What Is CFW?

CFW is a SaaS firewall product developed by the security team based on cloud native strengths. It provides users with inter-VPC and NAT firewall protection and addresses unified cloud access control management and log audit. In addition to the features of traditional firewalls, CFW supports multi-tenancy on the cloud and is an essential network security infrastructure for users to migrate their businesses to the cloud.

Features

Overview

CFW provides users with a unified network access control center. Through the Overview page in the console, tenants can intuitively see all content related to the firewall, including the following modules:

• Asset protection overview: Displays information such as traffic bandwidth statistics, security policy configurations, and log storage statistics.
• Firewall status monitoring: Displays the peak bandwidth of the NAT boundary and between VPCs within the past 7 days.
• Traffic statistics: Display the volume of total traffic between VPCs within the past 24 hours to 6 months.
• Security policy configuration: Displays the number of access control rules configured for the Internet boundary, NAT boundary, or between VPCs, and their remaining quotas.
• Log storage statistics: Display the total log storage capacity, existing capacity, and remaining available capacity.

CFW Instances

• NAT firewall switch: A NAT firewall is a virtualized firewall that works similarly to a NAT gateway. It can provide network address translation and security audit features, such as access control and log retention.
  After a NAT firewall instance is activated and created, the system automatically identifies the subnets within the VPC in the selected region. Users only need to locate the subnet to be connected and enable the firewall switch. The system then automatically modifies the subnet route to redirect the Internet traffic of the subnet to the NAT firewall. Users can configure access control lists on the NAT firewall to filter out and manage traffic.
• Inter-VPC firewall switch: The system automatically identifies the quantity, connectivity status, and connection methods of VPCs in the private network of the cloud tenant and displays them through a visual VPC network topology view. If the inter-VPC firewall is used for the first time, you need to enable the unified inter-VPC firewall switch. After the switch is enabled, the system automatically configures sub-firewalls between every two interconnected VPCs for users. Users can enable or disable the sub-firewalls and configure access control rules based on the mapping relationships between VPCs.
• Cross-tenant VPC toggle
  On the basis of the existing Inter-VPC Firewall, protection against cross-tenant peering connections is added, allowing users to deploy the protection solutions with the same experience for multiple VPCs with multiple accounts.

Asset Center

Asset Center allows you to view and manage data and information related to each asset. You can better understand the current status of assets, manage assets, and predict and prevent security incidents by viewing the private network assets and detailed information on all your VPCs.

Traffic Center

Traffic Center displays inter-VPC activities based on the traffic access between VPCs.

Access Control

Access control rules are a collection of security policies, defined in a five-tuple form and arranged in a list. For each data stream passing through internet boundaries, CFW matches the five-tuple information according to the execution order of the rule list. If a matching data flow appears, the corresponding operation is performed on the data stream according to the action of the matched rule, thus meeting the tenant's access control protection requirements for public IP addresses and fulfilling the user's security Ops audit needs through log records.

Intrusion Prevention

CFW automatically identifies unknown risks beyond the access control rules based on its protection mode. It conducts intrusion prevention rule detection on the north-south traffic of public network IP addresses. It also prevents vulnerabilities in CVM from being exposed to the Internet.

Log Audit

CFW provides a 7-day rule hit logging feature, which can record all the traffic and corresponding effective rules of the executed firewall actions, assist security Ops personnel in auditing work, and quickly troubleshoot and repair network connection failures by searching logs. You can also view operation records for the past 30 days to improve the work efficiency of enterprises and network security administrators and reduce management costs.

Log Analysis

In Log Analysis, you can view the detailed traffic logs stored in CFW based on the login account. In addition, Log Analysis supports log search and query based on search statements, and provides report generation and statistical analysis services.