Note:
CFW runs in a CVM environment. For performance reasons, CVMs of different specifications are bound to different numbers of ENIs. The following describes the specification metrics supported by CFW.
VPC CFW Specification Metrics
- A VPC CFW instance supports a maximum of 10 VPCs.
- A group of VPC CFWs supports a maximum of 10 VPC CFW instances.
- Each tenant has no limit on the number of firewall groups. Each tenant has a total bandwidth limit. You can adjust the total bandwidth limit of a tenant on the cloud platform.
- The performance of a VPC CFW instance is related to the engine CVM configurations. For details, see CFW detection engine performance metrics.
| Firewall Specifications | CVM Specifications | Number of Connected VPCs |
|---|---|---|
| 0M-600M | 4c8g | 2 |
| 600M-2048M | 8c16g | 4 |
| 2048M-4096M | 16c32g | 6 |
| 4096M-6144M | 32c64g | 10 |
| 6144M-10240M | 64c128g | 10 |
NAT CFW Specification Metrics
- A NAT CFW instance supports a maximum of 10 VPCs.
- A NAT CFW instance supports a maximum of 8 EIPs.
- A NAT CFW instance supports a maximum of 5 NAT gateways.
- A NAT CFW instance supports a maximum of 6 Gbps outbound bandwidth.
- A NAT CFW instance can be connected to an EIP or a NAT gateway. However, it cannot be connected to them simultaneously.
- Each tenant has no limit on the number of NAT CFW instances. Each tenant has a total bandwidth limit. You can adjust the total bandwidth limit of a tenant on the cloud platform.
- The performance of a NAT CFW instance is related to the engine CVM configurations. For details, see CFW detection engine performance metrics.
| Firewall Specifications | CVM Specifications | Maximum Number of Connected VPCs | EIP (New Mode) | NAT Gateway (Access Mode) |
|---|---|---|---|---|
| 0M-600M | 4c8g | 2 | 1 | 1 |
| 600M-2048M | 8c16g | 4 | 2 | 2 |
| 2048M-4096M | 16c32g | 6 | 4 | 3 |
| 4096M-6144M | 32c64g | 10 | 8 | 5 |
CFW Detection Engine Performance Metrics
Since the maximum configuration of a physical server NIC is 10 Gbps, the maximum traffic (including inbound and outbound traffic) of the CFW cannot exceed 10 GB, and the number of new connections and concurrent connections are also subject to CVM specifications.
Throughput test results: An 8-core 16 GB CVM model supports 2.33 GB of traffic.
A 64-core 128 GB CVM model supports 4.8 GB of traffic. Its packet loss rate is 0%, and its blocking rate is 100%. The inbound and outbound traffic passing through CFW is about 9.6 GB.
Test Scenario Packet Sending Network Stream Sending PPS for eth1 Receiving PPS for eth0 Bandwidth CVM Configuration Engine CPU Utilization Ping Packet Loss Rate (%) Ping Latency (ms) One-way packet sending udp - - 1400 Client 461248 463488 4.8Gbps S3: 64-core and 128 GB 8.9 0 1.2 Firewall eth1 461177 462273 / / Firewall eth2 461080 463378 / / Server 0 471740.4 Ping packet blocking rate: 100% / Bidirectional packet sending udp - - 1400 Client 444224 451072 4.8Gbps S3: 64-core and 128 GB 8.8 0 1.4 Firewall eth1 461481 461481 / / Firewall eth2 461168 468855 / / Server 460416 462720 Ping packet blocking rate: 100% / Concurrent connection test results for an 8-core 16 GB model:
Scenario Use Case Maximum Number of Concurrent Connections Maximum number of concurrent TCP connections Peering connection 999999 Firewall without rules 871881 Firewall - Adding 5,000 rules with one rule hit 786516 Adding 5,000 rules with only the last rule hit 837350 New connection test results for an 8-core 16 GB model:
Scenario Use Case Maximum Number of HTTP Requests Per Second Maximum number of new HTTP connections per second Blank page 47359 1 KB page 61530 2 KB page 58456 4 KB page 54912 16 KB page 22179 21 KB page 17098 64 KB page 5724