How to evaluate the required NAT firewall specifications before purchase-Cloud Firewall(Cloud Firewall)-阿里云帮助中心

When you select a NAT firewall, you must determine the required specifications based on factors such as your business traffic and budget. This topic provides practical examples to help you evaluate the required specifications, allocate resources efficiently, and reduce costs.

NAT firewall specifications

For more information about the number of NAT firewall instances and the private network traffic processing capacity for the pay-as-you-go billing method, see Pay-as-you-go 2.0.
For more information about the number of NAT firewall instances and the private network traffic processing capacity for subscription editions (Premium Edition, Enterprise Edition, and Ultimate Edition), see Subscription 2.0.

Procedure

Step 1: Count NAT gateways

Method 1: Cloud Firewall console

Log on to the Cloud Firewall console.
In the left-side navigation pane, click Firewall.
On the NAT Firewall tab, count the number of NAT gateways that you want to protect.

Method 2: NAT Gateway console

Log on to the NAT Gateway console.
In the top navigation bar, select the region where you want to create the NAT gateway.
On the Internet NAT Gateway page, review the list of Internet NAT Gateways.
On the Internet NAT Gateway page, count the number of gateways that you want to protect.

Step 2: Calculate required NAT private traffic capacity from historical data

Select historical data from a period of 7 days or more.

Method 1: Evaluate using Cloud Firewall (recommended)

This method provides a more accurate estimate of the required NAT private traffic capacity.

Important

This method applies if you have enabled the internet boundary firewall. Calculate the peak traffic for all NAT EIPs from the Outbound Connections page of the internet boundary firewall. Then, use the peak traffic of the NAT EIPs to estimate the required NAT private traffic capacity.

Log on to the Cloud Firewall console.
In the navigation pane on the left, choose Analysis > Outbound Connections.
On the Public IP Address tab of Traffic Analytics, search for the public IP addresses (NAT EIPs) of the NAT gateway for which you want to enable the NAT firewall. Then, get the total peak traffic of the NAT gateway.
Sum the peak traffic rates for all NAT gateways.

Method 2: Evaluate using an NAT gateway

Important

If you use this method to estimate the required NAT private traffic capacity, the result may be inaccurate. This is because NAT Gateway and Cloud Firewall calculate bandwidth differently. Enable the NAT firewall based on the initial estimate. Then, upgrade or downgrade your Cloud Firewall edition or specification later as needed.

Log on to the NAT Gateway console.
In the top navigation bar, select the region where you want to create the NAT gateway.
On the Internet NAT Gateway page, find the NAT gateway for which you want to enable the NAT firewall. In the Monitor column, click the icon to view the metrics.
For a more accurate estimate, view traffic data from the last 7 days or longer.
Sum the peak traffic rates for all NAT gateways.

Step 3: Understand NAT firewall specifications in different Cloud Firewall editions

For the NAT gateway instances and private traffic processing capacity of NAT firewalls in the pay-as-you-go edition of Cloud Firewall, see Pay-as-you-go 2.0.
For the protection specifications of the NAT firewall in the subscription editions of Cloud Firewall (Premium, Enterprise, and Ultimate editions), see Subscription 2.0.

Step 4: Evaluate NAT firewall specifications and purchase Cloud Firewall

Evaluate the required Cloud Firewall edition and NAT firewall traffic processing capacity based on your service's private network traffic over the last seven days, your future needs, and the processing capacity of different Cloud Firewall editions.

If your future services require no more than 20 NAT firewall instances and a traffic processing capacity of 1000 Mbps or less for each, select the Cloud Firewall Premium Edition. This choice is supported by the evaluation results from both methods in this example.

The base price of the Cloud Firewall Premium Edition does not include NAT firewall instances or their traffic processing capacity by default. However, this edition supports expansion. The preceding evaluation results are within the expansion range for the Premium Edition.

For more information, see Purchase Cloud Firewall service.