This document describes the special use cases of the access control feature of CFW.

Managing the Execution Priorities of Rules

Managing the Execution Priorities of Inter-VPC Rules

Scenario 1: Quick Sorting of Rules in a List

1. Log in to the CFW console. In the left sidebar, choose Access Control > Inter-VPC rules to go to the Inter-VPC rules page.
2. On the Inter-VPC rules page, click Sort at the top of the list to enter the edit mode.
3. Move the positions and priorities of rules in batches within the current page, and sort the rules by dragging the icons next to them.
4. Click Save when you are done.
   Sorting instructions:

• If the position of a rule is changed after you release the mouse pointer, it indicates that one sort operation has taken place.
• If the position of a rule is not changed after you release the mouse pointer, it indicates that no sort operation has taken place.
• After a sort operation takes place, the Cancel button becomes active.
• You can click Recover once to return the list to the status after the last sort operation.
• If you click Save, you will see the toast message "Sorted successfully" at the top of the page.
• If you click Cancel, the list will return to the initial status, and all sort operations will not take effect.

Scenario 2: Moving a Rule to a Specified Position by Modifying It

When moving a rule over a large range is required, the quick sorting feature may not efficiently perform this operation. Therefore, you can use the editing feature to quickly move the current rule to a specified position. Unlike quick sorting, the editing feature allows you to modify the execution order of one rule at a time.

1. Log in to the CFW console. In the left sidebar, choose Access Control > Inter-VPC rules to go to the Inter-VPC rules page.
2. On the Inter-VPC rules page, find the rule you want to move in the list and determine the new position.
3. On the right side of the rule, click Edit to enter edit mode.
4. Modify the execution priority to the desired value.
   • Execution priorities adhere to the continuity and non-repeatability principles. When you move a rule by modifying it, you need to ensure that the minimum value of the execution priority is 1 and its maximum value is the total number of rules in the current list.
5. Click Complete and check whether the priorities of rules in the list are as expected.
   When you modify the execution priority of a rule in the list, the positions of all other rules will be automatically adjusted.

Scenario 3: Inserting a Rule to a Specified Position in an Existing List

CFW supports inserting a rule between any two rules. The execution order of the inserted rule is the current insertion position.
Rules are inserted in a pre-insertion manner. If you need to insert a new rule between rules with execution orders "2" and "3":

1. Log in to the CFW console. In the left sidebar, choose Access Control > NAT firewall rules to go to the NAT firewall rules page.
2. On the NAT firewall rules page, find the rule in position 3 in the list and click Insert on the right side of the rule.
3. A rule editing box will be displayed above the rule in position 3.
4. In the rule editing box, enter the rule fields and click Complete to complete the rule insertion operation. After the insertion operation is completed, the execution priority values of all rules after the inserted rule automatically increase by 1.

Checking Whether Rules Take Effect

• Method 1: Check the hit count of a rule in the access control list. If there are hits, the rule has taken effect. If a rule has zero hits, it does not mean that it is incorrectly configured. The rule may simply have no hits or not take effect for the time being.
• Method 2: Choose Log Audit > Access Control Logs in the left sidebar to view access control logs (rule hit logs). If a rule is included in the logs, it indicates that the rule has taken effect.

Operation Locking

• At any one time, only one user is allowed to execute any one of the following operations on a single access control list with the same AppID (the firewall ID is used for VPCs): Add Rule, Import Rule, Sort, Edit, and Insert.
• When performing operations on a list, you may see the toast message "The list is being edited by others and is locked. Please try again later." at the top of the page. This means that another user is performing operations on the list.
• Operations are locked for 5 minutes and will be automatically unlocked after that time period.