- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Creating a User Group and Granting Permissions
- Checking the Dashboard
- Purchasing and Changing the Specifications of CFW
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
- Enabling NAT Gateway Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
- Permissions Management
- Using Cloud Eye to Monitor CFW
- CTS Auditing
-
Best Practices
- CFW Best Practice Summary
- Purchasing and Querying CFW via API
- Migrating Security Policies to CFW in Batches
- Configuration Suggestions for Using CFW with WAF, Advanced Anti-DDoS, and CDN
- Allowing Internet Traffic Only to a Specified Port
- Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name
- Using CFW to Defend Against Network Attacks
- Configuring a Protection Rule to Protect Traffic Between Two VPCs
- Configuring a Protection Rule to Protect SNAT Traffic
- Using CFW to Protect Enterprise Resources
- Using CFW to Protect EIPs Across Accounts
- Using CFW to Protect VPCs Across Accounts
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
-
Firewall Management
- Creating a Firewall
- Obtaining the Status of a CFW Task
- Deleting a Firewall
- Querying the Firewall List
- Changing the East-West Firewall Protection Status
- Querying Firewall Details
- Obtaining East-West Firewall Information
- Creating an East-West Firewall
- Querying the Number of Protected VPCs
- Creating a Tag
- Deleting a Tag
- EIP Management
-
ACL Rule Management
- Creating an ACL Rule
- Deleting an ACL Rule
- Deleting ACL Rules in Batches
- Deleting the Number of Rule Hits
- Updating an ACL Rule
- Updating Rule Actions in Batches
- Setting the Priority of an ACL Protection Rule
- Querying a Protection Rule
- Querying Rule Tags
- Obtaining the Number of Rule Hits
- Viewing the Region List
- Checking the ACL Import Status
- Blacklist/Whitelist Management
- Address Group Management
- Service Group Management
-
Domain Name Resolution and Domain Name Group Management
- Adding a Domain Name Group
- Deleting a Domain Name Group
- Updating a Domain Name Group
- Updating the DNS Server List
- Querying the Domain Name Group List
- Querying the DNS Server List
- Querying an IP Address for Domain Name Resolution
- Obtain the list of domain names in a domain name group
- Adding a Domain Name List
- Deleting a Domain Name List
- Viewing Domain Group Details
- Obtaining the DNS Resolution Result of a Domain Name
- Deleting Domain Groups in Batches
- IPS management
- Log Management
- Packet Capture Management
- Antivirus Management
- Alarm Configuration Management
- Tag Management
- IPS Management
-
Firewall Management
- Appendix
- SDK Reference
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF, Advanced Anti-DDoS, and CFW Be Deployed Together?
- Can CFW Protect Resources Across Enterprise Projects?
- How Long Are CFW Logs Stored by Default?
- Regions and AZs
-
Troubleshooting
- What Do I Do If Service Traffic is Abnormal?
- Why Are Traffic and Attack Logs Incomplete?
- Why Does a Protection Rule Not Take Effect?
- What Do I Do If IPS Blocks Normal Services?
- Why Is No Data Displayed on the Access Control Logs Page?
- Why Is the IP Address Translated Using NAT64 Blocked?
- Why Some Permissions Become Invalid After a System Policy Is Granted to an Enterprise Project?
- What Do I Do If a Message Indicating Insufficient Permissions Is Displayed When I Configure LTS Logs?
-
Network Traffic
- How Do I Calculate the Number of Protected VPCs and the Peak Protection Traffic at the VPC Border?
- How Does CFW Collect Traffic Statistics?
- What Is the Protection Bandwidth Provided by CFW?
- What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?
- What Are the Differences Between the Data Displayed in Traffic Trend Module and the Traffic Analysis Page?
- How Do I Verify the Validity of an Outbound HTTP/HTTPS Domain Protection Rule?
- How Do I Obtain the Real IP Address of an Attacker?
