Overview of access control policies
After you enable Cloud Firewall, all traffic is allowed by default if no access control policies are configured. To manage unauthorized access to your assets, you can configure specific policies to allow or block traffic based on your business requirements. This topic describes how Cloud Firewall access control policies work and explains the related billing.
Overview
Cloud Firewall provides access control policies for the internet firewall, NAT firewall, VPC firewall, and internal firewall. You can configure access control policies for different firewalls to block unauthorized traffic and enforce security isolation and control over multiple traffic paths. The principles described in this topic apply only to access control policies for the internet firewall, NAT firewall, and VPC firewall.
For more information about access control policies for the internal firewall, see security group configuration.
For more information about access control policies for DNS domain names, see Configure DNS boundary access control policies.
Policy elements
An access control policy identifies and matches traffic based on different elements to allow or deny the corresponding traffic.
Match item | Description | Configuration type | Supported configurations |
Source | The initiator of the network connection. |
|
|
Destination | The receiver of the network connection. | Supports IP, ip address book, domain name, and region.
|
|
Protocol type | The transport layer protocol. | Supports TCP, UDP, ICMP, and ANY. You can select ANY if the specific protocol type is unknown. | All policies support all types. |
Port | The destination port. | Controls traffic based on the destination port, supporting single ports, port ranges, and port address books. |
|
Application | The application layer protocol. | Supports multiple protocols such as HTTP, HTTPS, SMTP, SMTPS, SSL, FTP, IMAPS, and POP3. You can select ANY if the specific application type is unknown. Note Cloud Firewall identifies the application type of TLS and SSL traffic based on the port.
| Depends on the selected protocol type. |
How it works
If you do not configure any access control policies, Cloud Firewall allows all traffic by default.
After you configure access control policies, Cloud Firewall expands each policy into one or more matching rules based on specific logic and deploys them to the engine. When traffic passes through Cloud Firewall, it is matched against the policies in order of priority. If a traffic packet matches a policy, the corresponding action is executed, and the matching process stops. If traffic does not match a policy, the next policy in the priority order is evaluated. If traffic does not match any configured access control policy, it is allowed by default.
After you create, modify, or delete an access control policy, Cloud Firewall takes about three minutes to deploy the policy to the engine.
The smaller the priority value, the higher the priority. To ensure optimal policy matching, we recommend that you set higher priorities for frequently matched and more specific policies.
The following figure shows how an access control policy works.
Policy actions
The action for an access control policy can be set to Allow, Monitor, or Deny. When traffic matches an access control policy, Cloud Firewall performs the specified action.
If a policy's action is set to Monitor, Cloud Firewall allows the matching traffic. After an observation period, you can change the action to Allow or Deny.
You can go to the Traffic Logs page to view traffic data. For more information, see Log audit.
Policy quota
After you configure an access control policy, Cloud Firewall calculates the quota consumed by each policy based on the number of objects in the source, destination, protocol type, port, and application fields.
Calculation method
The policy quota is calculated using the following formulas:
Quota consumed by a single policy = Number of source addresses (number of CIDR blocks or regions) × Number of destination addresses (number of CIDR blocks, regions, or domain names) × Number of port ranges × Number of applications
Total consumed quota = Sum of the quota consumed by all access control policies (including inbound and outbound policies)
On the Policy Configuration page, you can view the Used and the Edition Specifications limit in the Policy Settings section at the top.
Billing
Each Cloud Firewall edition comes with a default policy quota. For Ultimate Edition instances, if the policy quota is insufficient, you can contact your account manager to increase the quota. For more information, see Subscription 2.0 and Pay-as-you-go 2.0.
Calculation examples
Related documents
To manage traffic between Internet-facing assets and the internet, see Configure an access control policy for the internet firewall.
To manage traffic from private network assets to the internet, see Configure an access control policy for the NAT firewall.
To manage traffic between VPCs and between VPCs and on-premises data centers, see Configure an access control policy for a VPC firewall.
To manage traffic between ECS instances, see security group configuration.
For configuration rules and scenario examples for access control policies, see Access control policy configuration examples.
If you use both Cloud Firewall and Bastionhost, you must properly configure access control policies to prevent access from Bastionhost from being inadvertently blocked. For more information, see Best practices for access control policies when Cloud Firewall is deployed with Bastionhost.