Cloud Firewall:Configure a VPC firewall for a Basic Edition TR

How it works

After you enable a vpc firewall, Cloud Firewall intercepts and filters traffic between VPCs. It applies security measures such as Deep Packet Inspection (DPI), intrusion prevention system (IPS) rules, threat intelligence, virtual patching, and access control policies to determine whether to allow or block traffic. This blocks unauthorized access and secures traffic between your private network assets.

The following diagram shows an example of how a vpc firewall protects traffic in a Basic Edition transit router topology.

For more information about the protection scope, see What is Cloud Firewall?

Potential impacts

When you create a vpc firewall, you do not need to change your current network topology. You can create a vpc firewall and configure automatic traffic redirection to protect your assets without affecting your services. The creation process takes about 5 minutes. We recommend that you enable the vpc firewall during off-peak hours.

Enabling or disabling a vpc firewall takes 5 to 30 minutes, depending on the number of route entries. During this process, long-lived connections may experience transient interruptions that last for a few seconds. Short-lived connections are not affected.

Prerequisites

• You have purchased the Enterprise Edition, Ultimate Edition, or Pay-as-you-go Edition of Cloud Firewall. For more information, see Purchase Cloud Firewall.

  Note

  Only the Enterprise, Ultimate, and Pay-as-you-go editions of Cloud Firewall support configuring a vpc firewall for a Basic Edition transit router. The Premium Edition does not support this feature.

• You have authorized Cloud Firewall to access your cloud resources. For more information, see Authorize Cloud Firewall to access cloud resources.

• You have purchased a CEN instance and used it to establish network connectivity between VPCs. For more information, see Connect VPCs in the same region (Basic Edition) and Connect VPCs across regions and accounts (Basic Edition).

  Note

  If a VPC in your CEN instance was created by a different Alibaba Cloud account and that account has not granted the required permissions to Cloud Firewall, you cannot create a vpc firewall. We recommend that you log on to the Cloud Firewall console with the corresponding account to grant the permissions, and then enable the vpc firewall. For more information, see Authorize Cloud Firewall to access cloud resources.

• Make sure that the regions where your network resources are located are supported by the vpc firewall. For more information, see Supported regions.

Procedure

1. Log on to the Cloud Firewall console. In the left-side navigation pane, click Firewall.

2. On the Firewall page, click VPC Firewall.

3. On the VPC Firewall tab, click Cloud Enterprise Network (Basic Edition).

4. Locate the CEN instance for which you want to create a vpc firewall and click Create in the Actions column.

   If the asset you want to protect is not in the asset list, click Synchronize Assets to synchronize the asset information of the current Alibaba Cloud account and its member accounts.

5. In the Create Firewall panel, follow the configuration wizard to complete the vpc firewall configuration.

   For a Basic Edition transit router, you can run a diagnostic check to verify whether the conditions for creating the firewall are met. You can view the results in the Enable Diagnosis wizard. If you are familiar with the firewall creation requirements, you can skip the diagnostic check and create the firewall directly.

   The following table describes the vpc firewall configurations in a CEN-connected environment.

   Parameter	Description
   Basic Information	Name: Specify a unique name to identify the vpc firewall instance. We recommend that you use a meaningful name based on your business needs.
   VPC Configurations of Firewall	Assign CIDR blocks to the automatically created Cloud Firewall VPC and vSwitch. These are used to create a dedicated firewall VPC (Cloud_Firewall_VPC) for traffic redirection. A subnet CIDR block is allocated from the assigned VPC CIDR block for the Cloud Firewall VPC's vSwitch. The subnet's mask must be /29 or shorter and must not conflict with your network plan. Important These settings depend on your service configuration and cannot be changed after creation. To make changes, you must delete and recreate the firewall. VPC of Firewall: The default value is 10.0.0.0/8. You can customize the CIDR block for the firewall VPC. Supported ranges include 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and their subnets. vSwitch CIDR Block: The default value is 10.219.219.216/29. If the default value conflicts with your network plan, you can customize this CIDR block. Configure zone: Note If you select Default (Auto-assigned) for both the primary and secondary zones, the active-active mode is enabled. This mode is easy to configure and ideal for scenarios with latency-insensitive service traffic. If you specify a primary zone and a secondary zone, the active-passive mode is used. This mode is suitable for scenarios where service traffic is sensitive to latency and helps reduce traffic latency. For more information about the active-active and active-passive modes and the migration steps, see Best practices for migrating VPC firewall zones. Primary Zone: Set the primary availability zone for the vSwitch. Cloud Firewall also supports automatic assignment of the vSwitch availability zone. Important If your services are latency-sensitive, we recommend that you set the Primary Zone to the availability zone that hosts most of your services. Then, specify the same availability zone for the service VPC's vSwitch to further reduce latency. Secondary Zone: Set the secondary availability zone for the vSwitch. The vpc firewall preferentially forwards traffic through the primary zone for efficient transmission. When the primary zone is unavailable, the system automatically switches traffic to the secondary zone to ensure business continuity in disaster recovery scenarios.
   Assign vSwitch for Firewall	Configure the vSwitch in the service VPC that requires traffic protection. This vSwitch hosts the elastic network interface (ENI) that Cloud Firewall uses for traffic redirection. Cloud Firewall can assign the vSwitch automatically. If your services are latency-sensitive, you can customize the service VPC's availability zone to reduce network latency. Important This setting is based on your service configuration and cannot be changed after creation. To make changes, you must delete and recreate the firewall. Zone: Select the availability zone for the service VPC's vSwitch. To reduce latency, we recommend setting it to be the same as the primary availability zone of the firewall VPC's vSwitch. vSwitch: Select the vSwitch instance of the service VPC.
   Redirection Configuration	Enable or disable the redirection switch and view the protected CIDR blocks.
   IPS	Select the operating mode and policy for the intrusion prevention system (IPS) module. IPS Mode Monitor Mode: Monitors and generates alerts for malicious traffic. Block Mode: Blocks malicious traffic and intercepts intrusive activities. IPS Capabilities Basic Rules: Provides basic protection for your assets, including interception of brute-force attacks and exploits of command execution vulnerabilities, and control over post-infection connections to Command and Control (C&C) servers. Virtual Patching: Provides real-time protection against popular high-risk application vulnerabilities. Note This setting is applied to all network instances under the same CEN instance.

6. Click Start Creation to create the vpc firewall.

7. On the Cloud Enterprise Network (Basic Edition) tab, enable the switch for the vpc firewall you created.

   The vpc firewall must be enabled to protect your network resources. The vpc firewall is successfully enabled when its Firewall Status changes to Enabled.

   Note

   After you enable a vpc firewall, Cloud Firewall requires 15 to 30 minutes to learn new routes if you add or delete VPC route entries. We recommend that you wait for route learning to complete and then verify that the route table is updated. If you have any questions, .

   After the vpc firewall is created, Cloud Firewall automatically creates the following resources in your Virtual Private Cloud (VPC):

   • A VPC resource named Cloud_Firewall_VPC.

     Important

     Do not add other service resources to Cloud_Firewall_VPC. If you do, these resources will not be automatically deleted when you delete the vpc firewall. Do not manually modify or delete network resources in this VPC.

   • A vSwitch resource named Cloud_Firewall_VSWITCH.

   • Custom route table entries with the remark: Created by cloud firewall. Do not modify or delete it..

   After you enable the vpc firewall, a security group named Cloud_Firewall_Security_Group is automatically added to both Cloud_Firewall_VPC and the service VPC. An authorization policy is also configured for this security group to permit traffic to the vpc firewall.

   Important

   Do not delete the Cloud_Firewall_Security_Group security group or its authorization policy. Deleting either will interrupt service traffic.

   To perform batch operations or frequently enable and disable the vpc firewall, we recommend performing these actions during off-peak hours to avoid affecting your services.

Edit a VPC firewall

To modify the configuration of a vpc firewall, on the VPC Firewall page, go to the Cloud Enterprise Network (Basic Edition) tab, locate the target CEN instance, and click Edit in the Actions column.

Disable a VPC firewall

1. On the Firewall page, click VPC Firewall.

2. On the VPC Firewall page, go to the Cloud Enterprise Network (Basic Edition) tab, locate the target CEN instance, and turn off the Firewall switch.

   After you turn off the switch, please wait. The vpc firewall is successfully disabled when its Firewall Status changes to Disabled.

Delete a VPC firewall

If your services no longer require the vpc firewall, on the VPC Firewall page, go to the Cloud Enterprise Network (Basic Edition) tab, locate the target CEN instance, and click Delete in the Actions column.