cloud Firewall.

Traffic topology graph

Firewall switches

The Internet firewall protects inbound and outbound traffic between the Internet and public assets that have public IP addresses (IPv4 and IPv6).

Internet firewall

NAT firewalls protect traffic from private IP assets that access the Internet through a NAT Gateway.

NAT firewalls

The VPC firewall protects traffic between VPCs and between VPCs and data centers.

VPC firewall

Network traffic analysis

Outbound connections. Monitors outbound connections from public and private cloud assets to the Internet in real time to promptly detect unusual traffic.

Outbound connection activities

Internet Exposure. Detects the IP addresses, ports, and applications of cloud assets protected by Cloud Firewall that are exposed to the Internet in real time. It provides visual analytics reports.

Internet Exposure

VPC Access. Monitors traffic between interconnected VPCs in real time. This helps you obtain real-time VPC network traffic data to promptly detect and troubleshoot unusual traffic.

VPC Access

Attack prevention

Intrusion prevention. Actively detects and intercepts malicious traffic in real time. This includes malicious attacks from hackers, vulnerability exploits, brute-force attacks, worms, mining programs, backdoor trojans, and DoS attacks. It protects your cloud information systems and network architecture.

Intrusion prevention

Vulnerability Prevention. Automatically synchronizes vulnerabilities that Security Center detects on your public assets connected to Cloud Firewall. It provides attack prevention for these vulnerabilities to create a closed loop of vulnerability detection and protection.

Vulnerability Prevention

Breach awareness. Helps you detect server intrusion events to prevent major business losses.

Breach awareness

Data breach. Helps you promptly detect sensitive data leaks and risky payloads in outbound connections from your cloud assets to prevent business losses.

Data breach

The built-in threat detection engine lets you configure attack prevention rules to more precisely detect and block intrusion threats.

IPS Configuration

Access control

Internet Border. Supports Layer 4 to Layer 7 access control for north-south inbound and outbound traffic of public assets. This effectively prevents external malicious attacks and strictly controls outbound traffic from outbound connections to prevent untrusted connections.

Configure access control policies for the Internet border

NAT Border. Supports Layer 4 to Layer 7 access control for north-south traffic from private IP addresses that access the Internet through NAT Gateways. This effectively intercepts unauthorized access from the internal network to the Internet.

Configure access control policies for the NAT border

VPC Border. Supports access control for east-west traffic between different VPCs, and between VPCs and data centers or third-party clouds. This blocks unauthorized internal traffic and allows trusted traffic.

Configure access control policies for the VPC border

Internal Border. Supports access control for inbound and outbound traffic between ECS instances to restrict unauthorized access between them.

Internal firewall

Security group check. Detects important-risk rules in the security groups of ECS servers and provides suggestions for remediation. This helps you use the security group feature more securely and efficiently.

Security group check

Manage address books. Supports custom address books, cloud service address books, and threat intelligence address books. You can add multiple IP addresses, ports, or domain names to an address book. Then, you can reference and automatically update them in access control policies with a single click to improve the efficiency of your policies.

Manage address books

Sync nodes

ACK cluster sync nodes: Designed for ACK container environments. They support dynamic collection of pod IP addresses and update them to address books. This resolves access control issues caused by frequent IP address changes, significantly reduces manual configuration, and improves security and management efficiency.

Up to 5

Up to 2

Up to 5

Up to 10

ACK clusters

Private DNS sync nodes: Suitable for enterprises that use PrivateZone or self-managed DNS servers and have configured internal domain name resolution records for services such as PaaS or hosts. Cloud Firewall can use private DNS sync nodes to automatically obtain the corresponding domain name-to-IP mappings and use them in domain name-based access control policies.

Private DNS

Log Monitoring

Log audit. Provides a 7-day log audit feature by default. This helps you trace events and troubleshoot faults.

Log audit

Log analysis. Automatically collects, stores, and performs advanced analysis on all traffic logs delivered to Cloud Firewall in real time. The storage duration can be customized from 7 to 730 days, and you can also customize the delivery switch. It supports real-time monitoring and alerting based on specific metrics to ensure a prompt response when abnormalities occur in key services.

Log analysis

Business Visualization

Lets you establish relationships between applications, application groups, and business groups of your cloud assets using custom groups.

It supports business visualization to help you gain a comprehensive understanding of your cloud asset information and access relationships.

Custom groups

Security group visualization

Application Group Visualization

Multi-account management

Supports the multi-account management feature. This helps you share resources and ensure secure traffic access across multiple accounts.

Multi-account management

Alert notifications

When traffic exceptions, host compromise, suspicious outbound connections, vulnerability threats, disabled protection, or disabled intrusion prevention occur on your assets, you can receive prompt notifications by text message or email.

Alert notifications