CreateVpcFirewallCenConfigure-阿里云帮助中心

Creates a VPC border firewall (protects mutual access traffic between network instances within a Cloud Enterprise Network (CEN) and a specified VPC).

Operation description

This operation is generally used to create a VPC border firewall for VPC instances within a Cloud Enterprise Network (CEN). The VPC border firewall can protect mutual access traffic between network instances within the CEN (network instances include VPCs, VBRs, and CCNs) and a specified VPC. It does not support protecting mutual access traffic between VBR and VBR, CCN and CCN, or VBR and CCN. For more information, see VPC border firewall limits.

QPS limit

The single-user QPS limit for this operation is 10 calls per second. If the limit is exceeded, API calls will be throttled, which may affect your business. Please call this operation as needed.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-cloudfirewall:CreateVpcFirewallCenConfigure

create

*VpcFirewallCen

acs:yundun-cloudfirewall::{#accountId}:vpcfirewallcen/*

None

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language type for the request and response messages. Valid values: zh (default): Chinese. en: English.	zh
VpcFirewallName	string	Yes	The instance name of the VPC border firewall.	vpc-firewall-test
NetworkInstanceId	string	Yes	The VPC instance ID for which the VPC border firewall is created.	vpc-bp10zlifxh6j0232w****
VpcRegion	string	Yes	The region ID of the VPC for which the VPC border firewall is created. Note For more information about the regions supported by Cloud Firewall, see Supported regions.	cn-hangzhou
FirewallSwitch	string	Yes	The switch status of the VPC border firewall. Valid values: open (default): Protection is automatically enabled after the VPC border firewall is created. close: Protection is not automatically enabled after the VPC border firewall is created. You can call the ModifyVpcFirewallCenSwitchStatus operation to enable protection.	open
CenId	string	Yes	The Cloud Enterprise Network (CEN) instance ID.	cen-x5jayxou71ad73****
MemberUid	string	No	The member account UID of the current Alibaba Cloud account.	258039427902****
VSwitchId	string	No	The vSwitch ID to which the Cloud Firewall interface belongs.	vsw-qzeaol304m***
FirewallVpcCidrBlock	string	No	The VPC CIDR block used by the firewall. You must configure a CIDR block with a subnet mask no larger than 28 bits to allocate a VPC CIDR block for the firewall creation process. This is used to automatically create a firewall security VPC (Cloud_Firewall_VPC) for traffic redirection. If this parameter is not specified, the CIDR block 10.0.0.0/8 is automatically allocated by default. Note This parameter is only valid when a VPC firewall is created for the first time in this CEN region.	10.0.0.0/8
FirewallVpcZoneId	string	No	The primary availability zone ID of the firewall. If your business is latency-sensitive, you can customize the firewall availability zone to be the same as your business VPC vSwitch availability zone to reduce latency. If this parameter is not specified, the firewall availability zone is automatically allocated by default. Note This parameter is only valid when a VPC firewall is created for the first time in this CEN region.	cn-hangzhou-a
FirewallVSwitchCidrBlock	string	No	The vSwitch CIDR block used by the firewall. You must configure a CIDR block with a subnet mask no larger than 29 bits that does not conflict with the network plan to allocate a vSwitch CIDR block for the firewall creation process. This is used to automatically create a vSwitch (Cloud_Firewall_VSWITCH) within the firewall security VPC for traffic redirection. The vSwitch CIDR block must be a subnet of the firewall VPC CIDR block. If this parameter is not specified, the CIDR block 10.219.219.216/29 is automatically allocated by default. Note This parameter is only valid when a VPC firewall is created for the first time in this CEN region.	10.0../28
FirewallVpcStandbyZoneId	string	No	The standby availability zone ID of the firewall. The firewall automatically switches to the standby availability zone and continues to run only when the primary availability zone service is unavailable. If this parameter is not specified, the firewall standby availability zone is automatically allocated by default. Note This parameter is only valid when a VPC firewall is created for the first time in this CEN region.	cn-hangzhou-b

Response elements

Element	Type	Description	Example
	object
VpcFirewallId	string	The instance ID of the VPC border firewall.	vfw-m5e7dbc4y****
RequestId	string	The request ID.	850A84D6-0DE4-4797-A1E8-00090125h4j6

Examples

Success response

JSON format

{
  "VpcFirewallId": "vfw-m5e7dbc4y****",
  "RequestId": "850A84D6-0DE4-4797-A1E8-00090125h4j6"
}

Error codes

HTTP status code	Error code	Error message	Description
400	ErrorAliUid	The aliuid is invalid.	The aliuid is invalid.
400	ErrorVpcFirewallExist	The firewall has been configured and cannot be created repeatedly.	The firewall is configured and cannot be repeatedly created.
400	ErrorVpcId	The VPC ID is invalid.	The VPC ID is invalid.
400	ErrorRegionNoError	The region is invalid.	The region is invalid.
400	ErrorVpcFirewallNotFound	The specified VPC firewall does not exist. Please select again.	The specified VPC firewall does not exist. Enter another value.
400	ErrorDBSelectError	A database select error occurred.	The error message returned because an internal error has occurred in querying the database.
400	ErrorDBTxError	A database transaction error occurred.	The error message returned because an internal error has occurred in the database transaction.
400	ErrorDBUpdateError	A database update error occurred.
400	ErrorRecordLog	An error occurred while updating the operation log.	An error occurred while updating the operation log.
400	ErrorCenVbrNotSupport	云企业网vbr不支持开防火墙
400	ErrorCenNotSupportCCN	VPC防火墙云企业网CCN实例, 不支持开启VPC防火墙
400	ErrorCenNotSupportMultipleAccounts	The current version of Cloud Firewall does not support multiple accounts when it uses VPC Firewall to protect Cloud Enterprise Network. Upgrade the specifications and try again.	The current edition of Cloud Firewall does not support multiple accounts when it uses VPC Firewall to protect CEN. Upgrade the specifications and try again.
400	ErrorFirewallStatus	Firewall status error, please try again later.	The status of the firewall is invalid. Try again later.
400	ErrorFirewallQuotaNotEmpty	quota is not enough, unable to configure VPC firewall, please increase quota first.
400	ErrorHubvpcCannotCreate	HUB VPC不允许创建防火墙
400	ErrorCenVpcEcConflict	The VPC of the cloud enterprise network conflicts with the VPC of the high-speed channel, and the firewall cannot be opened. Please select again	Conflicts occur between the VPC of CEN and the VPC of Express Connect. You cannot enable the firewall. Specify another value.
400	ErrorRegionNoDisable	There are unsupported regions, please reselect	Some regions are not supported. Specify supported regions.
400	ErrorCenFirewallVpcNumInvalid	云企业网vpc数量不足, 无法开启VPC边界防火墙
400	ErrorDestCidrError	The target network segment is wrong. Please configure the target network segment correctly.	The specified destination CIDR block is invalid. Enter another value.
400	ErrorVpcCustomRouteTableWithVswitch	VPC存在自定义路由表且关联了vswitch, 不允许创建VPC防火墙
400	ErrorCenNotSupportTREnterpriseAutoMode	VPC firewall does not support TR Enterprise Edition auto mode protection, please use manual mode protection	VPC firewalls do not support the CEN-TR automatic mode.
400	ErrorInvalidMemberUid	Member uid is invalid	The member is invalid.
400	ErrorFirewallName	Firewall name invalid.	Firewall name error, please re-enter.
400	ErrorFirewallSwitch	The firewall enabling parameter is incorrect. Please select again.	The specified switch of the firewall is invalid. Enter another value.
400	ErrorNetworkInstanceIdError	Network InstanceId ID is invalid	The ID of the network instance is invalid.
400	ErrorCenId	CEN ID is error	The ID of the CEN instance is invalid.
400	ErrorCidrFormat	Cidr ip format error.	CIDR format error, please re-select
400	ErrorDestCidrEmpty	The target network segment is empty and cannot be created	The destination CIDR block is not specified. The firewall cannot be created.
400	ErrorOwnerId	owner id invalid.	The account is incorrect, please re-enter.
400	ErrorCenManualFirewallExist	VPC firewall in manual mode already exists in this CEN network. You are not allowed to create a VPC firewall in automatic mode.	This CEN already has a VPC firewall in manual mode. You cannot create a VPC firewall in automatic mode.
400	ErrorFirewallExistDeleting	There is a VPC firewall that is being deleted, and it is not allowed to create.	The VPC firewall being deleted is not allowed to be created.
400	ErrorSameCidrIp	The same network segment cannot be configured repeatedly. Please reselect the network segment.	The CIDR block is already in use. Specify another CIDR block.
400	ErrorCenRouteMapExist	cen route map is exist.	Creating a VPC perimeter firewall is not allowed RouteMap it already exists. Please contact the cloud firewall after-sales technical support.
400	ErrorUserCredentials	User credentials failed.	Unauthorized, not accessible, please first authorize firewall permissions.
400	ErrorDBNoRow	No rows in database.	No data found.
400	ErrorVpcFirewallVpcNumLimit	The number of vpcs in this region is limited to open the vpc firewall.	The VPC boundary firewall cannot be enabled because of the limited number of VPCs in this region.
400	ErrorCenExistPublicCidr	cen domain route exist public route.	There is a public network segment in the cloud enterprise network, and the VPC boundary firewall is not supported.
400	ErrorCenExistTrRoute	Cen VPC route exist tr route.	The VPC in the cloud enterprise network has a route whose next hop is TR, and the VPC boundary firewall is not supported.
400	ErrorCenTRAssociationCustomRouteTable	CEN-TR association custom route table.	The VPC boundary firewall does not support the custom route table associated with the CEN-TR network instance connection, and the VPC boundary firewall cannot be enabled.
400	ErrorDBInsertError	A database insert error occurred.	An error occurred while performing an insert operation in the database.
400	ErrorVpcFirewallZoneId	VPC firewall zone error.	VPC firewall zone selection error
400	ErrorInvalidMemberUidStatus	invalid member uid status.	The status of the member account is invalid. This operation is not supported.
400	ErrorBandwidthPenalty	Cloud Firewall bandwidth is being overused.	Cloud Firewall bandwidth is being overused.
400	ErrorGeneralInstanceSpecFull	Cloud Firewall instance specifications are full.	Cloud Firewall instance specifications are full.
400	ErrorFirewallVSwitchCidrConflict	Firewall switch network segment conflicts with business network segment.	Firewall switch network segment conflicts with business network segment

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.