Cloud Firewall:Cloud Firewall Switch FAQ

• Why can’t I enable Cloud Firewall for my current account?

• How do I disable Cloud Firewall?

• What do I do if my business traffic exceeds the bandwidth supported by Cloud Firewall?

• Internet firewall

  • What is the impact of enabling the firewall on my business?

  • What does the Internet firewall do?

  • Does the Internet firewall support protection for IPv6 assets?

  • Does the Internet firewall affect network traffic?

  • What is the impact of disabling the Internet firewall?

  • Why does the system show an SLB network restriction when I enable the Internet firewall?

  • After synchronizing assets in the Free Edition, some public IP assets are not displayed.

  • When I enable the Internet, NAT, and DNS firewalls at the same time, how does outbound traffic match rules?

  • How do I efficiently enable and configure Internet firewall access control policies?

  • Why does an asset in the Internet firewall show Protection Abnormal?

• NAT firewall

  • What is the impact of enabling the firewall on my business?

  • NAT firewall Why do I need to create a route table and add a 0.0.0.0/0 static route?

  • When I enable the Internet, NAT, and DNS firewalls at the same time, how does outbound traffic match rules?

  • After configuring NAT firewall access control policies, why can I still use telnet commands to access resources?

  • Why does some traffic from the transit router (TR) bypass the NAT firewall even though it is configured?

• VPC firewall

  • What is the impact of enabling the firewall on my business?

  • Does enabling the VPC firewall affect ECS security group rules?

  • When creating a VPC firewall, why does the system report unauthorized network instances?

  • In a Basic Edition transit router scenario, why does a deny routing policy appear after enabling the VPC firewall?

What is the impact of enabling the firewall on my business?

How do I disable Cloud Firewall?

If you determine that your business does not require Cloud Firewall protection, release the instance to avoid extra charges.

Why can’t I enable Cloud Firewall for my current account?

What does the Internet firewall do?

The Internet firewall supports multiple public assets, such as public IP addresses of Elastic Compute Service (ECS) instances, public IP addresses of Server Load Balancer (SLB) instances, and elastic IP addresses (EIPs). After enabling the Internet firewall, the system forwards traffic entering or leaving the Internet border to Cloud Firewall. Cloud Firewall inspects and filters the traffic, allowing only traffic that meets the allow conditions to pass. For more information, see Internet firewall.

Does the Internet firewall support protection for IPv6 assets?

Yes. Cloud Firewall fully supports IPv6 asset protection starting January 8, 2025.

• Related announcement: [Announcement] Public IPv6 support for subscription and pay-as-you-go Cloud Firewall is now generally available

• Detailed protection principles and asset types: Internet firewall protection principles

For the scope of assets protected by the Internet firewall, see Protection scope.

Does the Internet firewall affect network traffic?

If you only enable the Internet firewall without configuring Internet access control or intrusion prevention policies, Cloud Firewall only inspects and alerts on traffic. It does not block traffic.

After purchasing Cloud Firewall, all Internet firewall switches are enabled by default.

What is the impact of disabling the Internet firewall?

After disabling the Internet firewall, all traffic bypasses it. This causes the following impacts:

• The Internet firewall’s protection capabilities become unavailable, including inbound and outbound access control policies and intrusion prevention.

• Internet traffic statistics are no longer updated, including network traffic analysis reports and traffic logs.

Why does the system show an SLB network restriction when I enable the Internet firewall?

After synchronizing assets in the Free Edition, some public IP assets are not displayed.

The Cloud Firewall Free Edition only synchronizes EIP assets. New assets take one day to synchronize to Cloud Firewall. It does not synchronize public IP addresses of ECS or SLB instances.

Why does an asset in the Internet firewall show Protection Abnormal?

Does enabling the VPC firewall affect ECS security group rules?

No.

After enabling the VPC firewall, Cloud Firewall automatically creates a security group named Cloud_Firewall_Security_Group and adds allow rules to permit traffic to the VPC firewall. The Cloud_Firewall_Security_Group security group applies only to traffic within that VPC. Your existing ECS security group rules remain effective and unchanged. You do not need to migrate or modify them.

When creating a VPC firewall, why does the system report unauthorized network instances?

In a Basic Edition transit router scenario, why does a deny routing policy appear after enabling the VPC firewall?

After enabling the VPC firewall for a VPC connected through a Basic Edition transit router (for example, VPC-test), Cloud Firewall creates a VPC named Cloud_Firewall_VPC under the transit router and publishes a static route. This route directs traffic from other VPCs not enabled for firewall protection to Cloud Firewall.

Cloud Firewall also adds a static route in VPC-test pointing to the Cloud Firewall ENI to direct outbound traffic from VPC-test to Cloud Firewall. It creates a deny routing policy to prevent VPC-test from learning routes published by the CEN instance.

Why does the NAT firewall require creating a route table and adding a 0.0.0.0/0 static route?

