- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Creating a User Group and Granting Permissions
- Checking the Dashboard
- Purchasing and Changing the Specifications of CFW
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
- Enabling NAT Gateway Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
- Permissions Management
- Using Cloud Eye to Monitor CFW
- CTS Auditing
-
Best Practices
- CFW Best Practice Summary
- Purchasing and Querying CFW via API
- Migrating Security Policies to CFW in Batches
- Configuration Suggestions for Using CFW with WAF, Advanced Anti-DDoS, and CDN
- Allowing Internet Traffic Only to a Specified Port
- Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name
- Using CFW to Defend Against Network Attacks
- Configuring a Protection Rule to Protect Traffic Between Two VPCs
- Configuring a Protection Rule to Protect SNAT Traffic
- Using CFW to Protect Enterprise Resources
- Using CFW to Protect EIPs Across Accounts
- Using CFW to Protect VPCs Across Accounts
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
-
Firewall Management
- Creating a Firewall
- Obtaining the Status of a CFW Task
- Deleting a Firewall
- Querying the Firewall List
- Changing the East-West Firewall Protection Status
- Querying Firewall Details
- Obtaining East-West Firewall Information
- Creating an East-West Firewall
- Querying the Number of Protected VPCs
- Creating a Tag
- Deleting a Tag
- EIP Management
-
ACL Rule Management
- Creating an ACL Rule
- Deleting an ACL Rule
- Deleting ACL Rules in Batches
- Deleting the Number of Rule Hits
- Updating an ACL Rule
- Updating Rule Actions in Batches
- Setting the Priority of an ACL Protection Rule
- Querying a Protection Rule
- Querying Rule Tags
- Obtaining the Number of Rule Hits
- Viewing the Region List
- Checking the ACL Import Status
- Blacklist/Whitelist Management
- Address Group Management
- Service Group Management
-
Domain Name Resolution and Domain Name Group Management
- Adding a Domain Name Group
- Deleting a Domain Name Group
- Updating a Domain Name Group
- Updating the DNS Server List
- Querying the Domain Name Group List
- Querying the DNS Server List
- Querying an IP Address for Domain Name Resolution
- Obtain the list of domain names in a domain name group
- Adding a Domain Name List
- Deleting a Domain Name List
- Viewing Domain Group Details
- Obtaining the DNS Resolution Result of a Domain Name
- Deleting Domain Groups in Batches
- IPS management
- Log Management
- Packet Capture Management
- Antivirus Management
- Alarm Configuration Management
- Tag Management
- IPS Management
-
Firewall Management
- Appendix
- SDK Reference
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF, Advanced Anti-DDoS, and CFW Be Deployed Together?
- Can CFW Protect Resources Across Enterprise Projects?
- How Long Are CFW Logs Stored by Default?
- Regions and AZs
-
Troubleshooting
- What Do I Do If Service Traffic is Abnormal?
- Why Are Traffic and Attack Logs Incomplete?
- Why Does a Protection Rule Not Take Effect?
- What Do I Do If IPS Blocks Normal Services?
- Why Is No Data Displayed on the Access Control Logs Page?
- Why Is the IP Address Translated Using NAT64 Blocked?
- Why Some Permissions Become Invalid After a System Policy Is Granted to an Enterprise Project?
- What Do I Do If a Message Indicating Insufficient Permissions Is Displayed When I Configure LTS Logs?
-
Network Traffic
- How Do I Calculate the Number of Protected VPCs and the Peak Protection Traffic at the VPC Border?
- How Does CFW Collect Traffic Statistics?
- What Is the Protection Bandwidth Provided by CFW?
- What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?
- What Are the Differences Between the Data Displayed in Traffic Trend Module and the Traffic Analysis Page?
- How Do I Verify the Validity of an Outbound HTTP/HTTPS Domain Protection Rule?
- How Do I Obtain the Real IP Address of an Attacker?
- What Do I Do If a High Traffic Warning Is Received?
-
About the Product
- Videos
-
More Documents
-
User Guide (Ankara Region)
- Product Overview
- Checking the Dashboard
- Creating Cloud Firewall
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF and CFW Be Deployed Together?
- Troubleshooting
- Network Traffic
-
About the Product
- Change History
- API Reference (Ankara Region)
-
User Guide (Ankara Region)
- General Reference
Copied.
Using CFW to Protect VPCs Across Accounts
Application Scenarios
Protect resources across accounts. For example, different departments in an enterprise use different accounts but need to share CFW protection policies.
This section describes how to use CFW to protect the VPC of account A and add the VPC of another account to CFW.
Solution Overview
VPC border protection has been enabled for account A for a period of time, and you need to add the VPCs of accounts B and C for protection. The solution is as follows:
Account A shares an enterprise router with accounts B and C. Accounts B and C add attachments to the enterprise router. Account A accepts the attachments in the enterprise router and adds associations and propagations. Accounts B and C add routes to their VPCs to configure access for protection. In this way, CFW protection policies will protect the VPC resources of accounts B and C as well.


