Configuring the Enterprise Router to Divert Traffic to CFW

Step 1: Add VPC Attachments to the Enterprise Router

After you perform the operations in Creating a VPC Border Firewall, you need to add VPC attachments to the enterprise router. In this scenario, you need to create two types of attachments:

• Type 1: used for traffic forwarding between the enterprise router and CFW.

  After a firewall is created, a CFW attachment (name: cfw-er-auto-attach, attachment type: CFW) is automatically generated on the enterprise router. This attachment is used to forward traffic between the enterprise router and CFW. You do not need to manually create the attachment.

  Figure 2 Attachment
  
• Type 2: used for traffic forwarding between the VPC and the enterprise router. The operations are as follows:

  Each time a protected VPC is added, an attachment needs to be added. In this example, add two attachments.

  1. Go to the VPC border firewall management page. In the resource list, click Edit Protected VPCs in the Operation column of the target resource. On the displayed page, click the Attachments tab on the enterprise router details page.
     Figure 3 Editing a protected VPC
     
  2. Create an attachment for VPC1.
     1. On the Attachments tab page of the enterprise router details page, click Create Attachment. The page for creating an attachment is displayed.
        Figure 4 Creating an attachment
        
     2. Configure basic information about the attachment as prompted.

        Table 2 Creating an attachment

        Parameter	Description	Example Value
        Name	Attachment name. The name: Must contain 1 to 64 characters. Can contain letters, numbers, underscores (_), hyphens (-), and periods (.).	er-attach-vpc1
        Attachment Type	Select VPC, indicating that a VPC is to be attached to the enterprise router.	VPC
        Attached Resource	Select the resource to be attached. VPC: Select the VPC to be connected to the enterprise router from the drop-down list. You can enter the VPC name to quickly find it. Subnet: Select the subnet of the VPC from the drop-down list. You can enter the subnet name to quickly find it.	VPC: vpc-01 Subnet: subnet-A01
        (Optional) Auto Add Routes	Determine whether to enable auto route addition. Enable this option if you want to automatically add routes (with this enterprise router as the next hop and 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as the destinations) to all route tables of the selected VPC. Do not enable this option if an existing route in the VPC route tables has a destination set to 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 because the routes will fail to be added. In this case, do not enable this option. After the enterprise router is created, manually add the routes by referring to Step 4: Manually Add Routes Pointing to the Enterprise Router in the VPC Route Tables. NOTE: This parameter is only displayed when a VPC attachment is created. It cannot be enabled after the VPC attachment is created. If IPv6 is enabled for a VPC attachment and Auto Add Routes is also enabled, the system automatically adds IPv4 routes to the VPC route tables but does not add IPv6 routes. You need to manually add IPv6 routes.	Disabled
        (Optional) Tag	You can add tags when creating an attachment for easy categorization and quick search. For details about tags, see Tag Overview.	Tag key: test01 Tag value: 01
        (Optional) Description	Describe the attachment for easy identification.	-

     3. Click Create Now.

        The attachment list is displayed. If the status changes from Creating to Normal, the attachment is successfully created.

  3. Create an attachment for VPC2.
     1. On the Attachments tab page of the enterprise router details page, click Create Attachment. The page for creating an attachment is displayed.
        Figure 5 Creating an attachment
        
     2. Configure basic information about the attachment as prompted.

        Table 3 Creating an attachment

        Parameter	Description	Example Value
        Name	Attachment name. The name: Must contain 1 to 64 characters. Can contain letters, numbers, underscores (_), hyphens (-), and periods (.).	er-attach-vpc2
        Attachment Type	Select VPC, indicating that a VPC is to be attached to the enterprise router.	VPC
        Attached Resource	Select the resource to be attached. VPC: Select the VPC to be connected to the enterprise router from the drop-down list. You can enter the VPC name to quickly find it. Subnet: Select the subnet of the VPC from the drop-down list. You can enter the subnet name to quickly find it.	VPC: vpc-02 Subnet: subnet-A02
        (Optional) Auto Add Routes	Determine whether to enable auto route addition. Enable this option if you want to automatically add routes (with this enterprise router as the next hop and 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as the destinations) to all route tables of the selected VPC. Do not enable this option if an existing route in the VPC route tables has a destination set to 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 because the routes will fail to be added. In this case, do not enable this option. After the enterprise router is created, manually add the routes by referring to Step 4: Manually Add Routes Pointing to the Enterprise Router in the VPC Route Tables. NOTE: This parameter is only displayed when a VPC attachment is created. It cannot be enabled after the VPC attachment is created. If IPv6 is enabled for a VPC attachment and Auto Add Routes is also enabled, the system automatically adds IPv4 routes to the VPC route tables but does not add IPv6 routes. You need to manually add IPv6 routes.	Disabled
        (Optional) Tag	You can add tags when creating an attachment for easy categorization and quick search. For details about tags, see Tag Overview.	Tag key: test02 Tag value: 02
        (Optional) Description	Describe the attachment for easy identification.	-

     3. Click Create Now.

        The attachment list is displayed. If the status changes from Creating to Normal, the attachment is successfully created.

