Help Center/ Cloud Firewall/ Service Overview/ Constraints
Updated on 2025-10-30 GMT+08:00
View PDF
Share

Constraints

This topic describes some limitations and constraints on using CFW.

CFW Usage Restrictions

  • CFW can only protect the services deployed on Huawei Cloud. It cannot protect the services deployed on Intelligent EdgeCloud (IEC) or across clouds.
  • Traffic protection supports EIPs, but does not support global EIPs or the EIPs bound to API Gateway.
  • CFW can be used only in the region you selected when purchasing it. To use it in other regions, switch to the corresponding region and purchase it.
  • VPC border protection depends on the enterprise router for traffic diversion. To use this function, ensure your account has at least one enterprise router.
  • CFW does not support Chinese domain names.

Protection Policy Quota Limit

  • A maximum of 20,000 protection policies (protection rules and blacklist/whitelist rules) can be added to a firewall instance. The limits on the blacklist/whitelist rules are as follows:
    • A maximum of 2,000 blacklist items can be added to a firewall instance.
    • A maximum of 2,000 whitelist items can be added to a firewall instance.
  • Groups
    • IP address groups
      • A firewall instance can have up to 3,800 IP address groups.
      • An IP address group can contain up to 640 IP addresses.
      • A firewall instance can contain up to 30,000 IP addresses.
    • Service groups
      • A firewall instance can have up to 900 services.
      • A firewall instance can have up to 512 service groups.
      • A service group can have up to 64 services.
    • Domain name groups
      • The domain names in a domain name group can be referenced by protection rules for up to 40,000 times. Wildcard domain names (for example, *.example.com) can be referenced for up to 2,000 times.
      • Application domain name group (layer 7 protocol parsing)
        • A firewall instance can have up to 500 domain name groups.
        • A firewall instance can have up to 2,500 domain names.
        • An application domain name group can have up to 1,500 domain names.
      • Network domain name group (layer 4 protocol parsing)
        • A firewall instance can have up to 1,000 domain names.
        • A network domain name group can have up to 15 domain names.
        • Each domain name group can resolve up to 1,500 IP addresses.
        • Each domain name can resolve up to 1,000 IP addresses.

Restrictions on Basic IPS

  • Modifying the action of a basic protection rule
    • The actions of up to 3000 rules can be manually changed to observation.
    • The actions of up to 3000 rules can be manually changed to interception.
    • The actions of up to 128 rules can be manually changed to disabling.
  • Custom IPS signature
    • Only the professional edition supports custom IPS signatures.
    • A maximum of 500 features can be added.

Restrictions on Logs

  • CFW allows you to view the logs generated within the last seven days. If you need to record and view logs generated within the last 1 to 365 days, you can record one or multiple types of logs in LTS.
  • Up to 100,000 records can be exported for a single log at a time.