Configuring Access Policies When CFW and CBH Are Both Deployed

Scenarios

Cloud Firewall (CFW) and Cloud Bastion Host (CBH) are complementary security products in the Huawei Cloud security and compliance system.

CFW is a next-generation, cloud-native SaaS firewall operating from the network layer to the application layer (L3 to L7). It protects both Internet and VPC borders on the cloud, offering capabilities such as real-time intrusion detection and prevention, global unified access control, comprehensive visualized traffic analysis, log auditing, and source tracing analysis.

CBH serves as an Authentication, Authorization, Accounting and Audit (AAAA) platform for security management. It centrally manages accounts, authorization, authentication, and audit, while delivering fine-grained control over O&M operations, including command executions, session recordings, file transfers, and database SQL statements.

When deploying CFW and CBH together in public network O&M scenarios, a critical operational conflict arises: CFW's default action for EIP protection is Allow. However, when security administrators change this default action to Block to minimize the asset attack surface, CBH's O&M access traffic is often inadvertently blocked. As a result, administrators cannot log into CBH or manage downstream target hosts through CBH.

To resolve this issue, this section details how to align CFW's inbound and outbound Internet border (north-south) access control policies with CBH's O&M authorization policies to achieve two key objectives:

1. Balance security and availability: CFW effectively protects north-south traffic between CBH and the Internet without disrupting legitimate CBH O&M traffic.
2. Complementary closed-loop audit: Network-layer audits from CFW (covering IP addresses, ports, and domain names) combine with terminal-side operational audits from CBH to form a comprehensive, closed-loop security audit system.

Prerequisites

• You have purchased CFW. For details, see Purchasing Yearly/Monthly CFW and Purchasing Pay-per-Use CFW.
• You have purchased a CBH instance. There are no special requirements for the series and edition of the CBH instance. For details, see Buying a CBH Instance.
• An EIP has been bound to the CBH instance. For details, see Binding or Unbinding an EIP to or from a Bastion Host.

Step 1: Enable Protection for the EIP Bound to the CBH Instance in CFW

1. Log in to the CFW console.
2. In the navigation pane on the left, choose Assets > EIPs. The EIPs page is displayed.
3. In the search box above the EIP list, enter the EIP bound to the CBH instance to quickly search for it.
4. In the row of the EIP bound to the CBH, click Enable Protection in the Operation column. In the displayed dialog box, confirm the information and click Bind and Enable.

   If Protected is displayed in the Protection Status column of the EIP, the protection has been enabled. After protection is enabled for an EIP, the system allows all traffic by default. That is, the default action of the access control policy is Allow.

Step 2: Configure an Inbound Access Policy for the Internet border in CFW

1. Log in to the CFW console.
2. In the navigation pane of the CFW console, choose Protection Policies > Access Control > Internet Border Protection Rules. The Internet Border Protection Rules page is displayed.
3. Add a rule to allow access from the source IP addresses of O&M personnel to the CBH service port. Pin the rule to the top.
   1. On the Protection Rules > EIP tab, click Add Rule. Configure protection parameters.

      Table 1 Internet border - inbound - allow rule

      Parameter	Description
      IP Type	Select the IP address type of the security policy as needed.
      Name	Name of a custom protection rule. Naming rules: It can contain 1 to 255 characters. The name can contain only letters, numbers, underscores (_), and hyphens (-).
      Direction	Select Inbound, which indicates accessing cloud assets (EIPs) from the Internet.
      Source	Set the party that initiates a session. Set this parameter to the IP addresses allowed to access the CBH instance, that is, the Source IP of the CBH O&M personnel. You can add the source IP addresses of CBH O&M personnel to an IP address group and reference the group with one click. For details about how to add an IP address group, see Adding an IP Address Group.
      Destination	Set the recipient of a session. Set this parameter to the EIP bound to the CBH instance, that is, the EIP in Step 1: Enable Protection for the EIP Bound to the CBH Instance in CFW.
      Service	Set it to the CBH service ports. The ports involved in CBH services include but are not limited to the following: 443, 80, 2222, 53389, 2121, 20000–21000, 62222, and the database proxy port in use. For more CBH service ports, see the Inbound ports in Network Access Control. You can add multiple ports to a service group and reference the group with one click. For details about how to add a user-defined service group, see Adding a Service Group. You can also configure this parameter based on the predefined service group Remote Login and Ping. In the navigation pane on the left, choose Protection Policies > Access Control > Object Groups. On the Service Groups tab page, click the Pre-defined Service Groups tab to view predefined service groups.
      Application	(Optional) Configure protection rules for application-layer protocols. Select an application-layer protocol based on the value of Protocol under Service. If no protocol is selected, this parameter is set to Any by default, indicating that all application types are supported. For example, if the Protocol under Service is set to TCP, TCP-based applications such as HTTP and HTTPS are supported. If Protocol is set to UDP, UDP-based applications such as DNS and RDP are supported.
      Protection Action	Set it to Allowed, indicating that the firewall allows the traffic to be forwarded.
      Status	Set it to .
      Priority	Select Pin on top, indicating that the priority of the policy is set to the highest. If multiple security policies are configured, the security policies will be matched based on their priorities. Once traffic matches a security policy, it will not be checked against others.
      Schedule Management	(Optional) Click Schedule Management to set the time range to apply the rule. For details about how to add a schedule, see Managing Schedules.
      Allow Long Connection	If only one service is configured in the current protection rule and Protocol is set to TCP or UDP, you can configure the service session aging time (unit: second). Up to 50 rules can be configured with persistent connections. Yes: Configure the persistent connection duration. No: Retain the default durations. The default connection durations for different protocols are as follows: TCP: 1,800s UDP: 60s
      Long Connection Duration	If Allow Long Connection is set to Yes, you need to set the persistent connection duration and set hour, minute, and second. The duration range is 1 second to 1,000 days.
      Tags	(Optional) Tags are used to identify rules. You can use tags to classify and search for protection rules.
      Description	(Optional) Describe the usage and application scenario of the rule.

   2. Click OK to complete the protection rule configuration.

      After a protection rule is configured and enabled, it takes effect immediately.

4. Add a blocking rule and pin it to the bottom to block all non-whitelisted access.
   1. On the Protection Rules > EIP tab, click Add Rule. Configure protection parameters.

      Table 2 Internet border - inbound - block rule

      Parameter	Description
      IP Type	Select the IP address type of the security policy as needed.
      Name	Name of a custom protection rule. Naming rules: It can contain 1 to 255 characters. The name can contain only letters, numbers, underscores (_), and hyphens (-).
      Direction	Select Inbound, which indicates accessing cloud assets (EIPs) from the Internet.
      Source	Set the party that initiates a session. Set it to Any.
      Destination	Set the recipient of a session. Set it to Any.
      Service	Set it to Any.
      Application	Set it to Any.
      Protection Action	Set it to Blocked, indicating that the firewall blocks the traffic.
      Status	Set it to .
      Priority	Select Lower than the selected group/rule and put the policy at the end, indicating that the policy has the lowest priority. If multiple security policies are configured, the security policies will be matched based on their priorities. Once traffic matches a security policy, it will not be checked against others.
      Schedule Management	(Optional) Click Schedule Management to set the time range to apply the rule. For details about how to add a schedule, see Managing Schedules.
      Tags	(Optional) Tags are used to identify rules. You can use tags to classify and search for protection rules.
      Description	(Optional) Describe the usage and application scenario of the rule.

   2. Click OK to complete the protection rule configuration.

      After a protection rule is configured and enabled, it takes effect immediately.

Step 3: Configure an Outbound Access Policy for the Internet Border in CFW

1. Log in to the CFW console.
2. In the navigation pane of the CFW console, choose Protection Policies > Access Control > Internet Border Protection Rules. The Internet Border Protection Rules page is displayed.
3. Add an allow rule and pin it to the top to allow CBH to access necessary Huawei Cloud services.
   1. On the Protection Rules > EIP tab, click Add Rule. Configure protection parameters.

