Cloud Firewall allows you to adjust the instance edition, specifications, bandwidth, and billing method. You can modify your configuration based on your needs to optimize resource use and costs.
Business impact: Upgrading or downgrading Cloud Firewall will not affect your services.
Applicable editions: Only subscription Cloud Firewall that uses the subscription billing method (Premium Edition, Enterprise Edition, and Ultimate Edition) can be upgraded or downgraded.
Modifiable items
Effective October 15, 2025, Cloud Firewall has released Billing Method 2.0. New users will adopt Billing Method 2.0 by default. Existing users who made purchases before this date will continue to use Billing Method 1.0. The modifiable items vary by billing method, as shown below.
Billing Method 2.0
Upgrade or downgrade the current Cloud Firewall instance edition.
Increase or decrease the configuration specifications of the current edition, including Number of Scalable Firewall Instances, Firewall Scalable Bandwidth, and Log Storage Capacity.
Enable or disable feature modules, including Network Detection and Response (NDR), Sensitive Data Leak Detection, and Log Analysis.
Perform a Temporary Bandwidth Upgrade.
Billing Method 1.0
Upgrade or downgrade the current Cloud Firewall instance edition.
Increase or decrease the configuration specifications of the current edition, including Number of public IPs protected by Internet Firewall, Throughput of Internet Firewall, Number of NAT Firewall instances, Throughput of NAT Firewall, Number of VPC Firewall instances, Throughput of VPC Firewall, Quota for Additional Policy, and Log Storage Capacity.
Enable or disable feature modules, including NDR, Elastic Traffic Processing Capability, Sensitive Data Leak Detection, and Log Analysis.
Perform a Temporary Bandwidth Upgrade.
Upgrade
Upgrade notes
Specification limits: The upgraded specifications cannot exceed the limits of the current Cloud Firewall instance edition.
Fee difference: Upgrades require you to pay the price difference. For specific pricing, refer to the Cloud Firewall purchase page.
Upgrade recommendations
Before upgrading, log in to the Cloud Firewall console and check your current edition and purchased specifications on the right side of the Overview page. Determine if an upgrade is necessary based on your current usage, service requirements, costs, and your edition's specification limits.
The following are some upgrade recommendations for different scenarios:
If multiple specifications exceed your current edition's limits, upgrade the instance edition to expand your protection capability.
If only a single specification exceeds its limit, upgrade only that specific item.
If your protection needs exceed the specification limits, your protection may be compromised. Regularly check your specification use and maintain sufficient headroom to meet your needs.
Procedure
You can upgrade the edition, increase configuration specifications, or enable feature modules to enhance your protection capability. The expiration date of the upgraded instance edition and specifications remains the same as that of your original Cloud Firewall subscription.
Log on to the Cloud Firewall console.
In the right-side area of the Overview page, click Upgrade.
On the Upgrade page, view the configuration specifications of your current edition. Select the target edition and specifications based on your service requirements, or enable disabled feature modules as needed.
Read and select I have read and agree to the Cloud Firewall Terms of Service, and then click Buy Now to complete the payment. The new edition takes effect immediately after payment.
Procedure for temporary bandwidth upgrade
The temporary bandwidth upgrade feature allows you to temporarily increase your traffic processing capability (for public, VPC, and NAT private traffic) on an hourly basis. At the specified restoration time, the traffic processing capability automatically reverts to its pre-upgrade level. This is a short-term solution. You can only upgrade the traffic processing capability of your current purchased edition. You cannot downgrade specifications, and the upgrade duration must be shorter than your subscription period.
If you perform a standard specification upgrade to increase your peak bandwidth before the temporary upgrade expires, Cloud Firewall adopts the new bandwidth from the standard upgrade, and the temporary upgrade becomes invalid.
Log on to the Cloud Firewall console.
In the upper-right corner of the Overview page, choose
Select the traffic processing capability specifications and restoration time that meet your service requirements.
Read and select the Cloud Firewall Terms of Service, and click Buy Now to complete the payment. The temporary upgrade takes effect immediately after payment.
Downgrade
If your current specifications exceed your needs, you can downgrade them or disable unused feature modules to reduce costs.
Downgrade notes
Specification limits: Downgraded specifications cannot be lower than the default specifications for the current edition, nor can they be lower than your current usage.
Refund rules: When you downgrade an edition or its specifications, a refund is calculated based on the remaining subscription time and the new specifications. The specific refund amount is displayed on the downgrade page. For more information about the refund rules for Alibaba Cloud products, see Unsubscribe rules.
View refunds: After receiving a refund for a downgrade, go to the Expenses and Costs page and choose Orders from the left-side navigation pane to view the refund details.
Procedure
Log on to the Cloud Firewall console.
In the upper-right corner of the Overview page, choose .
On the Downgrade page, reduce the specifications of the current edition or set the options for unused feature modules to No based on your service requirements.
Read and agree to Cloud Firewall Terms of Service, and then click Buy Now to confirm the downgrade.
On the Overview page, view your updated specifications.