Cloud Firewall:Configure a VPC Firewall for a VPC Peering Connection

Protection topology

For more information about the protection scope, see What is Cloud Firewall?

Impact on services

You can create a VPC Firewall to protect your assets without changing your network topology. The creation process takes about 5 minutes and does not affect your services. We recommend that you enable the VPC Firewall during off-peak hours.

Enabling or disabling a VPC Firewall takes 5 to 30 minutes, depending on the number of route entries. During this process, long-lived connections may experience brief disconnections lasting a few seconds. Short-lived connections are not affected.

Prerequisites

• You have activated Cloud Firewall Enterprise Edition, Ultimate Edition, or Pay-As-You-Go Edition. For more information, see Purchase Cloud Firewall.

  Note

  Only Cloud Firewall Enterprise Edition, Ultimate Edition, and Pay-As-You-Go Edition support VPC Firewall. Premium Edition does not support this feature.

• You have authorized Cloud Firewall to access your cloud resources. For more information, see Authorize Cloud Firewall to access cloud resources.

• You have created a VPC Peering Connection instance to connect VPCs. For more information, see Use VPC Peering Connection to connect VPCs.

• Make sure that your network resources are deployed in regions that support VPC Firewall. For more information, see Supported regions.

Procedure

1. Log on to the Cloud Firewall console. In the left-side navigation pane, click Firewall.

2. On the VPC Firewall tab, click the Peering Connection subtab.

3. On the Peering Connection subtab, click Synchronize Assets. The system synchronizes assets for your account and its member accounts.

   This process takes 1 to 2 minutes.

4. Find the VPC Peering Connection instance that you want to protect and click Create in the Actions column.

   If you have a large number of VPC Peering Connection instances, you can filter the list by region or VPC instance.

5. In the Create VPC Firewall dialog box, configure the parameters.

   Parameter	Description
   Instance Name	Use a descriptive name for easy identification.
   Connection Type	This field is automatically set to VPC Peering Connection and cannot be changed.
   VPC	Confirm the VPC region and instance, select the Route Table to protect, and then enter the Destination CIDR Block. Route table When you create a VPC, a default route table is automatically created to manage traffic by adding system routes. You can create multiple route tables as needed. For more information, see Route table overview. In the Cloud Firewall console, the console automatically reads your VPC route table information. A VPC Peering Connection supports multiple route tables. You can view and select the specific route tables that you want to protect. Destination CIDR block When you select a route table, its default destination CIDR block automatically appears. You can manually modify the destination CIDR block to protect other network segments. You can add multiple CIDR blocks, separated by commas (,). Important After the VPC Firewall is enabled, you must manually edit its configuration to add protected CIDR blocks.
   Peer VPC	Confirm the peer VPC's region and instance, select the Route Table to protect, and then enter the Destination CIDR Block. Important After the VPC Firewall is enabled, you must manually edit its configuration to add protected CIDR blocks.
   IPS	Select an Intrusion Prevention System (IPS) policy: IPS mode Monitor Mode: Identifies and logs malicious traffic without blocking it. Block Mode: Blocks malicious traffic to prevent intrusions. Three strictness levels are available: Block Mode - Loose Blocking Mode - Medium Block Mode - Strict IPS Capabilities Basic Rules: Provides basic protection against threats such as brute-force attacks, command execution vulnerabilities, and command and control (C&C) server callbacks. Virtual Patching: Provides real-time defense against high-risk application vulnerabilities.
   Enable VPC Firewall	Enable this option to automatically activate the VPC Firewall after it is created.

6. Click Submit and confirm the action.

   Note

   After you enable the VPC Firewall, it may take 15 to 30 minutes for Cloud Firewall to learn the routes if you add or delete VPC route table information. We recommend that you wait for the route learning process to complete and then verify that the route table is effective. If you have any questions, submit a to consult product technical experts.

   After you create the VPC Firewall, Cloud Firewall automatically creates the following resources in the associated VPC:

   Custom route table entries with the following remarks: Created by cloud firewall. Do not modify or delete it..

   When you enable the VPC Firewall, the system automatically creates a security group named Cloud_Firewall_Security_Group and configures an Authorization Policy for it to allow traffic to the VPC Firewall.

   Important

   Do not delete the Cloud_Firewall_Security_Group security group or its authorization policy. Otherwise, traffic cannot be redirected to the VPC Firewall.

   To prevent service interruptions, perform batch operations or frequently enable and disable the VPC Firewall only during off-peak hours.

7. On the Peering Connection subtab, turn on the switch for the VPC Firewall that you created.

   Cloud Firewall can protect your network resources only when the VPC Firewall is enabled. The VPC Firewall is enabled when its Firewall Status changes to Enabled.

Disable a VPC Firewall

If you need to disable a VPC Firewall, go to the Peering Connection subtab, find the target firewall instance, and then turn off its Firewall.

The VPC Firewall is disabled when its Firewall Status changes to Disabled.