- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Creating a User Group and Granting Permissions
- Checking the Dashboard
- Purchasing and Changing the Specifications of CFW
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
- Enabling NAT Gateway Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
- Permissions Management
- Using Cloud Eye to Monitor CFW
- CTS Auditing
-
Best Practices
- CFW Best Practice Summary
- Purchasing and Querying CFW via API
- Migrating Security Policies to CFW in Batches
- Configuration Suggestions for Using CFW with WAF, Advanced Anti-DDoS, and CDN
- Allowing Internet Traffic Only to a Specified Port
- Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name
- Using CFW to Defend Against Network Attacks
- Configuring a Protection Rule to Protect Traffic Between Two VPCs
- Configuring a Protection Rule to Protect SNAT Traffic
- Using CFW to Protect Enterprise Resources
- Using CFW to Protect EIPs Across Accounts
- Using CFW to Protect VPCs Across Accounts
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
-
Firewall Management
- Creating a Firewall
- Obtaining the Status of a CFW Task
- Deleting a Firewall
- Querying the Firewall List
- Changing the East-West Firewall Protection Status
- Querying Firewall Details
- Obtaining East-West Firewall Information
- Creating an East-West Firewall
- Querying the Number of Protected VPCs
- Creating a Tag
- Deleting a Tag
- EIP Management
-
ACL Rule Management
- Creating an ACL Rule
- Deleting an ACL Rule
- Deleting ACL Rules in Batches
- Deleting the Number of Rule Hits
- Updating an ACL Rule
- Updating Rule Actions in Batches
- Setting the Priority of an ACL Protection Rule
- Querying a Protection Rule
- Querying Rule Tags
- Obtaining the Number of Rule Hits
- Viewing the Region List
- Checking the ACL Import Status
- Blacklist/Whitelist Management
- Address Group Management
- Service Group Management
-
Domain Name Resolution and Domain Name Group Management
- Adding a Domain Name Group
- Deleting a Domain Name Group
- Updating a Domain Name Group
- Updating the DNS Server List
- Querying the Domain Name Group List
- Querying the DNS Server List
- Querying an IP Address for Domain Name Resolution
- Obtain the list of domain names in a domain name group
- Adding a Domain Name List
- Deleting a Domain Name List
- Viewing Domain Group Details
- Obtaining the DNS Resolution Result of a Domain Name
- Deleting Domain Groups in Batches
- IPS management
- Log Management
- Packet Capture Management
- Antivirus Management
- Alarm Configuration Management
- Tag Management
- IPS Management
-
Firewall Management
- Appendix
- SDK Reference
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF, Advanced Anti-DDoS, and CFW Be Deployed Together?
- Can CFW Protect Resources Across Enterprise Projects?
- How Long Are CFW Logs Stored by Default?
- Regions and AZs
-
Troubleshooting
- What Do I Do If Service Traffic is Abnormal?
- Why Are Traffic and Attack Logs Incomplete?
- Why Does a Protection Rule Not Take Effect?
- What Do I Do If IPS Blocks Normal Services?
- Why Is No Data Displayed on the Access Control Logs Page?
- Why Is the IP Address Translated Using NAT64 Blocked?
- Why Some Permissions Become Invalid After a System Policy Is Granted to an Enterprise Project?
- What Do I Do If a Message Indicating Insufficient Permissions Is Displayed When I Configure LTS Logs?
-
Network Traffic
- How Do I Calculate the Number of Protected VPCs and the Peak Protection Traffic at the VPC Border?
- How Does CFW Collect Traffic Statistics?
- What Is the Protection Bandwidth Provided by CFW?
- What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?
- What Are the Differences Between the Data Displayed in Traffic Trend Module and the Traffic Analysis Page?
- How Do I Verify the Validity of an Outbound HTTP/HTTPS Domain Protection Rule?
- How Do I Obtain the Real IP Address of an Attacker?
- What Do I Do If a High Traffic Warning Is Received?