Resource and Cost Planning
Resource |
Description |
Quantity |
Cost |
---|---|---|---|
Enterprise Router |
An enterprise router routes traffic between VPC and CFW. |
1 (existing) |
For details about billing rules, see Enterprise Router Billing. |
Cloud Firewall (CFW) |
Only the CFW professional edition provides VPC border protection. |
1 (existing) |
For details about billing rules, see CFW Billing. |
Virtual Private Cloud (VPC) |
Protected resource. |
1 |
For details about billing rules, see VPC Billing. |
Adding VPCs of Another Account to CFW
VPC border protection has been enabled for account A (for details, see Configuring a Protection Rule to Protect Traffic Between Two VPCs) and has been running for a period of time. To add the VPCs of accounts B and C to protection, perform the following steps:
- Use account A to share the enterprise router with accounts B and C. For details, see Creating a Sharing.
- Use accounts B and C to add attachments to the enterprise router. For details, see Creating a VPC Attachment.
NOTE:
- One attachment needs to be added for each VPC.
- In the following example, account B has a VPC named VPC1 and an attachment named VPC_B. Account C has a VPC named VPC2 and an attachment named VPC_C.
- Use account A to configure the route table.
- Accept the attachment requests. For details, see Accepting an Attachment Request.
- Add associations.
Click an enterprise router and click the Route Tables tab. On the page that is displayed, select the association route table (er-RT1), click the Associations tab, and click Create Association.
NOTE:
How to identify the association route table: The association route table is used to transmit traffic from VPC to CFW. The current configurations are as follows:- Associations tab (having multiple attachments):
- Attachment Type: VPC
- Attachment: connections to multiple VPCs under account A
- Key parameters on the Routes tab:
- Attachment Type: CFW instance
- Next Hop: firewall connection (cfw-er-auto-attach)
This section uses account B as an example to describe how to add VPCs. If you need to add multiple (for example, three) VPCs, you need to add the corresponding number (for example, three) of associations.
- Attachment Type: VPC
- Attachment: Select the VPC attachment of account B, that is, VPC_B.
NOTE:
In this case, the configurations of the association route table are as follows:
- Associations tab (having multiple attachments + VPC_B):
- Attachment Type: VPC
- Attachment: attachments of VPCs of accounts A and B
- Key parameters on the Routes tab:
- Attachment Type: CFW instance
- Next Hop: firewall connection (cfw-er-auto-attach)
- Associations tab (having multiple attachments):
- Add propagations.
Select the propagation route table (er-RT2), click the Propagations tab, and click Create Propagation.
NOTE:
How to identify the propagation route table: The propagation route table is used to transmit traffic from CFW to VPC. The current configurations are as follows:- Key parameters on the Associations tab:
- Attachment Type: CFW instance
- Attachment: firewall connection (cfw-er-auto-attach)
- Propagations tab (having multiple propagations):
- Attachment Type: VPC
- Attachment: connections to multiple VPCs under account A
This section uses account B as an example to describe how to add VPCs. If you need to add multiple (for example, three) VPCs, you need to add the corresponding number (for example, three) of propagations.
- Attachment Type: VPC
- Attachment: Select the VPC attachment of account B, that is, VPC_B.
NOTE:
In this case, the configurations of the propagation route table are as follows:
- Key parameters on the Associations tab:
- Attachment Type: CFW instance
- Attachment: firewall connection (cfw-er-auto-attach)
- Propagations tab (having multiple propagations + VPC_B):
- Attachment Type: VPC
- Attachment: attachments of VPCs of accounts A and B
- Key parameters on the Associations tab:
- Use accounts B and C to configure VPC route tables.
For example, to protect traffic between VPC1 and VPC2, configure the route of VPC1 to point to VPC2 and the route of VPC2 to point to VPC1.
- Return to the Enterprise Router page. In the navigation pane on the left, choose Network > Virtual Private Cloud > Route Tables.
- In the Name/ID column, click the route table name of a VPC. The Summary page is displayed.
- Click Add Route and configure parameters as follows:
- Add a route to VPC1 of account B:
- Destination Type: Select IP address.
- Destination: Enter the CIDR block of VPC2.
- Next Hop Type: Enterprise Router
- Add a route to VPC2 of account C:
- Destination Type: Select IP address.
- Destination: Enter the CIDR block of VPC1.
- Next Hop Type: Enterprise Router
- Add a route to VPC1 of account B:
- Configure a protection policy.
- Configure protection rules, blacklists, and whitelists to control traffic. For details, see Access Control Policy Overview .
- Configure attack defense to detect and protect traffic. For details, see Attack Defense Overview .
NOTE:
By default, VPC resources connected to the same enterprise router use the protection policies of the CFW instance bound to the enterprise router.
- View log information. For details, see Protection Log Overview.
Reference
To protect EIP resources across accounts, see Using CFW to Protect EIPs Across Accounts.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot