Configuring the Enterprise Router to Direct Traffic to the Cloud Firewall

Click Edit Protected VPCs next to the firewall status. Add attachments on the enterprise router page that is displayed. For details about the supported attachment types, see Attachment Overview.

Assume you want to protect two VPCs. (At least two VPC attachments are required to connect the two VPCs to the enterprise router.) For details, see Adding VPC Attachments to an Enterprise Router.

Figure 3 Adding VPC connections

• After a firewall is created, a firewall connection (named cfw-er-auto-attach and connected to the CFW instance) is automatically generated. You need to manually add a connection for each protected VPC.

  For example, the VPC1 connection is named vpc-1, the VPC2 connection is named vpc-2, and the VPC3 connection is named vpc-3.

• To use the enterprise router of account A to protect VPCs under account B, share the router with account B. For details, see Creating a Sharing.

Click the Route Tables tab. Click Create Route Table. For more information, see Table 1.

1. Configure associations. On the route table configuration page, select the association table, click the Associations tab, and click Create Association. For more information, see Table 2.
   Figure 4 Creating an association
   

   Table 2 Association parameters

   Parameter	Description
   Attachment Type	Select VPC.
   Attachment	Select an item from the Attachment drop-down list.

   

   Add at least two associations. An association is required for each protected VPC you add.

   For example, select attachment vpc-1 for VPC1 and vpc-2 for VPC2. To add VPC3 for protection, add an association and select attachment vpc-3.

2. Configure routes. Click the Routes tab and click Create Route. Create routes as needed. For more information, see Table 3.
   Figure 5 Creating a route
   

   Table 3 Route parameters

   Parameter	Description
   Destination	Set the destination address. If 0.0.0.0/0 is configured, all the traffic of the VPC is protected by CFW. If a CIDR block is configured, the traffic of the CIDR block is protected by CFW.
   Blackhole Route	You are advised to disable this function. If it is enabled, the packets from a route that matches the destination address of the blackhole route will be discarded.
   Attachment Type	Set Attachment Type to CFW instance.
   Next Hop	Select the automatically generated firewall attachment cfw-er-auto-attach.
   Description	(Optional) Description of a route.

1. Configure associations. On the route table configuration page, select the propagation table, click the Associations tab, and click Create Association. For more information, see Table 4.
   Figure 6 Creating an association
   

   Table 4 Association parameters

   Parameter	Description
   Attachment Type	Set Attachment Type to CFW instance.
   Attachment	Select the automatically generated firewall attachment cfw-er-auto-attach.

2. Configure propagations. Click the Propagations tab, and click Create Propagation. For more information, see Table 5.
   Figure 7 Creating a propagation
   

   Table 5 Propagation parameters

   Parameter	Description
   Attachment Type	Select VPC.
   Attachment	Select an item from the Attachment drop-down list.

   

   • Add at least two propagations. A propagation is required for each protected VPC you add.

     For example, select attachment vpc-1 for VPC1 and vpc-2 for VPC2. To add VPC3 for protection, add a propagation and select attachment vpc-3.

   • After a propagation is created, its route information will be extracted to the route table of the enterprise router, and a propagation route will be generated. In the same route table, the destinations of different propagation routes may be the same, and cannot be modified or deleted.
   • You can add static routes for the attachments in a route table. The destinations of static routes in a table must be unique, and can be modified or deleted.
   • If a static route and a propagation route in the same route table happen to use the same destination, the static route takes effect first.

1. In the service list, click Virtual Private Cloud under Networking. In the navigation pane, choose Route Tables.
2. In the Name/ID column, click the route table name of a VPC. The Summary page is displayed.
3. Click Add Route. For more information, see Table 6.

   Table 6 Route parameters

   Parameter	Description
   Destination Type	Select IP address.
   Destination	The CIDR block that the traffic reaches. For example, to protect traffic between two VPCs, set the destination address of the route of VPC1 to the CIDR block of VPC2. NOTE: The value cannot conflict with existing routes or subnet CIDR blocks in the VPC.
   Next Hop Type	Select Enterprise Router from the drop-down list.
   Next Hop	Select a resource for the next hop. The enterprise routers you created are displayed in the drop-down list.
   Description	(Optional) Description of a route. NOTE: Enter up to 255 characters. Angle brackets (< or >) are not allowed.

   

   You need to add routes for at least two VPCs. Each time a protected VPC is added, you need to add a route for that VPC.

Click the route table and click the Associations tab. In the Operation column of the firewall VPC, click Delete. In the confirmation dialog box, click Yes.

Click the Propagations tab. In the Operation column of the firewall VPC, click Delete. In the confirmation dialog box, click Yes.

Click Create Route Table. For more information, see Table 7.

1. Select the route table er-RT2, click the Associations tab, and click Create Association. See, Figure 8. For more information, see Table 8.
   Figure 8 Creating an association
   

   Table 8 Association parameters

   Parameter	Description	Example Value
   Attachment Type	Set Attachment Type to CFW instance.	CFW instance
   Attachment	Select an item from the Attachment drop-down list.	cfw-er-auto

2. Create propagations for the route table (er-RT2). Click the Propagations tab and click Create Propagation. For more information, see Table 9.
   Figure 9 Creating a propagation
   

   Table 9 Propagation parameters

   Parameter	Description	Example Value
   Attachment Type	Select VPC.	VPC
   Attachment	Select an item from the Attachment drop-down list.	vpc-1

   Table 10 Propagation parameters

   Parameter	Description	Example Value
   Attachment Type	Select VPC.	VPC
   Attachment	Select an item from the Attachment drop-down list.	vpc-2

   

   • Add at least two propagations. A propagation is required for each protected VPC you add.

     For example, select attachment vpc-1 for VPC1 and vpc-2 for VPC2. To add VPC3 for protection, add a propagation and select attachment vpc-3.

   • After a propagation is created, its route information will be extracted to the route table of the enterprise router, and a propagation route will be generated. In the same route table, the destinations of different propagation routes may be the same, and cannot be modified or deleted.
   • You can add static routes for the attachments in a route table. The destinations of static routes in a table must be unique, and can be modified or deleted.
   • If a static route and a propagation route in the same route table happen to use the same destination, the static route takes effect first.

1. Add a static route. Select the route table er-RT1, click the Routes tab, click Create Route, and configure the following parameters:
   • Destination: 0.0.0.0/0
   • Attachment Type: CFW instance
   • Next Hop: cfw-er-auto (attachment of the firewall VPC)
   Figure 10 Adding a static route
   
2. Delete the propagation in the route table er-RT1.

   Click the Propagations tab. In the Operation column, click Delete. In the confirmation dialog box, click Yes.

   

   Delete all the propagations in the route table er-RT1.