After you configure access control policies, Cloud Firewall matches traffic packets against their 4-tuple, application, and domain name in sequence. If Cloud Firewall cannot identify the application or domain name of the traffic, it allows the traffic by default to keep your business running. To prevent the traffic from being allowed directly, you can enable strict mode.
Cloud Firewall traffic matching rules
After you configure access control policies, Cloud Firewall matches the traffic that passes through it against the 4-tuple (source address, destination address, destination port, and transport layer protocol), application, or domain name.
Loose mode: If a traffic packet carries a non-standard application or domain name, Cloud Firewall may fail to identify the application or domain name of the traffic. When Cloud Firewall matches application policies or domain name policies, it allows traffic with an unidentified application or domain name by default.
The application policy is set to a value other than ANY.
A domain name is configured, and the domain name matching mode is set to Based on FQDN (Extract Host/SNI from Packets) or Based on Both FQDN and DNS Dynamic Resolution.
Strict mode: Cloud Firewall does not immediately allow traffic from unidentified applications or domain names. Instead, it continues to evaluate the traffic against lower-priority policies until a match is found. The firewall then applies the action from the matched policy, either allow or deny. If the traffic does not match any access control policy, Cloud Firewall allows it by default.
If strict mode drops legitimate traffic, add the required application-layer protocol information to the request packets or disable strict mode.
Strict mode is enabled by default for new VPC firewall instances.
Enable or disable strict mode of the access control engine
The Internet border and the NAT border support access control engine mode configuration. By default, the access control engine mode is Loose Mode. In this mode, if business traffic with an unidentified application or domain name occurs, Cloud Firewall allows the traffic by default so that your business is not affected. You can switch to Strict Mode based on your business requirements.
To switch the access control engine mode for the Internet border, see Configure the ACL engine mode for the Internet border.
To switch the access control engine mode for the NAT border, see Configure the ACL engine mode for the NAT firewall.
FAQ
How do I view the logs of unidentified traffic?
Log on to the Cloud Firewall console.
In the left-side navigation pane, choose .
On the tab, set Rule Source to Access Control. In the All Pre-match Access Control Policy Statuses search box, select Application Unidentified or Domain Name Unidentified to run the query.
View the traffic records of strict mode, such as the time, source IP address, destination IP address, and destination port.
Related documents
For more information about how access control policies work, see Overview of access control policies.
For more information, see Create inbound and outbound access control policies for the Internet firewall.
To query more traffic logs and view their field descriptions, see Log Audit.