      Table 3 Internet border - outbound - allow rule

      Parameter	Description
      IP Type	Select the IP address type of the security policy as needed.
      Name	Name of a custom protection rule. Naming rules: It can contain 1 to 255 characters. The name can contain only letters, numbers, underscores (_), and hyphens (-).
      Direction	Select Outbound, which indicates accessing the Internet from cloud assets (EIPs).
      Source	Set the party that initiates a session. Set this parameter to the EIP bound to the CBH instance, that is, the EIP in Step 1: Enable Protection for the EIP Bound to the CBH Instance in CFW.
      Destination	Set the recipient of a session. Set this parameter to the domain names involved in CBH workloads. The domain names involved in CBH workloads include but are not limited to the following: The domain names of the email server, SMS gateway, Azure AD authentication server, SAML authentication server, JIT authentication server, AD authentication server, LDAP authentication server, RADIUS authentication server, and OBS/FTP/SFTP/rsyslog/LTS server configured in the bastion host. You can add multiple domain names involved in CBH workloads to a network domain name group and reference the group with one click. For details, see Adding a Domain Name Group.
      Service	Set it to the CBH service ports. Common ports used by CBH include but are not limited to TCP 443, UDP 53 (DNS), TCP 10743 (SMS), and other ports related to custom authentication servers. For more CBH service ports, see the Outbound ports in Network Access Control. You can add multiple ports to a service group. For details, see Adding a Service Group.
      Application	(Optional) Configure protection rules for application-layer protocols. Select an application-layer protocol based on the value of Protocol under Service. If no protocol is selected, this parameter is set to Any by default, indicating that all application types are supported. For example, if the Protocol under Service is set to TCP, TCP-based applications such as HTTP and HTTPS are supported. If Protocol is set to UDP, UDP-based applications such as DNS and RDP are supported.
      Protection Action	Set it to Allowed, indicating that the firewall allows the traffic to be forwarded.
      Status	Set it to .
      Priority	Select Pin on top, indicating that the priority of the policy is set to the highest. If multiple security policies are configured, the security policies will be matched based on their priorities. Once traffic matches a security policy, it will not be checked against others.
      Schedule Management	(Optional) Click Schedule Management to set the time range to apply the rule. For details about how to add a schedule, see Managing Schedules.
      Allow Long Connection	If only one service is configured in the current protection rule and Protocol is set to TCP or UDP, you can configure the service session aging time (unit: second). Up to 50 rules can be configured with persistent connections. Yes: Configure the persistent connection duration. No: Retain the default durations. The default connection durations for different protocols are as follows: TCP: 1,800s UDP: 60s
      Long Connection Duration	If Allow Long Connection is set to Yes, you need to set the persistent connection duration and set hour, minute, and second. The duration range is 1 second to 1,000 days.
      Tags	(Optional) Tags are used to identify rules. You can use tags to classify and search for protection rules.
      Description	(Optional) Describe the usage and application scenario of the rule.

   2. Click OK to complete the protection rule configuration.

      After a protection rule is configured and enabled, it takes effect immediately.

4. Add a blocking rule and pin it to the bottom to block all non-whitelisted access.
   1. On the Protection Rules > EIP tab, click Add Rule. Configure protection parameters.

      Table 4 Internet border - outbound - block rule

      Parameter	Description
      IP Type	Select the IP address type of the security policy as needed.
      Name	Name of a custom protection rule. Naming rules: It can contain 1 to 255 characters. The name can contain only letters, numbers, underscores (_), and hyphens (-).
      Direction	Select Outbound, which indicates accessing the Internet from cloud assets (EIPs).
      Source	Set the party that initiates a session. Set it to Any.
      Destination	Set the recipient of a session. Set it to Any.
      Service	Set it to Any.
      Application	Set it to Any.
      Protection Action	Set it to Allowed, indicating that the firewall allows the traffic to be forwarded.
      Status	Set it to .
      Priority	Select Lower than the selected group/rule and put the policy at the end, indicating that the policy has the lowest priority. If multiple security policies are configured, the security policies will be matched based on their priorities. Once traffic matches a security policy, it will not be checked against others.
      Schedule Management	(Optional) Click Schedule Management to set the time range to apply the rule. For details about how to add a schedule, see Managing Schedules.
      Tags	(Optional) Tags are used to identify rules. You can use tags to classify and search for protection rules.
      Description	(Optional) Describe the usage and application scenario of the rule.

   2. Click OK to complete the protection rule configuration.

      After a protection rule is configured and enabled, it takes effect immediately.

Step 4: Verify the Access Policy Configuration

If the configuration is successful, you can perform the following operations:

• CBH: You can log in to the CBH system and use its functions, such as creating users and performing O&M operations on resources.
• CFW: On the Log Query page of CFW, you can view the traffic data between the CBH system and the Internet, including attack event logs, access control logs, and traffic logs. For details, see Log Query.

References

For more information about CFW protection rules, see Configuring Protection Rules to Block or Allow Internet Border Traffic.