Cloud Firewall
Cloud Firewall
- What's New
- Function Overview
- Service Overview
- Getting Started
-
User Guide
- Creating a User Group and Granting Permissions
- Checking the Dashboard
- Purchasing and Changing the Specifications of CFW
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
- Viewing Audit Logs
- Viewing Monitoring Metrics
-
Best Practices
- CFW Best Practice Summary
- Purchasing and Querying CFW via API
- Migrating Security Policies to CFW in Batches
- Configuration Suggestions for Using CFW with WAF, Advanced Anti-DDoS, and CDN
- Allowing Internet Traffic Only to a Specified Port
- Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name
- Using CFW to Defend Against Network Attacks
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
- Domain Name Management
- VPC Protection
- Rule Hit Count
- IPS Switch Management
- East-west Protection
- ACL Rule Management
- Blacklist and Whitelist Management
- Log Query Management
- Protection Mode Management
- Cloud Firewall Information Management
- Service Group Management
- Service Group Member Management
- EIP Management
- Address Group Member Management
- Address Group Management
- Appendix
- Change History
- SDK Reference
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF and CFW Be Deployed Together?
- How Long Are CFW Logs Stored by Default?
- Regions and AZs
- Troubleshooting
-
Network Traffic
- How Do I Calculate the Number of Protected VPCs and the Peak Protection Traffic at the VPC Border?
- How Does CFW Collect Traffic Statistics?
- What Is the Protection Bandwidth Provided by CFW?
- What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?
- What Are the Differences Between the Data Displayed in Traffic Trend Module and the Traffic Analysis Page?
- How Do I Verify the Validity of an Outbound HTTP/HTTPS Domain Protection Rule?
- Billing
-
About the Product
- Videos
On this page
Enabling Internet Border Traffic Protection
Updated on 2024-11-04 GMT+08:00
CFW protects Internet border traffic by protecting EIPs. After EIP protection is enabled, your service traffic will pass through CFW. By default, all traffic is allowed.
To use CFW to protect traffic, you also need to configure access control policies or enable IPS. For details about how to configure access control policies, see Adding a Protection Rule. For details about IPS, see Configuring Intrusion Prevention Policies.
Constraints
- Currently, IPv6 addresses cannot be protected.
- An EIP can only be protected by one firewall.
- Only EIPs in the enterprise project to which the current account belongs can be protected.
Impacts on Services
Enabling or disabling EIP protection does not interrupt services, ensuring smooth traffic switchover.
Enabling Internet Border Traffic Protection
- Log in to the management console.
- Click
in the upper left corner of the management console and select a region or project. - In the navigation pane on the left, click
and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed. - (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click View in the Operation column of a firewall to go to its details page.
- In the navigation pane, choose Assets > EIPs. The EIPs page is displayed. The EIP information is automatically updated to the list.
- Enable EIP protection.
- Enable protection for a single EIP: In the row of the EIP, click Enable Protection in the Operation column.
- Enable protection for multiple EIPs: Select the EIPs that you want to enable protection and click Enable Protection above the list.
NOTICE:
- Currently, IPv6 addresses cannot be protected.
- An EIP can only be protected by one firewall.
- Only EIPs in the enterprise project to which the current account belongs can be protected.
- On the page that is displayed, check the information and click Bind and Enable. Then the Protection Status changes to Protected.
NOTE:
After EIP protection is enabled, the default action of the access control policy is Allow.
Related Operations
- Disabling EIP protection
- To disable an EIP, click Disable Protection in the Operation column of the EIP.
- To disable multiple EIPs, select them and click Disable Protection above the table.
- Enabling automatic protection for new EIPs: Enable Auto Protect New EIP above the list. Protection will be automatically enabled for new EIPs, and EIP traffic will pass through and be protected by the firewall.
Follow-up Operations
After protection is enabled, all traffic is allowed by default. CFW will block traffic based on the policies you configure.
- To implement traffic control, configure a protection policy. For details, see Adding an Internet Boundary Protection Rule or Adding Blacklist or Whitelist Items to Block or Allow Traffic.
- Allow or block traffic based on protection rules.
- Traffic allowing rule: The allowed traffic will be checked by functions such as intrusion prevention system (IPS) and antivirus.
- Traffic blocking rule: Traffic will be directly blocked.
- Allow or block traffic based on the blacklist and whitelist:
- Whitelist: Traffic will be directly allowed without being checked by other functions.
- Blacklist: Traffic will be directly blocked.
- Allow or block traffic based on protection rules.
- For details about how to block network attacks, see Blocking Network Attacks.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.
The system is busy. Please try again later.
