Protect network instance traffic in a CEN (manual diversion) - Cloud Firewall

This topic describes how to manually configure routes between a Transit Router (TR) and a VPC Firewall. This configuration lets the VPC Firewall protect all traffic between the Virtual Private Clouds (VPCs) connected by the TR.

Use cases

Cloud Firewall can protect traffic between network instances connected by a Cloud Enterprise Network (CEN) Transit Router (TR). These network instances include Virtual Private Clouds (VPCs), Virtual Border Routers (VBRs), Cloud Connect Networks (CCNs), and VPN gateways.

This topic describes how to configure the manual traffic diversion mode for a VPC Firewall. This mode protects traffic between multiple VPCs in the same region.

Architecture diagram

Prerequisites

You have created a Cloud Enterprise Network (CEN) instance in the CEN Console and two Virtual Private Clouds (VPCs). This topic uses VPC-01 and VPC-02 as examples. For more information, see Create a CEN instance.

Step 1: Create a VPC for the firewall

A VPC Firewall requires a dedicated VPC. You must create a new VPC for this purpose.

Important

Ensure that the firewall VPC and the CEN Transit Router (TR) are in the same account. Otherwise, you cannot create the VPC Firewall.

Log on to the Virtual Private Cloud Console.
In the top navigation bar, select the region where you want to create the VPC, and then click Create VPC.

In the Create VPC dialog box, configure the parameters as described in the following table, and then click OK.

Parameter	Description
Region	Select the region where you want to enable the VPC Firewall.
Name	Enter a name for the VPC instance. This topic uses Cfw-TR-manual-VPC as an example.
IPv4 CIDR	The primary IPv4 CIDR block for the VPC. Specify a private CIDR block with a prefix length of at least /26. The CIDR block cannot overlap with the CIDR blocks of your services.
vSwitch	The vSwitches for the network instance connection. You need a private CIDR block with a prefix length of at least /28. Two vSwitches are required for the TR network instance connection. You must create them in two different availability zones that support the TR service. To reduce latency, select the availability zones where your services are deployed. The third vSwitch is for the VPC Firewall and can be in any availability zone. In this topic, the primary vSwitch for the TR connection is named TR-Vswitch-01, the secondary vSwitch is named TR-VSwitch-02, and the vSwitch for the VPC Firewall is named Cfw-Vswitch.

On the VPC page, find the firewall VPC instance Cfw-TR-manual-VPC and click its instance ID.
On the instance details page, click the Resource Management tab. In the Route Table section, click Add.

In the Create Route Table dialog box, configure the route table as described in the following table, and then click OK.

Parameter	Description
VPC	Select the firewall VPC that you created. This topic uses Cfw-TR-manual-VPC as an example.
Associated Resource Type	Select vSwitch.
Name	Enter a name for the custom route table. This topic uses VPC-CFW-RouteTable as an example.

Step 2: Connect the firewall VPC to the TR

This step creates a connection between the VPC instance (Cfw-TR-manual-VPC) and the Transit Router (TR) Enterprise Edition.

Log on to the CEN console.
On the CEN Instance page, find the CEN instance for which you want to divert traffic to the VPC Firewall, and then click the instance ID.
On the Basic Settings tab of the instance details page, click Create Connection in the Actions column. Alternatively, click the icon to the right of the VPC basic information.

On the Create Intra-Region Connection page, configure the connection between Cfw-TR-manual-VPC and the Transit Router.

The following table describes the key parameters for creating the network instance connection.

Parameter	Description
Network Type	The type of network instance to connect to CEN. Select Virtual Private Cloud (VPC).
Region	The region of the network instance to connect to CEN. This must be the same region where you created Cfw-TR-manual-VPC.
Networks	The network instance to connect to CEN. Select the instance ID of Cfw-TR-manual-VPC.
VSwitch	The vSwitches to associate with the network instance connection. Select TR-Vswitch-01 as the primary vSwitch and TR-VSwitch-02 as the secondary vSwitch.

For information about other parameters, see Create a VPC connection by using an Enterprise Edition transit router.

Step 3: Create network connections for the VPCs

You must create separate network instance connections for VPC-01 and VPC-02 to attach them to the CEN instance.

For more information, see Create a VPC connection by using an Enterprise Edition transit router.

Step 4: Create the VPC Firewall

In this step, you create a VPC Firewall for Cfw-TR-manual-VPC.

In the Cloud Firewall console, navigate to Firewall > VPC Firewall. On the CEN (Enterprise Edition) tab, find the TR instance for which you want to create a firewall and click Create in the Actions column. When you create the VPC Firewall, set Manual to Manual, set VPC to Cfw-TR-manual-VPC, and set vSwitch to Cfw-Vswitch. For more information, see Configure a VPC Firewall for an Enterprise Edition Transit Router.

Note

After you complete this step, Cloud Firewall creates an elastic network interface (ENI) in the Cfw-Vswitch for traffic diversion. You can view this ENI, which is named cfw-bonding-eni by default, on the Network & Security > ENIs page in the ECS console. This ENI is a virtual network interface for routing configuration. The firewall cluster is bound to multiple virtual ENIs in different availability zones by default to ensure high availability. In manual traffic diversion mode, the firewall cluster provides high availability by operating in a dual-active model across two automatically assigned availability zones.

Step 5: Configure routes for the firewall VPC

In this step, you configure VPC routes to divert traffic from the TR to the VPC Firewall for inspection, and then route the inspected traffic back to the TR.

Log on to the Virtual Private Cloud Console.
On the Route Table page, select the system route table of the firewall VPC instance.
On the Route Entry List tab, click the Custom Route tab.
Click Add Route Entry, configure the route entry as described in the following section, and then delete other custom route entries if any exist.
Key parameters:
- Destination CIDR Block: Set to 0.0.0.0/0.
- Next Hop Type: Set to ENI.
- ENI: Select the cfw-bonding-eni that you created in Step 4.
After you complete this step, traffic forwarded from the TR to the firewall VPC is diverted to the VPC Firewall.
On the Route Table page, open the custom route table VPC-CFW-RouteTable that you created. On the Associated vSwitch tab, click Associate vSwitch, set vSwitch to Cfw-Vswitch, and click OK.
On the Route Entry List tab, click the Custom Route tab. Click Add Route Entry, configure the route entry as described in the following section, and then delete other custom route entries if any exist.
Key parameters:
- Destination CIDR Block: Set to 0.0.0.0/0.
- Next Hop Type: Set to Transit Router.
- Transit Router: Select the network instance connection for the firewall VPC.
After you complete this step, the VPC Firewall routes the processed traffic back to the TR.

Step 6: Configure routes for the TR

In this step, you configure TR routes for VPC-01, VPC-02, and the firewall VPC. This ensures that traffic between VPC-01 and VPC-02 passes through the VPC Firewall.

Log on to the CEN console.
In the Cloud Enterprise Network, find the TR for which you want to enable the VPC Firewall, click its instance ID, and then go to the Route Table tab.
On the Route Table tab, click the system route table in the list on the left.
On the details page of the system route table, click the Route Propagation tab.
On the Route Propagation tab, create two route propagation entries. Select the connections for VPC-01 and VPC-02.
This operation enables route propagation for the system route table, which automatically learns the routes from VPC-01 and VPC-02.
After you configure Route Propagation, you can view the learned routes on the Route Entry tab.
On the details page of the system route table, click the Route Table Association tab.
On the Route Table Association tab, click Create Association.
In the Add Association dialog box, select the Cfw-TR-manual-VPC connection.
After you complete this step, the firewall VPC can automatically route traffic to VPC-01 and VPC-02 through the TR.
On the Route Table page, click Create Route Table in the left-side panel. In the Create Route Table dialog box, configure the route table.
For Transit Router, select the TR for which you want to enable the VPC Firewall and specify a name for the route table. This topic uses Cfw-TR-RouteTable as an example.
The new route table, Cfw-TR-RouteTable, forwards traffic from VPC-01 and VPC-02 to the firewall VPC, Cfw-TR-manual-VPC.
Find the Cfw-TR-RouteTable route table and click Add Route Entry. In the Add Route Entry dialog box, configure the route entry.
Parameters:
- Destination CIDR: Set to the default CIDR block 0.0.0.0/0.
- Blackhole Route: Set to the default option No.
- Next Hop: Select the TR connection instance ID that corresponds to the firewall VPC instance Cfw-TR-manual-VPC.
On the Route Table tab, click the system route table in the list on the left. Then, on the details page, click the Route Table Association tab.
Warning
Perform these operations during off-peak hours or a maintenance window. The following steps involve route switching, which can cause transient disconnections for long-lived TCP connections.
On the Route Table Association tab, delete the route table associations whose next hops are VPC-01 and VPC-02. Then, on the Route Table tab, click the Cfw-TR-RouteTable route table in the list on the left.
On the details page, click the Route Table Association tab, and then click Create Association.
In the Add Association dialog box, for Route Table Association, select VPC-01 and VPC-02, and then click OK.
After you complete this step, traffic from VPC-01 and VPC-02 is associated with Cfw-TR-RouteTable. Traffic between VPC-01 and VPC-02 is then forwarded to the firewall VPC.

Step 7: Verify the configuration

You can check for traffic logs from the CEN instance in the Log Analysis feature. The presence of relevant logs confirms that the forwarding configuration is successful. For more information, see Log Analysis.