Cloud Firewall:Configure a VPC firewall for a Basic Edition transit router

How it works

After you enable a VPC firewall, Cloud Firewall filters traffic between VPCs based on deep packet inspection (DPI) traffic analysis, intrusion prevention system (IPS) rules, threat intelligence, virtual patching, and access control policies. Cloud Firewall then determines whether to allow the traffic. This allows Cloud Firewall to block unauthorized access and secure traffic between your private network assets.

The following figure shows a sample scenario where a VPC firewall protects a Basic Edition transit router.

For more information about the protection scope, see What is Cloud Firewall?.

Impact on business

When you create a VPC firewall, you do not need to change your network topology. You can create a VPC firewall and enable the automatic traffic redirection mode with one click to protect your business assets. This operation does not interrupt your services. The creation process takes about 5 minutes. We recommend that you enable the VPC firewall during off-peak hours.

Enabling or disabling a VPC firewall takes about 5 to 30 minutes, depending on the number of route entries. During this process, persistent connections may experience transient disconnections that last for seconds. Short-lived connections are not affected.

Prerequisites

• You have purchased the Enterprise, Ultimate, or pay-as-you-go edition of Cloud Firewall. For more information, see Purchase Cloud Firewall.

  Note

  You can configure VPC firewalls for Enterprise Edition transit routers only with the Enterprise Edition, Ultimate Edition, and Pay-as-you-go Edition of Cloud Firewall. This feature is not available in the Premium Edition.

• You have granted Cloud Firewall the required permissions to access your cloud resources. For more information, see Authorize Cloud Firewall to access cloud resources.

• You have purchased a CEN instance and are using it to establish network connections between VPCs. For more information, see Use a CEN instance to connect VPCs in the same region (Basic Edition) and Use a CEN instance to connect VPCs across regions and accounts (Basic Edition).

  Note

  If a VPC in the CEN instance was created by a different Alibaba Cloud account, and that account has not granted permissions to Cloud Firewall, you cannot create a VPC firewall. We recommend that you log on to the Cloud Firewall console using the corresponding account to grant the required permissions before you enable the VPC firewall. For more information, see Authorize Cloud Firewall to access cloud resources.

• Ensure that the regions where your network resources are located are supported by the VPC firewall. For more information, see Supported regions.

Procedure

1. Log on to the Cloud Firewall console. In the navigation pane on the left, click Firewall Settings.

2. On the Firewall Settings page, click the VPC Firewall tab.

3. On the VPC Firewall tab, click Cloud Enterprise Network (Basic Edition).

4. Find the CEN instance for which you want to create a VPC firewall and click Create in the Actions column.

   If the assets that you want to protect are not in the list, you can click Synchronize Assets to synchronize asset information from your Alibaba Cloud account and its member accounts.

5. In the Create Firewall panel, follow the steps in the wizard to configure the VPC firewall.

   You can perform a one-click check to determine whether a Basic Edition transit router meets the conditions for creating a VPC firewall. After the check is complete, you can view the results in the Enable Diagnosis wizard. If you are familiar with the creation rules, you can skip this diagnostic check and create the firewall directly.

   The following table describes the VPC firewall configurations in CEN connection mode.

   Configuration item	Description
   Basic Information	Name: Enter a name for the VPC firewall. The name is used to identify the VPC firewall instance. We recommend that you enter a unique and meaningful name as needed.
   VPC Configurations of Firewall	Assign CIDR blocks to the automatically created Cloud Firewall VPC and vSwitch. These are used to create a firewall security VPC (Cloud_Firewall_VPC) for traffic redirection. A subnet CIDR block is allocated from the assigned VPC CIDR block for the vSwitch of the Cloud Firewall VPC. The subnet mask of the subnet CIDR block must be 29 bits or less and cannot conflict with the CIDR blocks in your network plan. Important Configure the settings as needed. After a VPC firewall is created, you cannot change these settings. To change the settings, you must delete the firewall and create a new one. VPC of Firewall: The default value is 10.0.0.0/8. You can customize the CIDR block of the firewall VPC. The following CIDR blocks and their subnet CIDR blocks are supported: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. vSwitch CIDR Block: The default value is 10.219.219.216/29. If the default value conflicts with your network plan, you can specify a different value. Configure Zone: Note If you select Default (Auto-assigned) for both the primary and secondary zones, the active-active mode is enabled. This mode is easy to configure and ideal for scenarios with latency-insensitive service traffic. If you specify a primary zone and a secondary zone, the active-passive mode is used. This mode is suitable for scenarios where service traffic is sensitive to latency and can reduce traffic latency. For more information about the active-active and active-passive modes and the migration steps, see Best practices for migrating VPC firewall zones. Primary Zone: Sets the primary zone for the vSwitch. Cloud Firewall supports the automatic allocation of a vSwitch zone. Important If your services are sensitive to latency, we recommend that you set Primary Zone to the region where service traffic occurs and also set Zone of the vSwitch required by the service VPC to the same region to further reduce latency. Secondary Zone: Specifies the secondary zone for the vSwitch. By default, the VPC firewall prioritizes forwarding traffic through the primary zone (AZ) for efficient transmission. If the primary zone becomes unavailable, the system automatically switches over to the secondary zone to forward traffic, which ensures business continuity in disaster recovery scenarios.
   Assign vSwitch for Firewall	Configure the vSwitch of the service VPC for which you want to enable traffic redirection. The vSwitch is used by the elastic network interfaces (ENIs) that are required for Cloud Firewall traffic redirection. Cloud Firewall automatically assigns the vSwitch. If your services are sensitive to network latency, you can specify a zone for the service VPC to reduce network latency. Important This setting is determined by the service configuration and cannot be changed after creation. To change this setting, you must delete and recreate the resource. Zone: Select the zone for the vSwitch in the service VPC. To reduce latency, we recommend that you select the same zone as the primary zone of the firewall VPC's vSwitch. vSwitch: Select the vSwitch instance of the business VPC.
   Redirection Configuration	Enable or disable traffic redirection and view the protected CIDR blocks.
   IPS	Select a mode and a policy for the intrusion prevention system (IPS). IPS Mode Monitor Mode: When enabled, it monitors malicious traffic and sends alerts. Block Mode: Blocks malicious traffic and prevents intrusions. IPS Capabilities Basic Rules: After you enable Basic Policies, they provide basic mitigation capabilities for your assets, including brute-force attack interception, command execution vulnerability interception, and control over post-infection connections to C&C (Command and Control) servers. Virtual Patching: Provides real-time protection against popular high-risk application vulnerabilities when enabled. Note This setting applies to all network instances under the same CEN instance.

6. Click Start Creation.

7. On the Cloud Enterprise Network (Basic Edition) tab, turn on the switch for the VPC firewall that you created.

   Cloud Firewall can protect your network resources only after the VPC firewall is enabled. The VPC firewall is successfully enabled when its Firewall Status changes to Enabled.

   Note

   After you enable a VPC firewall, if you add or delete information in a VPC route table, Cloud Firewall requires 15 to 30 minutes to learn the new routes. We recommend that you wait for the route learning process to complete before you check whether the route table has taken effect. If you have any questions, you can submit a ticket to contact a product technical expert.

   After a VPC firewall is created, Cloud Firewall automatically creates the following resources:

   • A VPC resource named Cloud_Firewall_VPC.

     Important

     Do not add other service resources to Cloud_Firewall_VPC. If you do, these resources cannot be deleted when you delete the VPC firewall. Do not manually modify or delete the network resources in this VPC.

   • A vSwitch resource named Cloud_Firewall_VSWITCH.

   • A custom route entry with the remark Created by cloud firewall. Do not modify or delete it..

   After you enable a VPC firewall, a security group named Cloud_Firewall_Security_Group is automatically added to Cloud_Firewall_VPC and the service VPC. An allow policy (authorization policy) is automatically configured for this security group to allow traffic to the VPC firewall.

   Important

   Do not delete the Cloud_Firewall_Security_Group security group or its allow policy. Otherwise, service traffic will be interrupted.

   To perform batch operations or frequently enable and disable the VPC firewall, we recommend that you perform these operations during off-peak hours to avoid service interruptions.

Edit a VPC firewall

To modify the configuration of a VPC firewall, go to the VPC Firewall page and click the Cloud Enterprise Network (Basic Edition) tab. Find the network instance for the target VPC firewall and click Edit in the Actions column.

Disable a VPC firewall

1. On the Firewall Settings page, click the VPC Firewall tab.

2. In VPC Firewall, on the Cloud Enterprise Network (Basic Edition) tab, locate the CEN instance for the target VPC firewall, and turn off the Firewall Settings.

   Wait for the VPC firewall to be disabled. The VPC firewall is successfully disabled when its Firewall Status changes to Disabled.

Delete a VPC firewall

If you no longer need the VPC firewall, go to the VPC Firewall page and click the Cloud Enterprise Network (Basic Edition) tab. Find the network instance for the target VPC firewall and click Delete in the Actions column.