-
About the Product
- Videos
-
More Documents
-
User Guide (Ankara Region)
- Product Overview
- Checking the Dashboard
- Creating Cloud Firewall
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF and CFW Be Deployed Together?
- Troubleshooting
- Network Traffic
-
About the Product
- Change History
- API Reference (Ankara Region)
-
User Guide (Ankara Region)
- General Reference
Copied.
Using CFW to Protect Enterprise Resources
Context
Huawei Cloud provides Enterprise Project Management Service (EPS) to help enterprises manage people, funds, resources, permissions, and services on the cloud, standardize enterprise operations on Huawei Cloud, and meet cloud IT governance requirements.
You can create enterprise projects based on your organizational structure to centrally manage resources in different regions. You can also grant different permissions to users and user groups in enterprise projects.
Application Scenarios
If a large enterprise wants to manage services by branch or department, but finds it difficult to divide bills and allocate resources, the enterprise can use EPS.
- Different services can be put under different enterprise projects. Bills are generated for each enterprise project, facilitating budget management and fee splitting.
- Enterprise projects can be assigned to users and user groups for refined resource management.
This section describes how to plan CFW when an enterprise manages services through EPS.
Resource and Cost Planning
Resource |
Description |
Quantity |
Cost |
---|---|---|---|
Enterprise Project Management Service (EPS) |
EPS manages enterprise resources. |
At least 2 |
Free of charge |
Cloud Firewall (CFW) |
CFW protects cloud resources. |
At least 2 |
For details, see CFW Pricing Details . |
Elastic IP (EIP) |
(Optional) EIP is a type of cloud resource. |
Configure based on service demands. |
For details, see EIP Pricing Details . |
Virtual Private Cloud (VPC) |
(Optional) EIP is a VPC of cloud resource. |
Configure based on service demands. |
For details, see VPC Pricing Details . |
Enterprise Router |
(Optional) An enterprise router routes traffic between VPC and CFW. When CFW is used to protect VPCs, traffic diversion depends on Enterprise Router. |
At least 1 |
For details, see Enterprise Router Pricing Details . |
Example
An enterprise has services A and B on the cloud. Each service has a production team and a test team. The enterprise creates enterprise projects as follows:
- To manage services A and B separately, the enterprise creates enterprise projects A_Production and A_Test for service A, and B_Production and B_Test for service B. Cloud resources are bound to the corresponding enterprise projects based on service teams during purchase.
- The enterprise creates an enterprise project named Security for the security department. When purchasing security products, the enterprise binds the products to Security so that the financial team can distinguish bills and manage security-related budget usage.

- To protect EIPs and VPCs in the production environment, the security administrator purchases the professional edition firewall.
- To protect EIPs in the test environment, the security administrator purchases the standard edition firewall.
In each environment, the firewall is shared by services A and B, and the bills are paid by the security department, as shown in Figure 2.

Enterprises can authorize member accounts by enterprise project in IAM to isolate the resources of different services. Take a security administrator and a test environment administrator as an example:
- The enterprise authorizes the security administrator to access all enterprise projects. The security administrator can view resources on both firewalls, configure different protection policies and security protection modes for the firewalls, and enable protection in different environments.
- On the CFW in the production environment, protection is enabled for the EIPs and VPCs in enterprise projects A_Production and B_Production.
- On the CFW in the test environment, protection is enabled for the EIPs in enterprise projects A_Test and B_Test.
- The enterprise authorizes the test environment administrator to manage A_Test, B_Test, and Security enterprise projects, but does not authorize the test administrator to manage resources (EIPs and VPCs) in the production environments. The test environment administrator can perform operations on the two firewalls under its account, and can only view the resource information in the test environments.
Related Operations
- For details about how to create an enterprise project, see Creating an Enterprise Project .
- For details about how to purchase a CFW, see Purchasing a CFW .
- For details about how to create and grant permissions to a user group using IAM, see Creating a User Group and Assigning Permissions. For details about how to grant permissions to a user using IAM, see Assigning Permissions to an IAM User.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot