Special Use Cases

This topic describes special scenarios of the Converge Cloud Firewall (CFW) access control feature.

Managing the Execution Priority of Rule Lists

You can manage the execution priority of Edge firewall rules, NAT firewall rules, and Inter-VPC rules.
The following takes Edge firewall rules as an example.

Scenario 1: Sorting Rules in the List

1. Log in to the Converge Cloud Firewall console and select Access Control → Edge firewall rules in the left navigation pane.
2. On the Edge firewall rules page, click Sort on the top of the list to enter the modification mode.
3. You can move the positions and priority of rules in batch within the current page and sort the rules by dragging the icons on their left.
4. When you are done, click Save.

Sort Operations:

• If you change the position of any rule when you release the mouse cursor, one sort operation has taken place.
• If you do not change the position of any rule when you release the mouse cursor, no sort operation has taken place.
• After a sort operation takes place, the Cancel button becomes active.
• Click Recover once to return the list to the state before the last sort operation.
• If you click Save, you will see a “Sorted successfully” toast at the top of the page.
• If you click Cancel, the list will return to the initial state and all sort operations will not take effect.

Scenario 2: Modifying a Rule to Move It to a Specified Position

When you need to move a rule within a large range, sorting can be inefficient. Instead, you can use the modification feature. You can modify the execution priority of only one rule at a time.

1. Log in to the Converge Cloud Firewall console and select Access Control → Edge firewall rules in the left navigation pane.
2. On the Edge firewall rules page, find the rule you want to move in the list and determine the new position.
3. Click Modify on the right to enter the rule modification mode.
4. Modify the execution priority to the desired value.

5. Click Complete and check the rule priority.

Scenario 3: Inserting a Rule to a Specified Position in an Existing List

Converge Cloud Firewall allows you to insert a rule between any two rules, and the inserted rule will be executed based on priority.

For example, if you want to insert a rule between positions 2 and 3:

1. Log in to the Converge Cloud Firewall console and select Access Control → Edge firewall rules in the left navigation pane.
2. On the Edge firewall rules page, find the rule in position 3 and click Add one above on the right.
3. The rule modification box will be displayed above the rule in position 3.
4. In the box, enter the fields of the new rule and click Complete to insert the rule.

Checking if Rules Are Effective

Method 1:
Check the hit counts in the access control list. If there are hits, the rules have taken effect.

Method 2:
Select Log Auditing → Access Control Logs in the left navigation pane to view access control logs (rule hit logs).
If a rule is included in the log, the rule has taken effect.

Operation Locking

At any one time, only one user is allowed to perform any of the following operations on a single access control list with the same AppID (the firewall ID is used for VPCs):

• Add rule
• Import rule
• Sort
• Modify
• Add one above

When performing operations on a list, you may see a toast message:
“The list is being modified by others. Please wait.”
This means another user is currently performing operations on the list.

More Information

For more information, please see Access Control in the Converge Cloud documentation.