Cloud Firewall:Security group configuration

How the ECS Firewall works

Policy group types

Policy Groups are either Standard Policy Group or Enterprise Policy Group.

Use cases

• A Standard Policy Group maps to an ECS standard security group. It provides stateful packet inspection and allows or denies inbound and outbound traffic for ECS instances in the group. Best for scenarios that require fine-grained network control with a moderate number of connections.

• An Enterprise Policy Group maps to an ECS enterprise security group. It supports more instances than a Standard Policy Group, removes private IP address limits, and simplifies rule configuration. Best for large-scale deployments that require high operational efficiency.

Comparison

For a detailed comparison between standard and enterprise security groups, see Standard security groups and enterprise security groups.

Prerequisites

Cloud Firewall Enterprise Edition or Ultimate Edition is activated. Purchase Cloud Firewall.

Configure ECS Firewall access policies

To configure ECS Firewall access control, first create a Policy Group with default policies, then add inbound or outbound policies. After configuration, publish the Policy Group to synchronize policies to the associated ECS security group.

Step 1: Create a policy group

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Prevention Configuration > Security Group Control. On the Security Group Configuration tab, click Create Policy Group.

3. In the Create Policy Group dialog box, configure the parameters for the Policy Group and click Confirm.

   Parameter	Description
   Policy Group Type	Select the type of the Policy Group: Common Policy Group Enterprise Policy Group
   Policy Group Name	Enter a name for the Policy Group. Use a descriptive name for easier identification.
   VPC	Select the VPC for this Policy Group. Each Policy Group supports only one VPC.
   Instance ID	Select one or more ECS instances for this Policy Group from the Instance ID drop-down list. Note The list displays only ECS instances within the selected VPC.
   Description	Enter a brief description of the Policy Group.
   Template	Select a template from the Template drop-down list: default-accept-login: Allows inbound traffic on TCP port 22 and TCP port 3389, and allows all outbound traffic. default-accept-all: Allows all inbound and outbound traffic. default-drop-all: Denies all inbound and outbound traffic. Note The default-drop-all option is not supported for Enterprise Policy Groups.

Step 2: Configure a policy

1. On the Security Group Configuration page, find the Policy Group that you want to manage and click Configure Policy in the Actions column.

2. On the Inbound or Outbound tab, click Create Policy.

3. In the Create Policy dialog box, configure the policy parameters and click Submit.

   Parameter	Description
   NIC Type	Defaults to Internal Network. Applies to inbound and outbound ECS instance traffic.
   Direction	Select the traffic direction for the policy. Inbound: Controls traffic from other ECS instances to the ECS instances associated with the Policy Group. Outbound: Controls traffic from the ECS instances within the Policy Group to other ECS instances.
   Policy Type	Select the policy action. Allow: Permits the matching traffic. Deny: Drops the data packets without sending a response. If two policies have the same configuration but different actions, the Deny policy overrides the Allow policy. Note The Deny option is not supported for Enterprise Policy Groups.
   Protocol Type	Select the protocol type. Select ANY if unsure.
   Port Range	Enter the port range. To specify a port range, such as all ports from 1 to 200, enter 1/200. To specify a single port, such as port 80, enter 80/80.
   Priority	The policy priority. Enter an integer from 1 to 100. Lower values indicate higher priority. Policies can share the same priority. If priorities match, the Deny policy takes precedence.
   Source Type, Source	Required for Inbound policies. Select a source type and configure the source object. CIDR Block Enter a single source address range in the Source field. Policy Group Select a source Policy Group from the Source list. Controls traffic from all ECS instances in the selected Policy Group. Note The Policy Group option is not supported for Enterprise Policy Groups. Prefix List Select a prefix list from the Source list. Controls traffic from IP addresses in the specified prefix list. Use prefix lists and port lists to efficiently manage security group rules.
   Destination	Required for Inbound policies. Available destination types: All ECS Instances: all ECS instances associated with the current Policy Group. CIDR Block: Enter the IP address (CIDR notation) of an ECS instance in this Policy Group. Controls inbound traffic for only the specified instance.
   Select Source	Required for Outbound policies. Available source types: All ECS Instances: all ECS instances associated with the current Policy Group. CIDR Block: Enter a source IP address or CIDR block. Matches ECS instances in this Policy Group with the specified address.
   Destination Type, Destination	Required for Outbound policies. The available destination types are: CIDR Block Enter a single destination CIDR block. Policy Group Select a destination Policy Group. Controls traffic to all ECS instances in the selected Policy Group. Note The Policy Group option is not supported for Enterprise Policy Groups. Prefix List Select a prefix list. Controls traffic to all ECS instances in the associated security group. Use prefix lists and port lists to efficiently manage security group rules.
   Description	Enter a description for the policy.

4. The new Policy Group appears in the ECS Firewall Policy Group list.

Step 3: Publish the policy

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Prevention Configuration > Security Group Control. On the Security Group Configuration tab, find the Policy Group that you want to publish and click Publish Policy in the Actions column.

3. In the Publish Policy dialog box, specify Update Remarks, review the changes under Update Policy, and click OK.

   Policies take effect only after publishing. On the Security Group page in the ECS console, you can view the synchronized Cloud Firewall policies. Cloud Firewall-created security groups are named Cloud_Firewall_Security_Group by default.

Synchronize policies from ECS security groups

• Manual: On the Security Group Configuration page, click Synchronize Security Group to pull ECS security group policies into Cloud Firewall. Synchronization takes 2 to 3 minutes.

• Automatic: Cloud Firewall synchronizes ECS security group policies every two hours.

Related operations

Available operations in the ECS Firewall Policy Group list:

• Edit: Modify the ECS instances and the description of a Policy Group.

• Delete: Delete a Policy Group.

  Warning

  Deleting a Policy Group permanently disables its policies. This action cannot be undone. The deleted group remains in the list but cannot be managed.

  To find unused Policy Groups, filter by source Custom to display manually created groups.