Creating a VPC Border Firewall

Scenario

Deploying a VPC border firewall enables visualization and security control over east-west traffic between VPCs and on-premises IDCs, or between separate VPCs. It enforces access control, intrusion prevention, and anomaly interception to safeguard internal cloud networks.

This section describes how to create a VPC border firewall in CFW.

Notes and Constraints

When creating a firewall, you need to select an enterprise router and configure an IPv4 CIDR block to divert traffic. The enterprise router and planned CIDR block must meet the following requirements:

Creating a VPC Border Firewall

1. Check whether there are available enterprise routers under the current account.
   • If yes, an enterprise router is available. Go to 2.
   • If no, create an enterprise router and then perform subsequent steps.
     • For details about Enterprise Router pricing, see Billing.
     • For details about how to create an enterprise router, see Creating an Enterprise Router. You are advised to disable Default Route Table Association, Default Route Table Propagation, and Auto Accept Shared Attachments.
       Figure 1 Enterprise router configuration
       

2. Check whether the professional edition CFW has been purchased.
   • If yes, you have a professional edition CFW. Go to 3.
   • If no, you do not have a professional edition CFW. Purchase it by referring to Purchasing and Modifying CFW and then perform the subsequent steps.

3. Create a VPC border firewall.
   1. Go to the VPC border firewall management page.
   2. Click in the upper left corner of the management console and select a region.
   3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
   4. On the VPC border firewall management page, click Create Inter-VPC Firewall.
   5. On the displayed Create Inter-VPC Firewall page, set the route type to Enterprise Router and click Next.
   6. On the Plan CIDR Blocks and Create Firewall page, select an enterprise router and configure a proper CIDR block.
      Figure 2 Creating a VPC border firewall
      

      Table 3 Planning a CIDR block

      Parameter	Description
      Enterprise Router	Select the enterprise router used for traffic diversion. It must meet the following requirements: The enterprise router is not associated with other firewall instances and must belong to the current account. The enterprise router is not a shared enterprise router. Default Route Table Association, Default Route Table Propagation, and Auto Accept Shared Attachments must be disabled.
      CIDR Block	Configure a proper CIDR block for traffic forwarding. After the CIDR block is configured, CFW will create an InspectionVPC by default. This VPC is dedicated to traffic detection and will not be created under your account. That is, the number of protected VPCs under your account will not increase. This VPC is used to divert traffic. It forwards inter-VPC traffic to CFW for check and protection, and automatically allocates a dedicated subnet associated with CFW to carry and forward east-west traffic (traffic exchanged between VPCs). Pay attention to the following principles when you configure the CIDR block of an inspection VPC: Resource ownership and CIDR block planning: The inspection VPC does not belong to your account (it is not displayed in the resource list of your account), but you need to specify its CIDR blocks. The larger the available space in the CIDR block, the more flexibility it will have in expanding CFW capacity, such as adding protected nodes or increasing traffic processing capacity. CIDR block conflict prevention: The planned CIDR block of the inspection VPC must not overlap with the CIDR blocks of the services that are already protected or scheduled for protection. Otherwise, traffic routing will be abnormal. Only private network address segments (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) are supported. Otherwise, route conflicts may occur in public network access scenarios, such as SNAT. The CIDR block 10.6.0.0/16-10.7.0.0/16 is reserved for CFW and cannot be specified. CIDR blocks cannot be modified after saving. In the east-west traffic diversion scenario, the CIDR block of the inspection VPC cannot be modified once saved. You are strongly advised to fully evaluate the subsequent service expansion requirements and reserve sufficient CIDR blocks before the configuration. To ensure your CIDR block can support long-term use, refer to Table 4 when configuring the CIDR block mask of the inspection VPC.

      Table 4 CIDR block mask

      CIDR block mask	Max. Protected Traffic
      / 24	20 Gbps
      / 23	45 Gbps
      / 22	95 Gbps
      / 21	195 Gbps
      / 20	395 Gbps

   7. Click OK. The firewall will be created in 3 to 5 minutes.

      During the creation, you can only check the Dashboard page. The firewall status will change to Upgrading.

Follow-up Operations

After creating the VPC border firewall and associating it with the ER, you must configure the router to redirect traffic to CFW. For detailed instructions, see Configuring the Enterprise Router to Divert Traffic to CFW.