- What Do I Do If a High Traffic Warning Is Received?
-
About the Product
- Videos
-
More Documents
-
User Guide (Ankara Region)
- Product Overview
- Checking the Dashboard
- Creating Cloud Firewall
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF and CFW Be Deployed Together?
- Troubleshooting
- Network Traffic
-
About the Product
- Change History
- API Reference (Ankara Region)
-
User Guide (Ankara Region)
- General Reference
Copied.
Purchasing Yearly/Monthly Cloud Firewall
Yearly/Monthly payment is a prepaid billing mode and is cost-effective for long-term use.
You can purchase multiple firewalls in a region and assign them different resources and policies.
Prerequisites
The current account has the BSS Administrator and CFW FullAccess permissions.
Constraints
- CFW can be used only in the region where it was purchased. To use CFW in another region, switch to that region and purchase it. For details about the regions where CFW is available, see Function Overview.
Editions
- Yearly/Monthly CFW instances support the standard edition and professional edition.
- Pay-per-use CFW instances support the professional edition.
For details about the feature differences between editions, see Editions.
- Standard edition
Suitable for small- and medium-sized enterprises that need to defend against cybersecurity threats like network intrusions and server compromises, or need to obtain Multi-Layer Protection Scheme (MLPS) certification.
- Professional edition
Suitable for large and medium-sized enterprises that need to defend against network intrusions and server compromises, control internal network security, obtain MLPS certification, or have key event assurance requirements.
Purchasing CFW
Perform the following operations to purchase a firewall instance of the desired edition.
Standard Edition Firewalls
- Log in to the management console.
- Click
in the upper left corner of the management console and select a region or project.
- In the navigation pane on the left, click
and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
- Click Buy CFW and configure parameters on the Buy CFW page. For more information, see Table 1.
Table 1 Parameters for purchasing the standard edition CFW Parameter
Description
Billing Mode
Yearly/Monthly
Region
Region where the CFW is to be purchased.
NOTICE:CFW can be used in the selected region only. To use CFW in another region, switch to the corresponding region and then purchase it. For details about the regions where CFW is available, see Can CFW Be Used Across Clouds or Regions?
Edition
-
Select the standard edition.
Add EIP Protection Capacity
(Optional) Number of additional EIPs to be protected. Value range: 0 to 2000.
NOTE:
Configure additional capacities to purchase. For example, 20 EIPs are protected by the standard edition (included in the package fee) by default. If you have 65 EIPs, you only need to enter 45.
Add Internet Border Protection Bandwidth
(Optional) Additional peak inbound or outbound traffic. The value range is 0 to 50,000 Mbit/s per month. (The value must be an integer multiple of 5.)
NOTE:
- Configure additional capacities to purchase. For example, up to 10 Mbit/s is protected by the standard edition (included in the package fee) by default. If your protection traffic is 200 Mbit/s, you only need to enter 190.
- The protection traffic is determined based on the maximum inbound or outbound traffic, whichever is higher.
Advanced Settings
Firewall Name
Firewall name.
It must meet the following requirements:- Only letters (A to Z and a to z), numbers (0 to 9), spaces, and the following characters are allowed: -_
- The value can contain 1 to 48 characters.
Enterprise Project
Enterprise project. Select the enterprise project that you belong to from the drop-down list. The purchased CFW instance then belongs to that enterprise project and can protect the resources of all the enterprise projects under the current account.
This option is only available if you have enabled enterprise projects, or if you are logged in using an enterprise master account. To use this function, enable Enterprise Center. You can use an enterprise project to centrally manage your cloud resources and members by project.
NOTE:
Value default indicates the default enterprise project. Resources that are not allocated to any enterprise projects under your account are displayed in the default enterprise project.
Tags
You can use a tag for multiple cloud resources. You are advised to predefine tags in TMS. For details, see Resource Tag Overview.
