Cloud Firewall:Create an access control policy for a VPC firewall

Procedure

To manage the traffic between two VPCs, you can use the blacklist mode or whitelist mode. In blacklist mode, you need to configure a policy to deny traffic that is not trusted or is not required in your workloads and a policy to allow other traffic. In whitelist mode, you need to configure a policy to allow traffic that is trusted or is required in your workloads and a policy to deny other traffic. For more information about the examples of configuring an access control policy for a VPC firewall, see Configure access control policies.

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Access Control > VPC Border.

3. On the VPC Border page, click Switchover to select the network instance for which you want to configure a policy.

   

4. Click Create Policy. Then, configure the policy parameters based on the following table and click OK.

   Parameter	Description
   Source Type	The initiator of the network connection. You must select a source type and enter source addresses from which network traffic is initiated based on the selected source type. If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,). If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Source Type to Address Book, make sure that an IP address book is configured. For more information about how to create an address book, see Manage address books.
   Source
   Destination Type	The receiver of network traffic. You must select a destination type and enter destination addresses to which network traffic is sent based on the selected destination type. If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,). If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Source Type to Address Book, you can select an IPv4 or domain address book that you create. You can select multiple address books. If you have not created an address book, click Create Address Book to create an IPv4 or domain address book. For more information about address books, see Manage address books. If you set Destination Type to Domain Name, enter a domain name for Destination. You can enter a wildcard domain name. Example: *.aliyun.com.
   Destination
   Protocol Type	The transport layer protocol. Valid values: TCP, UDP, ICMP, and ANY. If you do not know the protocol type, select ANY.
   Port Type	The port type and port number of the destination. If you set Port Type to Port, enter port ranges. Specify a port range in the Port number/Port number format. Examples: 22/22 or 80/88. Separate multiple port ranges with commas (,). You can enter up to 2,000 port ranges. If you enter multiple port ranges, Cloud Firewall automatically creates an address book that includes the entered port ranges. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Port Type to Address Book, make sure that a port address book is configured. For more information about how to create an address book, see Manage address books.
   Port
   Application	The application type of the traffic. You can select multiple application types. If you set Protocol Type to TCP, you can select HTTP, HTTPS, SMTP, SMTPS, SSL, and FTP for Application. If you set Protocol Type to UDP, ICMP, or ANY, you can select only ANY for Application. If you select Domain Name or Address Book for Destination Type, you can select only HTTP, HTTPS, SMTP, or SMTPS for Application. Note Cloud Firewall identifies application types based on packet characteristics instead of port numbers. If Cloud Firewall cannot identify the application type in a packet, Cloud Firewall allows the packet. If you want to block the traffic whose application type is unknown, we recommend that you enable the strict mode for the Internet firewall. For more information, see Configure the strict mode of the Internet firewall.
   Action	The action on the traffic if the traffic meets the preceding conditions that you specify for the access control policy. Allow: The traffic is allowed. Deny: The traffic is denied, and no notifications are sent. Monitor: The traffic is recorded and allowed. You can observe the traffic for a period of time and change the policy action to Allow or Deny based on your business requirements.
   Description	The description of the access control policy. Enter a description that can help identify the policy.
   Priority	The priority of the access control policy. Default value: Lowest. Valid values: Highest: The access control policy has the highest priority. Lowest: The access control policy has the lowest priority.
   Policy Validity Period	The validity period of the access control policy. The policy can be used to match traffic only within the validity period.

By default, an access control policy immediately takes effect after it is created. In the list of access control policies, view the hit details about an access control policy in the Hits/Last Hit At column.

The Hits/Last Hit At column displays the number of hits and the time when the policy was last hit. Click the number of hits to go to the Log Audit page. On the Traffic Logs tab, view the hit details. For more information, see Log audit.