- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Creating a User Group and Granting Permissions
- Checking the Dashboard
- Purchasing and Changing the Specifications of CFW
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
- Enabling NAT Gateway Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
- Permissions Management
- Using Cloud Eye to Monitor CFW
- CTS Auditing
-
Best Practices
- CFW Best Practice Summary
- Purchasing and Querying CFW via API
- Migrating Security Policies to CFW in Batches
- Configuration Suggestions for Using CFW with WAF, Advanced Anti-DDoS, and CDN
- Allowing Internet Traffic Only to a Specified Port
- Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name
- Using CFW to Defend Against Network Attacks
- Configuring a Protection Rule to Protect Traffic Between Two VPCs
- Configuring a Protection Rule to Protect SNAT Traffic
- Using CFW to Protect Enterprise Resources
- Using CFW to Protect EIPs Across Accounts
- Using CFW to Protect VPCs Across Accounts
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
-
Firewall Management
- Creating a Firewall
- Obtaining the Status of a CFW Task
- Deleting a Firewall
- Querying the Firewall List
- Changing the East-West Firewall Protection Status
- Querying Firewall Details
- Obtaining East-West Firewall Information
- Creating an East-West Firewall
- Querying the Number of Protected VPCs
- Creating a Tag
- Deleting a Tag
- EIP Management
-
ACL Rule Management
- Creating an ACL Rule
- Deleting an ACL Rule
- Deleting ACL Rules in Batches
- Deleting the Number of Rule Hits
- Updating an ACL Rule
- Updating Rule Actions in Batches
- Setting the Priority of an ACL Protection Rule
- Querying a Protection Rule
- Querying Rule Tags
- Obtaining the Number of Rule Hits
- Viewing the Region List
- Checking the ACL Import Status
- Blacklist/Whitelist Management
- Address Group Management
- Service Group Management
-
Domain Name Resolution and Domain Name Group Management
- Adding a Domain Name Group
- Deleting a Domain Name Group
- Updating a Domain Name Group
- Updating the DNS Server List
- Querying the Domain Name Group List
- Querying the DNS Server List
- Querying an IP Address for Domain Name Resolution
- Obtain the list of domain names in a domain name group
- Adding a Domain Name List
- Deleting a Domain Name List
- Viewing Domain Group Details
- Obtaining the DNS Resolution Result of a Domain Name
- Deleting Domain Groups in Batches
- IPS management
- Log Management
- Packet Capture Management
- Antivirus Management
- Alarm Configuration Management
- Tag Management
- IPS Management
-
Firewall Management
- Appendix
- SDK Reference
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF, Advanced Anti-DDoS, and CFW Be Deployed Together?
- Can CFW Protect Resources Across Enterprise Projects?
- How Long Are CFW Logs Stored by Default?
- Regions and AZs
-
Troubleshooting
- What Do I Do If Service Traffic is Abnormal?
- Why Are Traffic and Attack Logs Incomplete?
- Why Does a Protection Rule Not Take Effect?
- What Do I Do If IPS Blocks Normal Services?
- Why Is No Data Displayed on the Access Control Logs Page?
- Why Is the IP Address Translated Using NAT64 Blocked?
- Why Some Permissions Become Invalid After a System Policy Is Granted to an Enterprise Project?
- What Do I Do If a Message Indicating Insufficient Permissions Is Displayed When I Configure LTS Logs?
-
Network Traffic
- How Do I Calculate the Number of Protected VPCs and the Peak Protection Traffic at the VPC Border?
- How Does CFW Collect Traffic Statistics?
- What Is the Protection Bandwidth Provided by CFW?
- What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?
- What Are the Differences Between the Data Displayed in Traffic Trend Module and the Traffic Analysis Page?
- How Do I Verify the Validity of an Outbound HTTP/HTTPS Domain Protection Rule?
- How Do I Obtain the Real IP Address of an Attacker?
- What Do I Do If a High Traffic Warning Is Received?
