Tenant Cloud Security Cloud Firewall Product Introduction

Concepts

Last Updated At: 2026-08-14 08:08:00

VPC

A VPC is a logically isolated network space in the Converge Cloud that you can customize. It operates similarly to a traditional network running in an Internet data center (IDC). The resources hosted in the cloud platform VPC include CVM, CLB, and CDB instances.
VPC provides you with:

  • Elastic IP: Used for Internet access.
  • Peering connection: Supports interconnection between VPCs.
    Through peering connections, VPCs can interconnect with each other on the cloud. Traffic between VPCs is also known as east-west traffic.

Inter-VPC Firewall

Inter-VPC Firewall is a distributed firewall that detects east-west traffic between VPCs.
Inter-VPC Firewall is deployed between two VPCs connected via a peering connection. It supports access control, topology visualization, and log auditing features, without the need for complex routing configurations or image file installations. It provides out-of-the-box and user-exclusive resource configuration.

Access Control

ACL is a collection of traffic filtering rules. All rules that take effect on the same type of traffic form an access control list. Each ACL rule is composed of the rule body and description:

  • Rule body: Used to allow or disallow the communication over a certain protocol between a port of one address and a port of another address.
  • Access source: Indicates an address that initiates the communication. It is usually an IP address.
  • Access destination: Indicates an address that receives the communication. It can be an IP address or a domain name.
  • Destination port: Indicates the port number of an access destination address.
  • Protocol: Indicates a network protocol used for communication between two parties.
  • Policy: If a certain traffic meets the preceding four conditions, it is regarded as the hit traffic, and a firewall performs the following actions based on this rule policy.
  • Allow: Allow access and record traffic logs, but do not record rule hits.
  • Observe: Allow the hit traffic to pass through, and record traffic logs and rule hits.
  • Block: Not allow the hit traffic to pass through and not record traffic logs, but record rule hits.
  • Rule description: Record the purpose of the current access control rule.

    Note:

    A reasonable and standardized rule description helps improve the rule's readability, reduce subsequent maintenance costs, and enhance efficiency.

Rule Priority

The execution order is the position of the rule in the list, and the rule with execution order 1 has the highest priority. For each data flow passing through the firewall, the firewall will match the rules in the list in a top-down order:

  • If a data flow hits a rule, the firewall executes the corresponding policy and stops matching further rules.
  • If a data flow does not hit the current rule, the firewall continues matching the next rule.
  • If a data flow hits no rules, the firewall allows the data flow by default.
  • In an access control list, the value of the execution priority is an integer ranging from 1 to n. 1 indicates the highest priority, and n indicates the total number of rules, namely, the lowest priority in the current rule list, usually used for wildcard rules.
  • Execution priorities adhere to two principles: continuity principle and non-repeatability principle.
  • Continuity principle: The execution order should be consecutive positive integers. If the number of current rules is n, the maximum value of the execution order is n.
  • Non-repeatability principle: No duplicate execution order values are allowed within the same rule list.
  • The continuity and non-repeatability of execution priorities are ensured by the following three points:
  • Adding a rule: The execution order is set to n+1.
  • Inserting a rule: The execution order is based on the insertion position. All subsequent rules will automatically shift one position backward, with their execution order values increasing by 1.
  • Editing a rule: By modifying the execution order, you can move the rule to a new position. The execution order can be adjusted to the target position's execution order value, with a minimum of 1 and a maximum of n. After you enter the target position's execution order value, the rule will be inserted at that position. All subsequent rules will automatically shift one position backward, with their execution order values increasing by 1.

Logs

  • Rule hit logs: Rule hits are recorded in rule hit logs, which help Ops personnel with security audit tasks. The rule hit logs display the five-tuple information of allowed, observed, or blocked data flows. You can view the corresponding effective rules through buttons.
  • Operation logs: CFW operation logs are classified into user login logs, toggle operation logs, and rule operation logs.
  • User login logs: Record the login information of all accounts of the current user.
  • Toggle operation logs: Record CFW toggle information.
  • Rule operation logs: Record the operations of adding, deleting, and editing access control rules.