On this page

Show all

Help Center/ Cloud Firewall/ FAQs/ About the Product/ What Are the Differences Between CFW, Security Groups, and Network ACLs?

What Are the Differences Between CFW, Security Groups, and Network ACLs?

Updated on 2024-10-08 GMT+08:00

View PDF

CFW, security groups, and network ACLs allow you to set access control policies based on IP addresses or IP address groups to protect your Internet borders, VPC borders, ECSs, and subnets.

Table 1 describes the differences between them.

**Table 1** Differences between CFW, security groups, and network ACLs
Item	CFW	Security group	Network ACL
Definition	Cloud Firewall (CFW) is a next-generation cloud-native firewall. It protects the Internet border and VPC border on the cloud by real-time intrusion detection and prevention, global unified access control, full traffic analysis, log audit, and tracing. It employs AI for intelligent defense, and can be elastically scaled to meet changing business needs, helping you easily handle security threats. CFW is a basic service that provides network security protection for user services on the cloud.	A security group is a collection of access control rules for instances, such as cloud servers, containers, and databases, that have the same security requirements and that are mutually trusted within a VPC. You can define different access control rules for a security group, and these rules are then applied to all the instances added to this security group. For details about security groups, see Security Groups and Security Group Rules.	A network ACL is an optional layer of security for your subnets. After you associate one or more subnets with a network ACL, you can control traffic in and out of the subnets. For details about network ACLs, see Network ACL.
Protected objects	Internet boundary VPC boundary SNAT scenario	ECS	Subnet
Features	Filtering by 5-tuple (source IP address, destination IP address, protocol, source port, and destination port) Filtering by geographical location, domain name, domain name group, and blacklist/whitelist Intrusion prevention system (IPS) and antivirus (AV).	Filtering by 3-tuple (protocol, port, and peer IP address)	Filtering by 5-tuple (source IP address, destination IP address, protocol, source port, and destination port)

Parent topic: About the Product

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel