Product Features
Inter-VPC CFW provides traffic control and security protection for private network VPCs and inter-VPC access. It supports cross-region and cross-tenant traffic access control, and offers the IPS feature.
Use Cases of Inter-VPC CFW
| Working Mode | Prerequisite | Use Case |
|---|---|---|
| Normal mode | A peering connection between VPCs has been established, the route table has been completed, and the VPCs can communicate with each other. | Inter-VPC Firewall can manage inter-VPC access traffic under a single tenant. |
| Administrator mode | A peering connection between cross-tenant VPCs has been established, the route table has been completed, and cross-tenant VPCs can communicate with each other. | Each tenant is responsible for managing the traffic that other tenants access the VPCs of this tenant, and the administrator mode can be used as the normal mode. |
| Multi-account mode | A peering connection between cross-tenant VPCs has been established, the route table has been completed, and cross-tenant VPCs can communicate with each other. | CFW needs to be created under multiple accounts across tenants, and traffic passes through two firewalls for access control. |
Principles of Traffic Routing for Inter-VPC Firewall
- As shown in the preceding figure, VPC 1 and VPC 2 of the tenant are connected to the firewall. Traffic routing should be implemented first. In this example, a cross-tenant ENI is used to achieve traffic routing. The main implementation principles are as follows:
- FW is an overlay instance of the reserved account.
- Each VPC connected to the inter-VPC firewall will be assigned a firewall subnet, and a cross-tenant ENI will be created for the firewall. This ENI serves as a traffic routing NIC of the VPC and will be assigned a high-availability virtual IP address, to achieve high availability.
- If you switch the next hop route to the high availability virtual IP address of the traffic routing NIC, the traffic will be directed to the firewall.