Step 2: Create and Configure Route Table 1 to Send VPC Traffic to CFW

1. Go to the VPC border firewall management page. In the resource list, click Edit Protected VPCs in the Operation column of the target resource. On the displayed page, click the Attachments tab on the enterprise router details page.
   Figure 6 Editing a protected VPC
   
2. Create route table 1.
   1. On the target enterprise router details page, click the Route Tables tab. On the displayed page, click Create Route Table.
      Figure 7 Creating a route table
      
   2. Configure basic information about the route table as prompted.

      Table 4 Creating route table 1

      Parameter	Description	Example Value
      Name	Route table name. It must meet the following requirements: Must contain 1 to 64 characters. Can contain letters, numbers, underscores (_), hyphens (-), and periods (.).	er-rtb-vpc-cfw-01
      (Optional) AS_Path Route Selection	Do not configure: The system compares AS_Path attributes for the routes during load balancing and prefers the route with the shortest AS_Path length. The AS_Path attribute records all AS numbers that a BGP route passes through from the local end to the destination in the vector order. The fewer the AS numbers recorded in the AS_Path attribute, the shorter the AS_Path length. Ignore same length AS_Path: The system skips comparing the AS_Path attributes during load balancing if their lengths are identical. AS_Path prevents BGP loops between ASs. If you select this option, there may be BGP loops.	Do not configure
      (Optional) Tag	You can add tags when creating a route table for easy categorization and quick search. For details about tags, see Tag Overview.	Tag key: test01 Tag value: 01
      (Optional) Description	Route table description	-

   3. Click OK.

      The route table list page is displayed. When the status changes from Creating to Normal, the route table is created.

3. Configure route table 1.
   1. On the route table settings page, select route table 1 (er-rtb-vpc-cfw-01 in this example). The Basic Information tab page of the route table is displayed.
   2. Create an association to associate VPC1 with route table 1 of the enterprise router.
      1. Click the Associations tab. Click Create Association and configure parameters as prompted.
         Figure 8 Creating an association
         

         Table 5 Creating an association

         Parameter	Description	Example Value
         Attachment Type	Select an attachment type. In this example, select VPC.	VPC
         Attachment	In the attachment drop-down list, select the attachment of VPC 1 to be protected. In this example, select er-attach-vpc1.	er-attach-vpc1

      2. Click OK.
   3. Create an association to associate VPC 2 with route table 1 of the enterprise router.
      1. Click the Associations tab. Click Create Association and configure parameters as prompted.
         Figure 9 Creating an association
         

         Table 6 Creating an association

         Parameter	Description	Example Value
         Attachment Type	Select an attachment type. In this example, select VPC.	VPC
         Attachment	Select the attachment of VPC 2 to be protected. In this example, select er-attach-vpc2.	er-attach-vpc2

      2. Click OK.
   4. Create a route to forward enterprise router traffic (the traffic sent from the VPC to the enterprise router) to CFW.
      1. Click the Routes tab. Click Create Route and configure the route as prompted.
         Figure 10 Creating a route
         

         Table 7 Creating a route

         Parameter	Description	Example Value
         Destination	Set the destination address. If 0.0.0.0/0 is configured, all the traffic (IPv4) of the VPC is protected by CFW. If a CIDR block is configured, the traffic of the CIDR block is protected by CFW.	192.168.2.0/24
         Blackhole Route	You are advised to disable this function. If it is enabled, the packets from a route that matches the destination address of the blackhole route will be discarded.	Keep it disabled.
         Attachment Type	Select an attachment type. In this example, select CFW instance.	CFW instance
         Next Hop	Select the automatically generated firewall attachment cfw-er-auto-attach.	cfw-er-auto-attach
         Description	(Optional) Description of a route.	-

      2. Click OK.

Step 3: Create and Configure Route Table 2 for Sending Traffic Protected by CFW to the VPC

1. Go to the VPC border firewall management page. In the resource list, click Edit Protected VPCs in the Operation column of the target resource. On the displayed page, click the Attachments tab on the enterprise router details page.
   Figure 11 Editing a protected VPC
   

2. Create a route table.
   1. On the target enterprise router details page, click the Route Tables tab. On the displayed page, click Create Route Table.
      Figure 12 Creating a route table
      
