Restoring the Enterprise Router Configuration After VPC Border Protection Is Permanently Disabled

Scenario

If you no longer need VPC border traffic protection, manually restore the configuration of the enterprise router after disabling VPC border protection.

This section describes how to restore enterprise router configurations. After the restoration, traffic will be transmitted from VPC1 to VPC2 through the enterprise router without passing through CFW.

If you disable VPC protection and restore the enterprise router configuration, CFW will not protect the traffic between VPCs. Exercise caution when performing this operation.

Restoring Enterprise Router Configurations

1. Disable VPC border firewall protection. For details, see Disabling VPC Border Protection.
2. In the upper left corner, click and choose Networking > Enterprise Router. Click Manage Route Table.
3. Configure propagation routes (automatically generated after propagation is configured) in the association route table.
   1. On the Routes tab page of the association route table, click Create Route. Set Destination Address and Next Hop to those of the protected VPC specified in the configuration of the propagation route table.
      • Association route table: A route table that routes traffic from a VPC to CFW.
        1. Configure associations. On the route table configuration page, select the association table, click the Associations tab. On the displayed page, click Create Association. Set the parameters and click OK.

           Create at least two associations. An association is required for each protected VPC you add.

           For example, select attachment vpc-1 for VPC1 and vpc-2 for VPC2. To add VPC3 for protection, add an association and select attachment vpc-3.

           Figure 1 Creating an association
           

           Table 1 Association parameters

           Parameter	Description
           Attachment Type	Select VPC.
           Attachment	Select an item from the Attachment drop-down list.

        2. Configure routes. Click the Routes tab and click Create Route. Configure the parameters and click OK. Create routes as needed and configure parameters.
           Figure 2 Creating a route
           

           Table 2 Route parameters

           Parameter	Description
           Destination	Set the destination address. If 0.0.0.0/0 is configured, all the traffic (IPv4) of the VPC is protected by CFW. If a CIDR block is configured, the traffic of the CIDR block is protected by CFW.
           Blackhole Route	You are advised to disable this function. If it is enabled, the packets from a route that matches the destination address of the blackhole route will be discarded.
           Attachment Type	Set Attachment Type to CFW instance.
           Next Hop	Select the automatically generated firewall attachment cfw-er-auto-attach.
           Description	(Optional) Description of a route.

      • Propagation route table: A route table that transmits traffic from CFW to VPC.
        1. Configure an association. On the route table configuration page, click the Associations tab, click Create Association, and configure parameters.
           Figure 3 Creating an association
           

           Table 3 Association parameters

           Parameter	Description
           Attachment Type	Set Attachment Type to CFW instance.
           Attachment	Select the automatically generated firewall attachment cfw-er-auto-attach.

        2. Configure a propagation. Click the Propagations tab, click Create Propagation, and configure parameters.
           Figure 4 Creating a propagation
           

           Table 4 Propagation parameters

           Parameter	Description
           Attachment Type	Select VPC.
           Attachment	Select an item from the Attachment drop-down list.

           • Add at least two propagations. A propagation is required for each protected VPC you add.

             For example, select attachment vpc-1 for VPC1 and vpc-2 for VPC2. To add VPC3 for protection, add a propagation and select attachment vpc-3.

           • After a propagation is created, its route information will be extracted to the route table of the enterprise router, and a propagation route will be generated. In the same route table, the destinations of different propagation routes may be the same, and cannot be modified or deleted.
           • You can add static routes for the attachments in a route table. The destinations of static routes in a table must be unique, and can be modified or deleted.
           • If a static route and a propagation route in the same route table happen to use the same destination, the static route takes effect first.
      • The number of routes added to the association route table must be the same as the number of routes displayed in the propagation route table.
   2. (Optional) Delete the propagation route table.
      

      This step is optional. Traffic will be transmitted from VPC1 to VPC2 through the enterprise router even if the propagation route table is not deleted.

   3. For more information about how to delete a CFW connection, see Submitting a Service Ticket.