Protect selected traffic between VPCs with a TR in manual mode - Cloud Firewall

When you use a Transit Router (TR), you can manually configure routes to direct traffic between the TR and a vpc firewall. This allows the vpc firewall to protect selected traffic between VPCs and Virtual Border Routers (VBRs) connected to the TR. This topic shows you how to connect a TR to a vpc firewall.

Applicable scenarios

Cloud Firewall can protect traffic between network instances connected through a Cloud Enterprise Network (CEN) Transit Router (TR). These network instances include VPCs, Virtual Border Routers (VBRs), Cloud Connect Network (CCN) instances, and VPN gateways.

This topic describes how to configure a vpc firewall in manual traffic redirection mode to protect traffic between multiple VPCs in the same region.

Scenario diagram

Prerequisites

You have created a Cloud Enterprise Network (CEN) instance in the CEN console, along with three VPCs (VPC1, VPC2, and DMZ VPC in this example) and two VBRs (IDC-1 and IDC-2 in this example). For more information, see Create a CEN instance.

In this example, traffic between VPC1, IDC-1, IDC-2, and other VPCs is protected by Cloud Firewall. Traffic between VPC2 and DMZ VPC is not protected. Traffic from any VPC or IDC to the default route 0.0.0.0/0 is not protected.

Step 1: Create a VPC for the vpc firewall

The vpc firewall requires a dedicated VPC. You must create a dedicated VPC instance for this purpose.

Log on to the VPC console.
In the top navigation bar, select the region where you want to create the VPC and click Create VPC.

On the Create VPC page, configure the VPC with the following information and then click OK.

Parameter	Description
Region	Select the region where you want to enable the vpc firewall.
Name	Enter a name for the VPC instance. This example uses `FW VPC`.
IPv4 CIDR	Specify the primary IPv4 CIDR block for the VPC. It must be a private CIDR block with a mask of at least /26 and must not conflict with your service CIDR blocks.
vSwitch	Specify the vSwitches for the network instance connection. Each vSwitch must have a private CIDR block with a mask of at least /28. Create three vSwitches. Two vSwitches are used for the TR network instance connection. They must be created in different availability zones that support the TR service. We recommend that you select the availability zones where your services are deployed to reduce latency. The third vSwitch is used for the vpc firewall and can be created in any availability zone. In this example, the Primary vSwitch for the TR connection is named TR-Vswitch-01, the Secondary vSwitch is named TR-VSwitch-02, and the vSwitch for the vpc firewall is named Cfw-Vswitch.

On the VPC page, locate the firewall VPC instance FW VPC, and click its instance ID.
On the Resource Management tab, click Add in the Route Table section.

In the Create Route Table dialog box, configure the route table with the following information and then click OK.

Parameter	Description
VPC	Select the firewall VPC that you created. This example uses `FW VPC`.
Associated Resource Type	Select vSwitch as the resource type to associate with the route table.
Name	Enter a name for the custom route table. This example usesVPC-CFW-RouteTable.

Step 2: Connect the firewall VPC to the TR

In this step, you will connect the VPC instance (FW VPC) to the Enterprise Edition Transit Router.

Log on to the CEN console.
On the CEN Instance page, locate the CEN instance for which you want to redirect traffic to the vpc firewall and click its instance ID.
On the Basic Settings tab of the instance details page, click Create Connection in the Actions column or click the icon to the right of the VPC information.

On the Create Intra-Region Connection page, configure the connection between FW VPC and the Transit Router.

The following table describes the key parameters for creating the network connection.

Parameter	Description
Network Type	The type of network instance to connect through CEN. Select VPC.
Region	The region of the network instance. This must be the same as the region where `FW VPC` was created.
Networks	The network instance to connect through CEN. Select the instance ID of `FW VPC`.
VSwitch	The vSwitches to associate with the network connection. Select TR-Vswitch-01 for the Primary vSwitch and TR-VSwitch-02 for the Secondary vSwitch.

For information about other parameters, see Create a VPC connection with an Enterprise Edition Transit Router.

Step 3: Create network connections for VPCs and VBRs

You need to create network instance connections for VPC1, VPC2, DMZ VPC, IDC-1, and IDC-2 to attach them to the CEN instance.

For more information, see Create a VPC connection with an Enterprise Edition Transit Router.

Step 4: Create a vpc firewall

Create a vpc firewall for FW VPC.

In the Cloud Firewall console, navigate to Firewall > VPC Firewall > CEN(Enterprise Edition). Find the Transit Router for which you want to enable the firewall, and click Create in the Actions column. When creating the vpc firewall, select Manual for Traffic Redirection Mode, select FW VPC for VPC, and select Cfw-Vswitch for vSwitch. For more information, see Configure a vpc firewall for an Enterprise Edition Transit Router.

Important

The VPC configured for the firewall must belong to the same account as the CEN TR. Otherwise, the vpc firewall cannot be created.
After this step, Cloud Firewall creates an elastic network interface (ENI) in the Cfw-Vswitch for traffic redirection. You can view this ENI on the Network & Security > ENIs page in the ECS console. The system assigns it the default name cfw-bonding-eni. This ENI is a virtual network interface used for route configuration. By default, the firewall cluster binds to multiple virtual ENIs in different availability zones to ensure high availability. In manual traffic redirection mode, the firewall cluster defaults to an active-active mode across two automatically allocated availability zones.

Step 5: Configure routes for the firewall VPC

Configure VPC routes to direct traffic from the TR to the vpc firewall and back.

Log on to the VPC console.
On the Route Table page, select the system route table of the firewall VPC instance.
On the Route Entry List tab, select the Custom tab.
Click Add Route Entry, configure the following route entry, and delete any other existing custom route entries.
Key parameter descriptions:
- Destination CIDR Block: Select 0.0.0.0/0.
- Next Hop Type: Select ENI.
- ENI: Select Cfw-bonding-eni, which was created in Step 4.
After you complete this step, traffic from the TR to the firewall VPC is redirected to the vpc firewall.
On the Route Table page, open the custom route table VPC-CFW-RouteTable that you created earlier. On the Associated vSwitch tab, click Associate vSwitch. For vSwitch, select Cfw-Vswitch. Then, click OK.
On the Route Entry List tab, select the Custom tab. Click Add Route Entry, configure the following route entry, and delete any other existing custom route entries.
Key parameter descriptions:
- Destination CIDR Block: Select 0.0.0.0/0.
- Next Hop Type: Select Transit Router.
- Transit Router: Select the network instance connection for the vpc firewall.
The vpc firewall then forwards the processed traffic back to the TR.

Step 6: Configure routes for the TR

Configure routes on the Transit Router for VPC1, VPC2, and the firewall VPC to ensure that traffic between VPC1 and VPC2 passes through the vpc firewall.

Log on to the CEN console.
In the Cloud Enterprise Network console, locate the Transit Router for which you want to enable the vpc firewall, click its instance ID, and then go to the Route Table tab.
Create two route tables: Cfw-Untrust-RouteTable and Cfw-Trust-RouteTable.
1. On the Route Table tab, click Create Route Table.
2. In the Create Route Table dialog box, create the Cfw-Untrust-RouteTable and Cfw-Trust-RouteTable route tables.
  Transit Router: Select the Transit Router for which you want to enable the vpc firewall.
  Note
  Route table Cfw-Untrust-RouteTable: Forwards traffic from VPC1, IDC-1, and IDC-2 to FW VPC.
  Route table Cfw-Trust-RouteTable: Forwards traffic from FW VPC to VPC1, VPC2, DMZ VPC, IDC-1, and IDC-2.
Configure the Cfw-Trust-RouteTable route table.
Configure the Cfw-Trust-RouteTable route table to automatically learn routes from VPC1, VPC2, DMZ VPC, IDC-1, and IDC-2, and associate the traffic from FW VPC with Cfw-Trust-RouteTable.
1. Click the created Cfw-Trust-RouteTable route table, and in the details pane, click the Route Propagation tab.
2. On the Route Propagation tab, click Create Route Propagation.
3. In the Create Route Propagation dialog box, select VPC1, VPC2, DMZ VPC, IDC-1, and IDC-2 from the Attachments to Propagate Routes From dropdown list. Then, click OK.
  After route propagation is enabled, you can view the auto-learned route entries on the Route Entry tab.
4. On the Route Table tab, click the system route table in the left-side list, and then click the Route Table Association tab in the route table details pane.
5. On the Route Table Association tab of the system route table, click the created Cfw-Trust-RouteTable route table, and on the Route Table Association tab, click Create Association.
6. On the Create Association page, select FW VPC from the Route Table Association dropdown list. Then, click OK.
Configure the Cfw-Untrust-RouteTable route table.
By default, the custom route table Cfw-Untrust-RouteTable directs traffic to the VPC instance.
1. Click the created Cfw-Untrust-RouteTable route table, and in the details pane, click the Route Entry tab.
2. On the Route Entry tab, click Create Route Entry.
3. In the Add Route Entry dialog box, configure the route entry.
  Parameter descriptions:
  - Destination CIDR: Select the address range 10.0.0.0/8.
  - Blackhole Route: Select the default option No.
  - Next hop: Select the firewall VPC instance (FW VPC).
4. Repeat the preceding steps to add the following routes.
  - Add a route for the 172.16.0.0/12 CIDR block with the next hop set to the firewall VPC instance (FW VPC).
  - Add a route for the 192.168.0.0/16 CIDR block with the next hop set to the firewall VPC instance (FW VPC).
  - Add a route for the 61.20.0.0/16 CIDR block with the next hop set to the firewall VPC instance (FW VPC).
  - Add a route for the 0.0.0.0/0 CIDR block with the next hop set to DMZ VPC.
Configure the system route table to direct traffic from VPC1, IDC-1, and IDC-2 through Cloud Firewall.
Warning
This operation will cause a brief traffic interruption. We recommend that you perform it during off-peak hours or within a scheduled maintenance window.
1. On the Route Table tab, click the system route table in the left-side list, and then click the Route Propagation tab in the details pane.
2. On the Route Propagation tab, delete the route propagation entries for VPC1, IDC-1, FW VPC, and IDC-2.
  After this operation, only the route propagation entries for VPC2 and DMZ VPC remain in your system route table. You can view the auto-learned route entries on the Route Entries tab.
3. On the Route Entry tab, click Create Route Entry.
4. In the Add Route Entry dialog box, add the following routes.
  - Add a route for the 10.0.0.0/24 (VPC1) CIDR block with the next hop set to the firewall VPC instance (FW VPC).
  - Add a route for the 172.16.0.0/12 (IDC-1) CIDR block with the next hop set to the firewall VPC instance (FW VPC).
  - Add a route for the 61.20.0.0/16 (IDC-2) CIDR block with the next hop set to the firewall VPC instance (FW VPC).
Switch the route table associations to direct traffic from VPC1, IDC-1, and IDC-2 to other VPCs through Cloud Firewall.
Associate the traffic from VPC1, IDC-1, and IDC-2 with Cfw-Untrust-RouteTable.
Warning
This operation will cause a brief traffic interruption. We recommend that you perform it during off-peak hours or within a scheduled maintenance window.
1. On the Route Table Association tab of the system route table, delete the associations for VPC1, IDC-1, and IDC-2.
2. On the Route Table Association tab of the Cfw-Untrust-RouteTable route table, click Create Association.
3. In the Create Association dialog box, select VPC1, IDC-1, and IDC-2 from the Route Table Association dropdown list. Then, click OK.
4. On the Route Table Association tab, click Create Route Forwarding.
5. In the Add Route Forwarding dialog box, from the Route Table Association drop-down list, select VPC1, IDC-1, and IDC-2. Then, click OK.

Once this step is complete, CEN directs traffic to the vpc firewall's VPC instance.

Step 7: Verify the forwarding configuration

You can check the traffic logs for traffic from the CEN instance. The presence of relevant traffic logs confirms that the forwarding configuration is successful. For example:

Communication between VPC1 and VPC2 is successful, and traffic logs are generated.
Communication between VPC2 and DMZ VPC is successful, but no traffic logs are generated.

For detailed steps, see log audit.