Cloud Firewall:Features supported by different Cloud Firewall editions

Feature

Description

Pay-as-you-go Edition

Premium Edition

Enterprise Edition

Ultimate Edition

References

Overview

Provides an overview of Cloud Firewall's defense capabilities. It displays statistics on protected assets, traffic data for the last 7 days, and defended security risks.

Data overview

Displays a visual traffic topology graph for cloud assets protected by Cloud Firewall.

Traffic topology graph

Firewall switch

The Internet firewall protects inbound and outbound traffic between the Internet and public assets with IP addresses (including IPv4 and IPv6).

Internet firewall

NAT firewalls protect traffic from private IP assets that access the Internet through a NAT Gateway.

NAT firewall

The VPC firewall protects traffic between virtual private clouds (VPCs) and between VPCs and data centers.

VPC firewall

Network traffic analysis

Suspicious Outbound Connections. Provides real-time monitoring of outbound connections from public and private cloud assets to the Internet to promptly detect unusual traffic.

Outbound connections

Internet Exposure. Detects the IP addresses, ports, and applications of cloud assets protected by Cloud Firewall that are exposed to the Internet in real time. It provides visual analytics reports.

Internet Exposure

VPC Access. Monitors traffic between interconnected VPCs in real time. This helps you get real-time VPC network traffic data to promptly detect and troubleshoot unusual traffic.

VPC Access

Attack prevention

Intrusion prevention. Actively detects and intercepts malicious traffic in real time. This includes malicious attacks from hackers, exploits, brute-force attacks, worms, mining programs, backdoor trojans, and DoS attacks. It protects your cloud-based information systems and network architecture.

Intrusion prevention

Vulnerability Prevention. Automatically syncs vulnerabilities detected by Security Center on public assets connected to Cloud Firewall. It provides attack prevention for these vulnerabilities to create a closed loop of detection and protection.

Vulnerability Prevention

Breach awareness. Helps you detect server intrusion events to prevent major business losses.

Breach awareness

Data breach. Helps you promptly detect sensitive data leaks and risky payloads during outbound connections from your cloud assets. This prevents business losses.

Data breach

The built-in threat detection engine lets you configure attack prevention rules for more precise detection and blocking of intrusion threats.

IPS Configuration

Access control

Internet Border. Supports Layer 4 to Layer 7 access control (north-south) for inbound and outbound traffic of public assets. It effectively prevents external malicious attacks and strictly controls outbound traffic from active connections to prevent untrusted outbound connections.

Configure an access control policy for the Internet border

NAT Border. Supports Layer 4 to Layer 7 access control (north-south) for traffic from private IP addresses behind a NAT gateway that access the public network. It effectively intercepts unauthorized access from the internal network to the public network.

Configure an access control policy for the NAT border

VPC Border. Supports access control (east-west) for traffic between different VPCs, between VPCs and data centers, or between VPCs and third-party clouds. It blocks unauthorized internal traffic and allows trusted traffic.

Configure an access control policy for the VPC border

Internal Border. Supports access control for inbound and outbound traffic between ECS instances to restrict unauthorized access between them.

Internal firewall

Security group check. Detects high-risk rules in the security groups of ECS servers and provides suggestions for remediation. This helps you use the security group feature more securely and efficiently.

Security group check

Manage address books. Supports custom address books, cloud service address books, and threat intelligence address books. You can add multiple IP addresses, ports, or domain names to an address book. You can then reference and automatically update them in access control policies with a single click to improve policy efficiency.

Manage address books

Synchronization nodes

ACK cluster synchronization nodes: Designed for ACK container environments. They dynamically collect pod IP addresses and update them to address books. This solves access control challenges caused by frequent IP changes, significantly reduces manual configuration, and improves security and management efficiency.

Up to 5

Up to 2

Up to 5

Up to 10

ACK cluster

Private DNS synchronization nodes: Suitable for enterprises that use PrivateZone or self-managed DNS servers and have configured DNS records for internal domain names of services such as PaaS or hosts. Cloud Firewall can use private DNS synchronization nodes to automatically obtain the corresponding domain name-to-IP mappings and use them in domain name-based access control policies.

Private DNS

Log Monitoring

Log auditing. Provides a 7-day log audit feature by default for event tracing, troubleshooting, and other purposes.

Log auditing

Log analysis. Automatically collects, stores, and performs advanced analysis on all traffic logs from assets connected to Cloud Firewall in real time. The storage duration can be customized from 7 to 730 days, and you can also customize the delivery switch. It supports custom real-time monitoring and alerting based on specific metrics to ensure a timely response when anomalies occur in critical services.

Log analysis

Business Visualization

Lets you establish relationships between applications, application groups, and business groups for your cloud assets using custom groups.

Supports business visualization to help you gain a comprehensive understanding of your cloud asset information and access relationships.

Custom groups

Security group visualization

Application Group Visualization

Multi-account management

Supports the multi-account management feature. This helps you share resources and ensure secure traffic access across multiple accounts.

Multi-account management

Alert notifications

When traffic anomalies, host compromises, suspicious outbound connections, vulnerability threats, disabled protection, or disabled intrusion prevention occur on your assets, you can receive timely notifications by text message or email.

Alert notifications