- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Creating a User Group and Granting Permissions
- Checking the Dashboard
- Purchasing and Changing the Specifications of CFW
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
- Enabling NAT Gateway Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
- Permissions Management
- Using Cloud Eye to Monitor CFW
- CTS Auditing
-
Best Practices
- CFW Best Practice Summary
- Purchasing and Querying CFW via API
- Migrating Security Policies to CFW in Batches
- Configuration Suggestions for Using CFW with WAF, Advanced Anti-DDoS, and CDN
- Allowing Internet Traffic Only to a Specified Port
- Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name
- Using CFW to Defend Against Network Attacks
- Configuring a Protection Rule to Protect Traffic Between Two VPCs
- Configuring a Protection Rule to Protect SNAT Traffic
- Using CFW to Protect Enterprise Resources
- Using CFW to Protect EIPs Across Accounts
- Using CFW to Protect VPCs Across Accounts
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
-
Firewall Management
- Creating a Firewall
- Obtaining the Status of a CFW Task
- Deleting a Firewall
- Querying the Firewall List
- Changing the East-West Firewall Protection Status
- Querying Firewall Details
- Obtaining East-West Firewall Information
- Creating an East-West Firewall
- Querying the Number of Protected VPCs
- Creating a Tag
- Deleting a Tag
- EIP Management
-
ACL Rule Management
- Creating an ACL Rule
- Deleting an ACL Rule
- Deleting ACL Rules in Batches
- Deleting the Number of Rule Hits
- Updating an ACL Rule
- Updating Rule Actions in Batches
- Setting the Priority of an ACL Protection Rule
- Querying a Protection Rule
- Querying Rule Tags
- Obtaining the Number of Rule Hits
- Viewing the Region List
- Checking the ACL Import Status
- Blacklist/Whitelist Management
- Address Group Management
- Service Group Management
-
Domain Name Resolution and Domain Name Group Management
- Adding a Domain Name Group
- Deleting a Domain Name Group
- Updating a Domain Name Group
- Updating the DNS Server List
- Querying the Domain Name Group List
- Querying the DNS Server List
- Querying an IP Address for Domain Name Resolution
- Obtain the list of domain names in a domain name group
- Adding a Domain Name List
- Deleting a Domain Name List
- Viewing Domain Group Details
- Obtaining the DNS Resolution Result of a Domain Name
- Deleting Domain Groups in Batches
- IPS management
- Log Management
- Packet Capture Management
- Antivirus Management
- Alarm Configuration Management
- Tag Management
- IPS Management
-
Firewall Management
- Appendix
- SDK Reference
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF, Advanced Anti-DDoS, and CFW Be Deployed Together?
- Can CFW Protect Resources Across Enterprise Projects?
- How Long Are CFW Logs Stored by Default?
- Regions and AZs
-
Troubleshooting
- What Do I Do If Service Traffic is Abnormal?
- Why Are Traffic and Attack Logs Incomplete?
- Why Does a Protection Rule Not Take Effect?
- What Do I Do If IPS Blocks Normal Services?
- Why Is No Data Displayed on the Access Control Logs Page?
- Why Is the IP Address Translated Using NAT64 Blocked?
- Why Some Permissions Become Invalid After a System Policy Is Granted to an Enterprise Project?
- What Do I Do If a Message Indicating Insufficient Permissions Is Displayed When I Configure LTS Logs?
-
Network Traffic
- How Do I Calculate the Number of Protected VPCs and the Peak Protection Traffic at the VPC Border?
- How Does CFW Collect Traffic Statistics?
- What Is the Protection Bandwidth Provided by CFW?
- What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?
- What Are the Differences Between the Data Displayed in Traffic Trend Module and the Traffic Analysis Page?
- How Do I Verify the Validity of an Outbound HTTP/HTTPS Domain Protection Rule?
- How Do I Obtain the Real IP Address of an Attacker?
- What Do I Do If a High Traffic Warning Is Received?
-
About the Product
- Videos
-
More Documents
-
User Guide (Ankara Region)
- Product Overview
- Checking the Dashboard
- Creating Cloud Firewall
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF and CFW Be Deployed Together?