After enabling the NAT firewall, Cloud Firewall automatically creates a custom route table named Cloud_Firewall_ROUTE_TABLE and adds a 0.0.0.0/0 route pointing to the NAT Gateway. It also modifies the 0.0.0.0/0 route entry in the system route table, changing its next hop to the Cloud Firewall ENI. This redirects outbound traffic from the NAT Gateway to Cloud Firewall.

When I enable the Internet, NAT, and DNS firewalls at the same time, how does outbound traffic match rules?

When an ECS instance initiates domain name access (outbound traffic) with all three firewalls enabled, traffic matches as follows:

1. The ECS instance sends a DNS resolution request. The request passes through the DNS firewall and matches DNS firewall access control policies.

2. The ECS instance sends private network traffic through the NAT firewall and matches NAT firewall access control policies.

3. Allowed private network traffic passes through the NAT Gateway, which converts the private source IP to a public NAT IP.

4. The NAT Gateway sends public traffic to the Internet firewall and matches Internet firewall access control policies.

5. Traffic matches threat intelligence, basic defense, intelligent defense, and virtual patching rules in Cloud Firewall.

If traffic does not hit any deny policy during this process, it successfully accesses the domain name. If traffic hits any deny policy, it is blocked and cannot access the domain name.

After configuring NAT firewall access control policies, why can I still use telnet commands to access resources?

An EIP is bound to SNAT and the NAT firewall is enabled. Access control policies allow only ECS instances to access specified domains using HTTP or HTTPS over TCP. However, ECS instances can still use telnet commands to access other domains.

• Cause: Telnet commands lack application-layer protocol features (such as HTTP or HTTPS). Cloud Firewall cannot identify the application type using deep packet inspection (DPI), so the application appears as Unknown and does not match HTTP or HTTPS policies. In loose mode, if Cloud Firewall cannot identify the domain or application, it allows the unidentified traffic by default. To continue matching subsequent policies, enable strict mode.

  Important

  Strict mode is a global setting. Enabling it affects the matching logic for all traffic. Enable it only after careful consideration of your business requirements.

• Solution: Do not use telnet for testing. Use curl commands instead.

Why does some traffic from the transit router (TR) bypass the NAT firewall even though it is configured?

This issue usually occurs when the TR’s VPC attachment is associated with the dedicated vSwitch automatically created by the NAT firewall.

Explanation:

The NAT firewall relies on specific routing configurations to control traffic. In standard configuration, the process is as follows:

1. Steer business traffic: The route table of the business vSwitch in the VPC sets the next hop for outbound traffic to the NAT firewall, ensuring traffic passes through security inspection first.

2. Forward firewall traffic: After inspection, the route table of the dedicated vSwitch where the NAT firewall resides sets the next hop to the NAT Gateway, enabling final Internet access.

Impact of incorrect configuration
If the TR attachment point is bound to the NAT firewall’s dedicated vSwitch, public traffic from the TR enters the vSwitch directly. Traffic then matches the route entry in the vSwitch with the next hop set to the NAT Gateway, bypassing the NAT firewall’s security inspection. As a result, some traffic remains uncontrolled.

Recommended correct configuration
To ensure all public traffic passes through the NAT firewall, follow these best practices:

• vSwitch isolation: Do not use the NAT firewall’s dedicated vSwitch for other purposes, including as a TR attachment point.

• Independent planning: Assign a separate vSwitch for TR’s VPC attachments.

• Route verification: Confirm that all relevant route tables—including those associated with vSwitches used for TR attachments—have the next hop for public routes correctly set to the NAT firewall.

How do I efficiently enable and configure Internet firewall access control policies?

What are the differences between new and old versions of VPC firewalls for CEN Enterprise Edition transit routers with automatic traffic steering?

Cloud Firewall has updated some features of the VPC firewall for CEN Enterprise Edition transit routers. With automatic traffic steering, the firewall VPC ownership changed from user accounts to Cloud Firewall service accounts. Key differences include the following:

1. Firewall VPC ownership: In the new version, the firewall VPC belongs to the Cloud Firewall backend account, not your user account. You cannot view or modify its resources or configurations. It also does not consume your regional VPC quota.

2. Billing method: In the old version, TR traffic transfer fees apply both between the transit router and business VPCs and between the transit router and firewall VPC. Users bear both costs. In the new version, the firewall VPC belongs to Cloud Firewall, so Cloud Firewall bears the TR traffic transfer fee between the transit router and firewall VPC. Users no longer pay this fee.

3. Enabling the VPC firewall: When creating a VPC firewall, you no longer need to enter three vSwitch CIDR blocks. Enter only one CIDR block of at least /27 that does not conflict with your network plan. This block is assigned to vSwitches required during firewall creation. For instructions on configuring the Enterprise Edition VPC firewall, see Configure the VPC firewall for Enterprise Edition transit routers.

   

Is there latency when connecting to the VPC firewall?

Yes.

Latency increases by 4–8 ms across different availability zones (AZs) in the same region, and by 2–3 ms within the same AZ.