   2. Configure basic information about the route table as prompted.

      Table 8 Creating route table 2

      Parameter	Description	Example Value
      Name	Route table name. It must meet the following requirements: Must contain 1 to 64 characters. Can contain letters, numbers, underscores (_), hyphens (-), and periods (.).	er-rtb-cfw-vpc-02
      (Optional) AS_Path Route Selection	Do not configure: The system compares AS_Path attributes for the routes during load balancing and prefers the route with the shortest AS_Path length. The AS_Path attribute records all AS numbers that a BGP route passes through from the local end to the destination in the vector order. The fewer the AS numbers recorded in the AS_Path attribute, the shorter the AS_Path length. Ignore same length AS_Path: The system skips comparing the AS_Path attributes during load balancing if their lengths are identical. AS_Path prevents BGP loops between ASs. If you select this option, there may be BGP loops.	Do not configure
      (Optional) Tag	You can add tags when creating a route table for easy categorization and quick search. For details about tags, see Tag Overview.	Tag key: test02 Tag value: 02
      (Optional) Description	Route table description	-

   3. Click OK.

      The route table list page is displayed. When the status changes from Creating to Normal, the route table is created.

3. Configure the route table.
   1. On the route table page, select route table 2 (er-rtb-cfw-vpc-02 in this example). The Basic Information page is displayed.
   2. Create an association to associate CFW with route table 2 of the enterprise router.
      1. Click the Associations tab. Click Create Association and configure parameters as prompted.
         Figure 13 Creating an association
         

         Table 9 Creating an association

         Parameter	Description	Example Value
         Attachment Type	Select an attachment type. In this example, select CFW instance.	CFW instance
         Attachment	Select the automatically generated firewall attachment cfw-er-auto-attach.	cfw-er-auto-attach

      2. Click OK.
   3. Create a propagation to forward the traffic processed by CFW to VPC1 through the enterprise router.
      1. Click the Propagations tab. Click Create Propagation.
         Figure 14 Creating a propagation
         
      2. Configure basic information about the propagation as prompted.

         Table 10 Creating a propagation

         Parameter	Description	Example Value
         Attachment Type	Select an attachment type. In this example, select VPC.	VPC
         Attachment	In the attachment drop-down list, select the attachment of VPC 1 to be protected. In this example, select er-attach-vpc1.	er-attach-vpc1

      3. Click OK.
   4. Create a propagation to forward the traffic processed by CFW to VPC2 through the enterprise router.
      1. Click the Propagations tab. Click Create Propagation.
         Figure 15 Creating a propagation
         
      2. Configure basic information about the propagation as prompted.

         Table 11 Creating a propagation

         Parameter	Description	Example Value
         Attachment Type	Select an attachment type. In this example, select VPC.	VPC
         Attachment	Select the attachment of VPC 2 to be protected. In this example, select er-attach-vpc2.	er-attach-vpc2

      3. Click OK.

Step 4: Manually Add Routes Pointing to the Enterprise Router in the VPC Route Tables

1. Go to the route table list.
2. Configure a route for VPC1.
   1. In the Name/ID column of the route table list, click the name of the route table for VPC1. The basic information page of the route table is displayed.
   2. Click Add Route and configure parameters as prompted.

      Table 12 Route parameters

      Parameter	Description	Example Value
      Destination Type	The destination type can only be IP address. You can set an IP address or CIDR block.	IP address
      Destination Address	Enter the destination address of the route. The format is IP_address/Mask. For example, for inter-VPC protection, enter the CIDR block of VPC 2 in VPC 1.	CIDR block of VPC2 10.0.0.0/8
      Next Hop Type	Select a resource type for the next hop from the drop-down list. In this example, select Enterprise router.	Enterprise router
      Next Hop	Select a resource for the next hop. The enterprise routers you created are displayed in the drop-down list.	er-test-01
      Description	(Optional) Description of a route. Enter up to 255 characters. Angle brackets (< or >) are not allowed.	-

   3. Click OK.
3. Configure a route for VPC2.
   1. Return to the route table list.
   2. In the Name/ID column of the route table list, click the name of the route table for VPC2. The basic information page of the route table is displayed.
   3. Click Add Route and configure parameters as prompted.

      Table 13 Route parameters

      Parameter	Description	Example Value
      Destination Type	The destination type can only be IP address. You can set an IP address or CIDR block.	IP address
      Destination Address	Enter the destination address of the route. The format is IP_address/Mask. For example, for inter-VPC protection, enter the CIDR block of VPC 1 in VPC 2.	CIDR block of VPC1 10.0.0.0/8
      Next Hop Type	Select a resource type for the next hop from the drop-down list. In this example, select Enterprise router.	Enterprise router
      Next Hop	Select a resource for the next hop. The enterprise routers you created are displayed in the drop-down list.	er-test-01
      Description	(Optional) Description of a route. Enter up to 255 characters. Angle brackets (< or >) are not allowed.	-

   4. Click OK.