-
About the Product
- Videos
-
More Documents
-
User Guide (Ankara Region)
- Product Overview
- Checking the Dashboard
- Creating Cloud Firewall
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF and CFW Be Deployed Together?
- Troubleshooting
- Network Traffic
-
About the Product
- Change History
- API Reference (Ankara Region)
-
User Guide (Ankara Region)
- General Reference
Copied.
Attack Defense Overview
CFW can defend against network attacks and virus files. You are advised to set Protection Mode to Intercept in a timely manner.
Prerequisites
- For details about how to enable EIP traffic protection, see Enabling Internet Border Traffic Protection.
- For details about how to enable VPC traffic protection, see Enabling VPC Border Traffic Protection.
Defense Against Network Attacks and Virus Files
- IPS provides you with basic protection functions, and, with many years of attack defense experience, it detects and defends against a wide range of common network attacks and effectively protects your assets.
- IPS provides four protection modes. For details about how to configure it, see Adjusting the IPS Protection Mode to Block Network Attacks.
- Observe: Attacks are detected and recorded in logs but are not intercepted.
- Intercept: Attacks and abnormal IP address access are automatically intercepted.
- Intercept mode - loose: The protection granularity is coarse. In this mode, only attacks with high threat and high certainty are blocked.
- Intercept mode - moderate: The protection granularity is medium. This mode meets protection requirements in most scenarios.
- Intercept mode - strict: The protection granularity is fine-grained, and all attack requests are intercepted.
- IPS provides multiple types of rule libraries. For details, see Table 1. Different rules are enabled for different interception modes. For details, see Default Actions of Rule Groups in Different Protection Modes.
Table 1 Intrusion prevention rule libraries Function
Description
Check Type
Configuration Method
Basic defense
A built-in rule library. It covers common network attacks and provides basic protection capabilities for your assets.
- Scan for threats and scan vulnerabilities.
- Check whether traffic contains phishing, Trojans, worms, hacker tools, spyware, password attacks, vulnerability attacks, SQL injection attacks, XSS attacks, and web attacks.
- Checks whether there are protocol anomalies, buffer overflow, access control, suspicious DNS activities, and other suspicious behaviors in traffic.
For details about how to view and modify rule library settings, see Modifying the Protection Action of an Intrusion Prevention Rule.
Virtual patch
Hot patches are provided for IPS at the network layer to intercept high-risk remote attacks in real time and prevent service interruption during vulnerability fixing.
Updated rules are added to the virtual patch library first. You can determine whether to add the rules to the basic defense library.
To add defense rules, enable this function to apply virtual patch rules. The protection action can be manually modified.
Custom IPS signature (supported only by the professional edition)
If the built-in rule library cannot meet your requirements, you can customize signature rules.
The check types are the same as those of Basic defense.
Signature rules of the HTTP, TCP, UDP, POP3, SMTP and FTP protocols can be added.
For details, see Customizing IPS Signatures.
- IPS provides four protection modes. For details about how to configure it, see Adjusting the IPS Protection Mode to Block Network Attacks.
- Sensitive directory scan can defend against scanning attacks on sensitive directories on cloud servers. For details, see Enabling Sensitive Directory Scan Defense.
- Reverse shell detection can defend against network attacks in reverse shell mode. For details, see Enabling Reverse Shell Defense.
- Antivirus can identify and process virus-infected files through virus feature detection to prevent data damage, permission change, and system breakdown caused by virus-infected files. HTTP, SMTP, POP3, FTP, IMAP4 and SMB protocols can be checked.
For details about antivirus, see Blocking Virus-infected Files.
Protection Actions
- Observe: The firewall records the traffic that matches the current rule in Attack Event Logs and does not block the traffic.
- Intercept: The firewall records the traffic that matches the current rule in Attack Event Logs and blocks it.
- Disable: The firewall does not log or block the traffic that matches the current rule.
References
For details about logs, see Attack Event Logs.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot