Network Perimeter

The network perimeter is the boundary between the Internet and Converge Cloud's internal network.
The network perimeter traffic, also known as north-south traffic, is the traffic generated during communication between cloud assets and the Internet.

North-south traffic is the traffic between public IP addresses and can be divided into the following:

• Outbound traffic: The traffic generated when cloud assets communicate with the Internet through the bound public IP address.
• Inbound traffic: The traffic generated when the Internet communicates with the cloud assets.

Edge Firewall

The edge firewall is a firewall for clusters that monitors north-south traffic.
It defends the boundary between the assets associated with your Elastic IP (EIP) and the Internet.

The edge firewall offers:

• Access control
• Log audit
• Built-in intrusion defense module
• Default cluster deployment

It is out-of-the-box and easy to scale without complex network configurations or image installation.

Virtual Private Cloud (VPC)

A Virtual Private Cloud (VPC) is a custom and logically isolated network space on Converge Cloud.
Similar to a traditional network running in a local data center, your VPC hosts your cloud resources including CVM, CLB, and CDB.

A VPC offers you:

• EIP: Used to access the Internet.
• Peering Connection: Supports communication between VPCs.
  View Peering Connection Documentation

Cloud VPC connection can be achieved using Peering Connection , and the traffic between two VPCs is called east-west traffic.
View Virtual Private Cloud Documentation

Inter-VPC Firewall

The Inter-VPC Firewall is a distributed firewall that monitors east-west traffic between VPCs.
It defends the boundary between two VPCs.

The Inter-VPC Firewall is deployed between two VPCs connected through Peering Connection and offers:

• Access control
• Topology visualization
• Log audit
• Exclusive resource configuration

It is out-of-the-box without complex routing configurations or image installation.

Access Control

Access control is a collection of traffic filtering rules.
An access control list (ACL) contains all the rules for the same type of traffic.
Each access control rule is composed of the rule body and description.

Rule Body

Defines the following:

• Access source: The address of the source (usually an IP address).
• Access destination: The address of the destination (IP address or domain name).
• Destination port: The destination port of the communication.
• Protocol: The network protocol used for the communication.
• Policy: The action to perform for matching traffic.

Policy Types

• Allow: Allows access and records traffic logs (no rule hit logs).
• Observe: Allows access and records both traffic and rule hit logs.
• Block: Denies access and records rule hit logs (no traffic logs).

Rule Description

Describes the purpose of this access control rule.

Rule Priorities

The priority indicates a rule’s position in the list, where 1 is the highest priority.

For any data flows that go through the firewall, Converge Cloud Firewall (CFW) matches them from top to bottom:

1. If a data flow matches a rule, matching stops and the policy is applied.
2. If a data flow does not match the current rule, it moves to the next.
3. If it does not match any rule, it is allowed by default.

Priority values are integers from 1 to n, where 1 is the top and n is the lowest.

Rules of Priority

• Continuity: Priorities must be consecutive integers.
• Uniqueness: No duplicate priorities allowed.

When adding or editing rules:

• Adding a new rule sets its priority to n+1.
• Inserting a rule shifts subsequent priorities by +1.
• Editing a rule’s priority automatically reorders the list.

Intrusion Defense

Intrusion Defense monitors network transmission and detects suspicious activities.
When a suspicious event is detected, the system can send alerts or take proactive measures.

CFW integrates Converge Cloud’s threat intelligence, basic protection, and virtual patching capabilities.

By performing real-time monitoring, statistics, and analysis on network perimeter traffic, CFW can detect:

• Intrusions
• Malicious outgoing requests
• Unknown risks

It provides real-time protection and alerts across Philippine regions.

Logs

Rule Hit Logs

Records the rule hits to assist in security audits.
The rule matching logs display the 5-tuple information of all allowed, observed, or blocked data flows.
You can view which rule was applied by clicking a button.

Operation Logs

Operation logs include:

• User login logs – Track all account login activities.
• Toggle operation logs – Record enabling and disabling of firewalls.
• Rule operation logs – Record add, delete, and edit operations on access control rules.