- Troubleshooting
- Network Traffic
-
About the Product
- Change History
- API Reference (Ankara Region)
-
User Guide (Ankara Region)
- General Reference
Copied.
Adding a Domain Name Group
A domain name group is a collection of multiple domain names or wildcard domain names. You can configure domain name groups to protect domains in batches.
- Application Domain Name Group: Supports the protection for domain names or wildcard domain names. Application-layer protocols such as HTTP/HTTPS are supported. Domain names are used for matching.
- Network Domain Name Group: Supports protection for one or multiple domain names. Applies to network-layer protocols and supports all protocols. The resolved IP addresses are used for matching.
Matching Policy
- Application Domain Name Group: CFW compares the HOST field in sessions with the application domain names. If they are consistent, the corresponding protection rule is hit.
- Network Domain Name Group: CFW obtains the IP addresses resolved by DNS every 15 seconds, if the four-tuple of a session matches the network domain name rule and the resolved address has been saved (that is, the IP address has been obtained from the DNS server), the corresponding protection rule is hit.
A single domain name can resolve up to 1,000 IP addresses. Each domain group can resolve up to 1,500 IP addresses. If the number of resolution results reaches the upper limit, no domain names can be added to the domain group.
You are advised to use the application domain name group for the domain names that have a large number of mapping addresses or rapidly changing mapping results.
Constraints
- Domain names in Chinese cannot be added to domain name groups.
- The domain names in a domain name group can be referenced by protection rules for up to 40,000 times, and wildcard domain names can be referenced for up to 2,000 times.
- A firewall instance can have up to 500 domain name groups.
- A firewall instance can have up to 2,500 domain names.
- A domain name group can have up to 1,500 domain names.
- A firewall instance can have up to 1,000 domain names.
- A network domain name group can have up to 15 domain names.
- Each domain name group can resolve up to 1,500 IP addresses.
- Each domain name can resolve up to 1,000 IP addresses.
Adding a Domain Name Group
- Log in to the management console.
- In the navigation pane on the left, click
and choose Security > Cloud Firewall. The Dashboard page will be displayed.
- (Optional) Switch to another firewall instance: Select a firewall from the drop-down list in the upper left corner of the page.
- In the navigation pane, choose Access Control > Object Groups.
- (Optional) To add a network domain group, click the Network Domain Name Group tab.
- Click the Domain Name Groups tab. Click Add Domain Name Group and configure parameters.
Table 1 Domain name group parameters Parameter
Description
Domain Name Group Type
Application/Network
Group Name
Name of a user-defined domain name group.
Description
(Optional) Enter remarks for the domain name group.
Domain Name
Enter one or multiple domain names.
- You can enter a multi-level single domain name (for example, top-level domain name example.com and level-2 domain name www.example.com) or a wildcard domain name (*.example.com).
- Multiple domain names are separated by commas (,), semicolons (;), line breaks, or spaces.
NOTE:
Domain names must be unique.
Adding a Domain Name to a Domain Group
- Log in to the management console.
- In the navigation pane on the left, click
and choose Security > Cloud Firewall. The Dashboard page will be displayed.
- (Optional) Switch to another firewall instance: Select a firewall from the drop-down list in the upper left corner of the page.
- In the navigation pane, choose Access Control > Object Groups.
- Click the Domain Name Groups tab. Click the name of a domain name group. The Domain Name Groups dialog box is displayed.
- Click Add Domain and enter domain name information.
You can click Add to add multiple domain names.
- Confirm the information and click OK.
Related Operation
- Exporting domain name groups: Click Export above the list and select a data range.
- Batch deleting domain names: Select domain names in the domain name list and click Delete above the list.
- Editing a domain name group: Click the name of a domain name group and modify parameters.
- A domain name group takes effect only after it is set in a protection rule. For more information, see Adding Protection Rules to Block or Allow Traffic.
- Viewing the IP addresses resolved by a domain name group of the network domain name group type: Click a domain name group name to go to the Basic Information page, and click IP address in the Operation column of the domain name list.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot