The VPC Firewall carries traffic between different VPCs by establishing firewall instances, providing Access Control rules and Log Auditing. The current version supports Direct Connect gateway protection: firewall instances support the CCN multi-route table mode. After Direct Connect gateways establish connections with cloud VPC assets through CCN, the VPC Firewall can inspect this traffic.
Note:
The VPC Firewall (primary/secondary mode) is available only in the CFW Enterprise Edition and above.
Architecture Overview
A VPC Firewall consists of multiple firewall instances, each responsible for connecting to different VPCs and establishing network connectivity with the firewall. The VPC Firewall essentially steers traffic to the firewall by modifying VPC routes. Whether firewall instances can communicate with each other depends on whether the VPCs connected to different instances have reachable routes. The firewall does not establish underlying network connectivity. Connectivity can be achieved by modifying the next hop in VPC route tables or through CCN multi-route tables.
When creating a firewall, you need to select an access mode. The modes are described as follows:
VPC mode: Select a VPC to connect to the firewall. Route steering is achieved by modifying the route tables of the relevant VPCs.
CCN mode: Select a CCN to connect to the firewall (multi-route table mode must be supported). Route steering is achieved by modifying the CCN route tables.
SASE mode: In SASE mode deployment, select a CCN to connect to CFW. This mode supports SD-WAN networks. This feature is currently in limited beta. To use it, submit a ticket.
VPC mode (CDC): This mode is the same as VPC mode and is available only in CDC environments.
Private Network Mode
1. Log in to the CFW console, and in the left sidebar, choose Firewall Toggle > VPC Firewall (Primary/Secondary).
2. On the VPC Firewall (Primary/Secondary) page, click Firewall Instances to go to the firewall instance page, and then click Create Firewall.
3. In the Create VPC Firewall dialog box, enter a firewall name, select VPC mode, and click Next.
4. Fill in the relevant parameters and click Next. If the number of instances does not meet your requirements, click
on the right to create multiple firewall instances.
Parameter description:
Firewall instance name: A custom name specified when a firewall instance is created.
Instance region: Indicates the region to which the VPC with protection enabled belongs.
Remote Disaster Recovery: VPC Firewall (primary/secondary) supports enabling remote disaster recovery to improve the disaster recovery capability of the firewall. You can enable it by selecting the checkbox.
Availability Zone: Select a suitable AZ based on your requirements.
Instance Specification: A single instance currently supports a minimum of 100 Mbps and a maximum of 20 Gbps. You can configure up to 5 Gbps in the console. If you need more, submit a ticket for evaluation. Upgrade and scaling out are supported. If the bandwidth of a single instance is insufficient, you can create multiple firewall instances for traffic distribution. Each instance has its own throughput limit, so when deploying multiple instances, ensure that each instance operates within its throughput limit.
Instance Access: Click Access Network, select the desired VPCs by the region of the VPCs to be connected, and then click OK.
Note:
Each firewall instance can be connected only to VPCs in the same region. You can create multiple firewall instances in the same region. We recommend that you plan the VPCs to be connected by region before creating instances and configuring network access. The firewall cannot connect basic networks. Before connecting, make sure that a peering connection or CCN has been created between the VPCs. Otherwise, the connection does not take effect and the Firewall Toggle is not displayed.
Each VPC can be connected to only one firewall instance. The maximum number of VPCs that can be connected to a VPC firewall instance of each specification is as follows:
For VPC firewall instances below 1024M: up to 2 VPCs.
For VPC firewall instances from 1024M to 1300M: up to 4 VPCs.
For VPC firewall instances of 1300M and above: up to 6 VPCs.
5. Configure the traffic redirection subnet method, firewall VPC, and routing mode. After confirming the settings are correct, click Create. The creation process takes several minutes. Please wait patiently.
Parameter Name
Description
Subnet routing
CFW creates a /24 subnet in the selected VPC for traffic steering to the firewall. You can choose different methods to create the subnet. The traffic redirection subnet cannot be modified after the firewall is created.
Preferred Proprietary IP Range: CFW will automatically select an idle subnet IP range in the VPC you chose. If the VPC has no subnet quota, the extended IP range of the selected VPC will be used.
Secondary Network Range Preferred: CFW will prioritize using the idle expansion IP address range reserved for the VPC. This mode does not consume the subnet quota of the selected VPC. An expansion IP address range is an auxiliary IP address range within a VPC. For details, see VPC - Editing IPv4 CIDR.
Custom: You can specify a subnet IP range for the firewall. Note that it must be a /24 subnet, and the custom IP range must fall within the CIDR of the current VPC, for example, 192.168.0.0/24.
Firewall VPC
It is used to connect firewall instances. You need to create firewall VPCs respectively in the regions where the selected VPCs are located.
Automatic Selection: The firewall will automatically create a /20 VPC that does not conflict with the connected VPC.
Custom: Enter a /20 VPC that does not conflict with the planned network, for example, 192.168.1.0/20.
Routing mode
The routing scheme of a firewall toggle. The way that networks are interconnected determines the specific firewall toggle and routing mode. It is recommended to choose a routing mode based on the workload network mode.
Single-Point Interconnection: This mode is suitable for scenarios where a small number of VPCs need to be connected and the network topology is simple. In this mode, one firewall toggle is generated for each VPC-to-VPC connection.
Multi-Point Interconnection: This mode is suitable for scenarios where multiple VPCs need to be connected and the network topology is simple, such as a star network topology. In this mode, one toggle is configured for each VPC, and traffic between VPCs passes through two firewall toggles.
Full Interconnection: This mode is suitable for scenarios where many VPCs need to be connected and the network topology is complex, such as a mesh network topology. In this mode, only one firewall toggle is configured to control all VPC routes.
Custom Routing: You can refer to the document Custom Routing Configuration Guide and configure routes yourself after the firewall is created. In this mode, no Firewall Toggle is available.
Note:
After multiple regions are selected, only custom routing is supported. For the availability of specific routing modes, refer to the console.
1. Log in to the CFW console, and in the left sidebar, choose Firewall Toggle > VPC Firewall (Primary/Secondary).
2. On the VPC Firewall (Primary/Secondary) page, click Firewall Instances to go to the firewall instance page, and then click Create Firewall.
3. In the Create VPC Firewall dialog box, enter a firewall name, select CCN mode, and click Next.
4. Click Click to Select. Then, based on the prompts, select the CCN instances to be added to the VPC Firewall, and click OK.
Note:
The CCN instance must support multi-route table mode. If it does not, contact CCN to enable the multi-route table feature first. CCN mode supports creating a VPC Firewall in a specified region. In CCN mode, one firewall can be bound to only one CCN instance.
5. After you select a CCN instance, the available regions are automatically generated below based on the VPCs connected to the CCN. If you select a region, a firewall instance is created in that region. Fill in the required parameters and click Next.
Parameter description:
Firewall instance name: A custom name specified when a firewall instance is created.
Region: Indicates the region to which the VPC with protection enabled belongs.
Note:
If you select only one region to deploy a firewall instance, all traffic between VPCs with Firewall Toggle enabled passes through the firewall instance in that region, which is suitable for a star topology network. If you select all regions to deploy firewall instances, all traffic between VPCs with Firewall Toggle enabled passes through the firewall instance in the local region, which is suitable for a mesh topology network. If you select multiple regions, only custom routing is supported.
Remote Disaster Recovery: VPC Firewall (primary/secondary) supports enabling remote disaster recovery to improve the disaster recovery capability of the firewall. You can enable it by selecting the checkbox.
Availability Zone: Select a suitable AZ based on your requirements.
Instance Specification: A single instance currently supports a minimum of 100 Mbps and a maximum of 20 Gbps. You can configure up to 5 Gbps in the console. If you need more, submit a ticket for evaluation. Upgrade and scaling out are supported. If the bandwidth of a single instance is insufficient, you can create multiple firewall instances for traffic distribution. Each instance has its own throughput limit, so when deploying multiple instances, ensure that each instance operates within its throughput limit.
6. Configure the new traffic diversion VPC and routing mode. After confirming the settings are correct, click Create. The creation process takes several minutes. Please wait patiently.
Parameter Name
Description
Create routing VPC
CFW creates a /20 VPC in the selected CCN instance for traffic steering to the firewall. You can choose different methods to create the VPC.
Auto: CFW automatically probes for 20 idle VPC CIDR blocks for firewall traffic steering.
Custom: You can customize the VPC subnet for the firewall. Note that it must be a /20 subnet, for example, 192.168.1.0/20.
Routing mode
The routing mode description is the same as that in VPC mode. See VPC Routing Mode parameter table.
Instance Specifications
VPC Firewall Instance Specifications Tier Table.
Note:
The VPC Firewall instance specifications and the private network rule list quotas are independent of each other and do not involve billing logic. They cannot be scaled out separately and can only be increased by upgrading the instance specifications. Each time you configure an ACL in the console, it is automatically converted into specific rules based on the deployment formula. The system automatically identifies the access source and destination, and deploys the rules to the specified VPC Firewall instance.
Deployment formula: Number of deployed rules = Number of source addresses × Number of destination addresses × Number of ports × Number of protocol types.
The VPC Firewall instance specification determines the maximum number of ACL rules that each instance can support. If too many ACL rules are deployed, the engine may become unstable.
We recommend that you optimize rules and reduce redundant rules based on the specifications and the number of deployed rules of each instance to improve engine stability.
Specification Tiers
Minimum Bandwidth/Mbps
Maximum Bandwidth/Mbps
Concurrent Connections/Unit
Number of Rules Quota / Item
1
100
1,023
130,000
5,000 (Intrusion Defense feature not included in this tier).
2
1,024
1,300
250,000
20,000
3
1,301
4,095
300,000
40,000
4
4,096
6,143
600,000
60,000
5
6,144
10,239
1,000,000
120,000
6
10,240
102,400
2,000,000
200,000
Viewing and Scaling Out
In the Specifications module on the Firewall Toggle page, you can view the connected network instances and VPC Firewall instances. The default number of VPC Firewall instances that can be created for each edition is as follows: Enterprise Edition 2, Ultimate Edition 3. If the quantity does not meet your requirements, you can expand capacity by upgrading the edition or scaling out resources.
Reference
To configure Firewall Toggle for your public IP addresses and associated cloud assets, see Internet Firewall Toggle.
To manage traffic and protect private network assets, or to forward network traffic based on SNAT and DNAT, see NAT Firewall Toggle.
If you encounter issues related to VPC Firewall, see the VPC Firewall documentation.
