When VPC Firewall (cluster mode) and NAT Firewall (cluster mode) use the automatic connection method, if the protected traffic involves communication between two VPCs in the same region, you need to enable same-city traffic steering for the relevant VPCs. This document describes the scenarios that require same-city traffic steering and how to apply for it.
VPC Firewall (Cluster)
Activation Requirements
When traffic passing through the firewall includes traffic between two VPCs in the same region, same-city traffic steering must be enabled for both VPCs involved.
Example 1: Multi-point Interconnection
Interconnection rules include the following instances:
|
A,B,C | Guangzhou | VPC |
D,E | Beijing | VPC |
F | Shanghai | VPC |
G | Guangzhou | Direct connect gateway |
There is same-city (Guangzhou) traffic between A, B, and C, and same-city (Beijing) traffic between D and E. Therefore, same-city traffic diversion must be enabled for A, B, C, D, and E.
There are no other VPCs in the region where F resides (Shanghai), so no enablement is required.
G is a Direct Connect gateway and is not included in the determination.
Example 2: Multi-point to Multi-point Interconnection
Interconnection rules include two instance groups:
|
Instance group 1 | A (Guangzhou, VPC), B (Guangzhou, VPC), C (Beijing, VPC), D (Shanghai, VPC) |
Instance group 2 | E (Beijing, VPC), F (Beijing, Direct Connect gateway) |
In a multipoint-to-multipoint rule, only traffic between different instance groups passes through the firewall.
There is same-city (Beijing) traffic between C (Beijing, VPC) and E (Beijing, VPC) that crosses instance groups. Therefore, same-city traffic steering must be enabled for C and E.
A and B belong to the same instance group (Group 1), and same-group traffic does not pass through the firewall, so no enablement is required.
F is a Direct Connect gateway and is not included in the determination.
NAT Firewall (Cluster)
Activation Requirements
When at least one of the connected VPCs is in the same region as the VPC where the NAT Gateway resides, same-city traffic steering must be enabled for the VPC where the NAT Gateway resides. The connected VPCs do not require enablement.
Example 1: Same-Region VPCs Exist
The VPC where the NAT Gateway resides is in Guangzhou. The connected instances are as follows:
|
A | Guangzhou | VPC |
B | Beijing | VPC |
C | Guangzhou | Direct Connect gateway |
A and the VPC where the NAT Gateway resides are both in Guangzhou. Therefore, same-city traffic steering must be enabled for the VPC where the NAT Gateway resides.
Example 2: No Same-Region VPCs Exist
The VPC where the NAT Gateway resides is in Guangzhou. The connected instances are A (Beijing, VPC), B (Shanghai, VPC), and C (Guangzhou, Direct Connect gateway).
If none of the connected VPCs is in the same region as the NAT Gateway (C is a Direct Connect gateway and is not included), you do not need to enable same-city traffic steering.
Operation Steps
After confirming the VPCs that require same-city traffic steering, submit a ticket to CCN and provide the following information: |
VPC instance ID list | VPCs that require same-city traffic steering based on the rules in this document. |
CCN instance ID | CCN instances to which the VPCs that require same-city traffic steering based on the rules in this document belong. |
Must-Knows
Direct Connect gateways (DCGWs) are not included in the scope of same-city traffic steering determination.
If the VPC has enabled the same-city direct connection feature, you must disable it first. Otherwise, the automatic connection policy-based routing will not take effect.
The CFW console checks whether same-city traffic steering is enabled for VPCs that are connected for protection. If it is not enabled, an abnormal reminder is displayed. Follow the instructions to submit a ticket to complete the enablement.