After a VPC Firewall is created, you can manage it and its subordinate firewall instances. A VPC Firewall contains multiple firewall instances, and each instance connects to a different VPC. Switches are created between the VPCs to which the instances connect.
This document introduces the following three dimensions: FWM, instance management, and switch management. FWM applies to the entire VPC Firewall, instance management applies to individual firewall instances, and switch management applies to switches themselves.
Firewall Management
Log in to the CFW console, and in the left sidebar, choose Firewall Toggle > VPC Firewall (Primary/Secondary) > Firewall Instances.
The following operations apply to the entire VPC Firewall and affect all firewall instances under it.
Configuring Firewall Instances
1. Click Actions > Configure Instance.
2. You can adjust the initial configuration at creation, including the firewall instance name, instance specifications (the bandwidth limit and the maximum number of deployable rules for the firewall instance), and the network instance connected to each instance. You can also add new VPC connections. The firewall network configuration cannot be modified.
For a newly added VPC, the system automatically redirects traffic based on the network configuration used when the instance was created. If the traffic redirection subnet for the instance was created using the Custom method, you must also manually enter the subnet CIDR of the new VPC.
Bandwidth Monitoring
Click Actions > Bandwidth Monitoring to view the bandwidth and traffic monitoring panel for this firewall.
Terminating a VPC Firewall
Click Actions > Terminate Firewall, and after a second confirmation, the entire VPC Firewall will be terminated.
Attention:
If you selected the Custom Routing mode when creating the firewall, manually restore the relevant routes according to the Custom Routing Configuration Guide before termination.
Configuring DNS Resolution
1. Click Actions > Configure DNS Resolution.
2. In the Configure DNS Resolution window, enter parameters such as Custom DNS and Custom Backup DNS, and then click OK to save.
Note:
Ensure that the DNS addresses you enter are accessible within the network connected to the firewall.
If no DNS server is specified, Tencent Cloud DNS addresses are used by default: 183.60.82.98 and 183.60.83.19.
3. After you configure DNS resolution addresses, the resolved IP addresses can be distributed to engine access control rules.
Protection configuration
1. Log in to the CFW console, select Firewall Toggle in the left sidebar, and click Firewall Settings in the upper-right corner.
2. In the Protection Configuration area, you can configure protection settings for the VPC Firewall:
TCP blocking action: When the firewall blocks a TCP session, define the blocking method.
Packet Loss Only: directly drops packets (the client perceives this as a connection timeout).
Drop Packets and Reset Connection: drops packets and sends an RST packet to the access source (the client immediately receives a connection refused signal).
Managing Instances
Log in to the CFW console, and in the left sidebar, choose Firewall Toggle > VPC Firewall (Primary/Secondary) > Firewall Instances.
The following operations take effect on a single firewall instance.
Engine Upgrade
VPC Firewall is deployed in a private mode, and its engine is exclusively used by the tenant. You need to manually update the engine. For details, see Firewall Engine Upgrade.
Viewing Instance Details
1. Click the ID of the target firewall instance, or click Instance Details on the right.
2. On the instance details page, view the configuration information of the instance.
Status Monitoring
Click Status Monitoring on the right of the target firewall instance to view its running status.
Note:
Instance-level Status Monitoring and firewall-level Bandwidth Monitoring are different entry points of the same monitoring panel, both of which allow you to view the bandwidth and traffic status of the firewall.
Viewing Firewall Toggle
Click the toggle count of the associated VPC Firewall to navigate to the Firewall Toggle page, where the toggles associated with the current firewall are automatically filtered.
You can also click More > View Firewall Toggles to be redirected to the same page, where the toggles associated with the current instance are automatically filtered.
Note:
A toggle can be associated with multiple firewall instances and controls traffic passing through these firewall instances.
For operations such as enabling, disabling, and viewing rules after navigating to the Firewall Toggle page, see Toggle Management.
Bandwidth limiting
1. Click More > Bandwidth Throttling.
2. On the Bandwidth Throttling page, click Add Rule, fill in the parameters as described below, and then click OK to save.
Parameter
Description
Rate limiting type
Supports limiting the upload and download rates for private IP addresses/CIDRs.
Rate limiting mode
Shared Throttling: All IPs within the CIDR share the rate limit.
Dedicated Throttling: Each IP address within the CIDR independently enjoys the rate limit.
IP/CIDR
Fill in the private IP address/CIDR that requires rate limiting within the network connected to the current firewall instance.
Uplink rate
Fill in the maximum rate at which traffic is sent out from the firewall instance. The unit can be Kbps, Mbps, or Gbps.
Downlink rate
Fill in the maximum rate at which traffic is received by the firewall instance. The unit can be Kbps, Mbps, or Gbps.
Debugging Tools
Click More > Debugging Tools to perform the following operations.
Enable ByPass: You can manually enable or disable ByPass mode. For details, see ByPass Mode.
Restart Instance: First restart the firewall secondary node. After the secondary node restart is complete, a primary/secondary switchover is performed, and then the primary node is restarted. After the primary node restart is complete, another primary/secondary switchover is performed. The entire process takes approximately 10 minutes, during which the network may experience minor jitter and you may be unable to perform operations or modify firewall configurations. It is recommended to perform this operation during off-peak business hours.
Switch Primary/Secondary: The firewall adopts a mutual primary/secondary scheme, where the currently active instance serves as the primary instance and can be switched to the secondary firewall instance. The switchover process takes approximately 1 to 2 seconds, during which the network may experience minor jitter. Do not perform other Ops operations during this period.
Enable Transparent Mode: In transparent mode, the current firewall instance only forwards network traffic, and the related access control or intrusion defense features do not take effect. It is expected to take effect within 1 minute after being enabled and is recommended for debugging purposes. After debugging, manually disable transparent mode. If you need more help, submit a ticket.
Migrate AZ: You can migrate the current primary or secondary node to another AZ. The migration process is expected to take approximately 2 to 5 minutes, during which a primary/secondary switchover may occur and the network may experience jitter. It is recommended to perform this operation during off-peak business hours.
Attention:
Operations such as enabling ByPass, restarting instances, primary/secondary switchover, and modifying routing tables to roll back the firewall trigger routing table switchover, which may cause network jitter of about 1 second. In scenarios such as cross-VPC access to basic services or TKE connecting to CFS without noresvport configured, existing sessions may be interrupted or even cause network disconnection. For details, see VPC Firewall.
Changing Associated Instances
Before reselecting an access instance, disable all toggles of the current VPC Firewall.
1. On the Firewall Instance page, click the toggle count of the associated VPC Firewall.
2. Navigate to the Firewall Toggle page and click Disable All to disable all toggles of the current firewall.
3. On the Firewall Toggle page, choose More > Reselect Access Instance to go to the Edit VPC Firewall page.
Attention:
When connecting to the VPC Firewall in VPC mode, you can reselect the VPC instances to connect. In CCN mode, all VPC instances within the CCN are connected, and reselection is not supported.
4. In the pop-up window, select the VPC you want to reconnect to and click OK.
Terminating a VPC Firewall Instance
Before terminating any firewall instance, disable all toggles of the current VPC Firewall. After the firewall instance is terminated, the VPCs connected to the current instance will be automatically disconnected, and the used quota will be released.
1. On the Firewall Instance page, click the toggle count of the associated VPC Firewall.
2. Navigate to the Firewall Toggle page and click Disable All to disable all toggles of the current firewall.
3. Return to the Firewall Instance page and click More > Terminate Instance. After a second confirmation, the current firewall instance will be terminated.
ByPass Mode
After ByPass or automatic ByPass is enabled, traffic will bypass the firewall and switch to the backup route, which may cause network jitter of about 1 second. If your business involves scenarios such as cross-VPC access to basic services or TKE connecting to CFS without noresvport configured, existing sessions may be interrupted or even cause network disconnection, resulting in significant impact. Evaluate the business impact before proceeding with caution. For details, see VPC Firewall.
Manual ByPass
On the Firewall Instance page, click More > Enable ByPass to manually switch to ByPass mode. In ByPass mode, all traffic of this instance bypasses the firewall, and all firewall configurations become invalid. It is recommended for debugging purposes. After debugging, manually disable ByPass mode.
Automatic ByPass
When VPC Firewall traffic reaches the instance bandwidth limit, network congestion or even packet loss may occur. You can set the Maximum Firewall Full-Load Duration in VPC Boundary Disaster Recovery Configuration under Firewall Settings > Feature Configuration > VPC Boundary Toggle Settings. By default, it is set to "No automatic action", and the setting takes effect only after you manually configure a duration threshold.
After the preset duration is reached, the firewall automatically switches to ByPass state and disables all toggles of the corresponding instance. It cannot recover automatically, so you must manually disable ByPass to restore normal protection.
Viewing/Editing Backup Routes
After ByPass mode is enabled on the firewall, the VPC is automatically switched to its bound backup route. You can view the binding relationship of the backup route in the console.
1. On the Firewall Instance page, select the firewall instance you want to view and click Instance Details.
Note:
Only CCN mode supports viewing backup routes, and only the custom routing traffic steering mode supports editing backup routes.
2. On the Instance Details page, click Backup Routes to view all connected VPCs and their bound backup routes below.
3. Click Edit to modify the backup route bound to the VPC. You can select a route table or choose not to connect to the firewall. If you choose not to connect to the firewall, ByPass will not operate on this VPC.
Switch Management
Log in to the CFW console, and in the left sidebar, choose Firewall Toggle > VPC Firewall (Primary/Secondary) > Firewall Toggle.
On the Firewall Toggle page, you can control VPC boundary traffic by enabling or disabling toggles.
Note:
Toggles are built on top of Peering Connections (or CCNs) between VPCs, and their status is automatically synchronized with configuration changes of the Peering Connections (or CCNs). When a Peering Connection (or CCN) is changed or deleted, the corresponding toggle is also changed or deleted, and CFW immediately performs this operation only on toggles in the disabled state.
Toggles are automatically generated based on reachable routes, and CFW does not actively connect basic networks. If no toggle is displayed on the page, first check whether a Peering Connection or CCN has been established between the relevant VPCs.
If you need to configure CCN routes, see Route Overview.
Enabling/Disabling a Switch
After you enable the toggle, traffic between the local and peer networks corresponding to the toggle is steered to the VPC Firewall. After you disable the toggle, traffic returns to its original path and no longer passes through the firewall.
1. On the Firewall Toggle page, click Firewall Toggle. You can enable or disable toggles individually, in batches, or all at once.
Individually: Select the desired firewall and click its toggle
. A confirmation dialog box appears.
In batches: After selecting the firewall toggles, click Batch Enable or Batch Disable in the upper-left corner. A confirmation dialog box appears.
All: When no items are selected, click Enable All or Disable All in the upper-left corner. A confirmation dialog box appears.
2. In the confirmation dialog box, click OK to enable or disable protection.
Attention:
Enabling or disabling a toggle involves automatic modification of routing policies in the background, and network interruption may occur within 1 to 10 seconds. If your business involves scenarios such as cross-VPC access to basic services or TKE connecting to CFS without noresvport configured, existing sessions may be interrupted or even cause network disconnection. For details, see VPC Firewall. To avoid affecting your business, schedule the operation at an appropriate time. If you need to enable or disable toggles in batches or frequently, perform the operation late at night when business traffic is low.
After you enable the toggle, do not manually change the routes corresponding to the toggle in the VPC (CCN) console. Otherwise, the firewall will lose the routes and cause network interruption.
After you disable the toggle, you can switch VPC routes as needed. However, do not manually enable firewall routes. Otherwise, network interruption or Firewall Toggle failures may occur.
Viewing Rules
1. On the Firewall Toggle page, click Firewall Toggle.
2. Select the desired firewall toggle and click View Rules.
3. On the VPC Border Rule page, you can view and edit rules. For detailed operations, see Firewall Border Rule.
Viewing Log
1. On the Firewall Toggle page, click Firewall Toggle.
2. Choose More > View Logs. You can choose to view traffic access control logs or traffic logs.