If your organization has configured a tag policy for CFW, you need to add tags in compliance with the policy. If a tag does not comply with the tag policies, firewall instance creation may fail. Contact your organization administrator to learn more about tag policies.
Required Duration
Service duration.
After selecting a duration, you can select Auto-renew. If you select and agree to service auto renewal, the system automatically generates a renewal order based on the subscription period and renews the service before it expires. Note the Auto-Renewal Rules when enabling auto-renewal.
- Confirm the information and click Buy Now.
- Confirm the order details, select I have read and agreed to the Huawei Cloud Firewall Service Statement, and click Next.
- Select a payment method and pay for your order.
Professional Edition Firewalls
- Log in to the management console.
- Click
in the upper left corner of the management console and select a region or project.
- In the navigation pane on the left, click
and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
- Click Buy CFW and configure parameters on the Buy CFW page. For more information, see Table 2.
Table 2 Parameters for purchasing a professional edition CFW Parameter
Description
Basic settings
Billing Mode
Yearly/Monthly
Region
Region where the CFW is to be purchased.
NOTICE:CFW can be used in the selected region only. To use CFW in another region, switch to the corresponding region and then purchase it. For details about the regions where CFW is available, see Can CFW Be Used Across Clouds or Regions?
Edition
-
Edition. Select the professional edition.
Add EIP Protection Capacity
(Optional) Number of additional EIPs to be protected. Value range: 0 to 2,000.
NOTE:
Configure additional capacities to purchase. For example, 50 EIPs are protected by the standard edition (included in the package fee) by default. If you have 65 EIPs, you only need to enter 15.
Add Internet Border Protection Bandwidth
(Optional) Additional peak inbound or outbound traffic. The value range is 0 to 50,000 Mbit/s per month. (The value must be an integer multiple of 5.)
NOTE:
- Configure additional capacities to purchase. For example, up to 50 Mbit/s per month is protected by the standard edition (included in the package fee) by default. If your protection traffic is 200 Mbit/s per month, you only need to enter 150.
- The protection traffic is determined based on the maximum inbound or outbound traffic, whichever is higher.
Add VPCs
(Optional) Select the number of VPCs to be expanded. The value ranges from 0 to 1,000.
NOTE:
- Only the professional edition supports inter-VPC protection.
- By default, two VPCs are protected by the professional edition (included in the package fee). If you have three VPCs, you only need to enter 1.
- For each VPC you add, the protected peak traffic increases by 200 Mbit/s.
Advanced Settings
Enterprise Project
Enterprise project. Select the enterprise project that you belong to from the drop-down list. The purchased CFW instance then belongs to that enterprise project and can protect the resources of all the enterprise projects under the current account.
This option is only available if you have enabled enterprise projects, or if you are logged in using an enterprise master account. To use this function, enable Enterprise Center. You can use an enterprise project to centrally manage your cloud resources and members by project.
NOTE:
Value default indicates the default enterprise project. Resources that are not allocated to any enterprise projects under your account are displayed in the default enterprise project.
Firewall Name
Firewall name.
It must meet the following requirements:- Only letters (A to Z and a to z), numbers (0 to 9), spaces, and the following characters are allowed: -_
- The value can contain 1 to 48 characters.
Tags
You can use a tag for multiple cloud resources. You are advised to predefine tags in TMS. For details, see Resource Tag Overview.
If your organization has configured a tag policy for CFW, you need to add tags in compliance with the policy. If a tag does not comply with the tag policies, firewall instance creation may fail. Contact your organization administrator to learn more about tag policies.
Required Duration
Service duration.
After selecting a duration, you can select Auto-renew. If you select and agree to service auto renewal, the system automatically generates a renewal order based on the subscription period and renews the service before it expires. Note the Auto-Renewal Rules when enabling auto-renewal.
- Confirm the information and click Buy Now.
- Confirm the order details, select I have read and agreed to the Huawei Cloud Firewall Service Statement, and click Next.
- Select a payment method and pay for your order.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot