FAQ about the billing of Cloud Firewall
Common questions about Cloud Firewall billing, quotas, and billing method changes.
How do I increase the quota for a billable item if the quota is insufficient?
Purchase additional quota for the item you need. Cloud Firewall supports quota increases for the following billable items:
Protected Public IP Addresses
Protected Internet Traffic
Protected VPCs
Protected VPC Traffic
Quota for Additional Policy
For step-by-step instructions, see Upgrade and downgrade Cloud Firewall.
Does Cloud Firewall that uses the pay-as-you-go billing method support the log analysis and VPC Firewall features?
Yes. Both the log analysis and VPC Firewall features are available under pay-as-you-go. For a full list of supported features by billing method, see Functions and features.
Why are bills generated for a pay-as-you-go instance if Cloud Firewall is not used?
In addition to the border firewall, features such as log analysis, threat intelligence (IPS), and Sensitive Data Leak Detection are billed separately.
To completely stop billing, log on to the Cloud Firewall console. In the upper-right corner of the Overview page, select . After you release the instance, the system generates a final bill the next day (T+1) that includes charges incurred before the release. No new bills are generated after that.
Why are bills generated after a pay-as-you-go instance is released?
If you are billed after a pay-as-you-go instance is released, it is usually for the following reasons:
Delayed billing: Pay-as-you-go instances are billed daily. After you release an instance, the system generates a bill on the next day (T+1). This bill includes charges incurred before the release. No new bills are generated after this.
Late instance release: If you do not manually release an instance after its free trial or savings plan expires, you will continue to be billed for the service at the standard rate.
Incorrect service termination: Disabling border firewall protection does not stop billing. To stop billing completely, Log on to the Cloud Firewall console. on the Overview page, in the upper-right corner, select .
Can I manually release Cloud Firewall before it expires?
Yes. The release window depends on your billing method:
Subscription: You can release Cloud Firewall up to 15 days before it expires, or within 7 days after it expires.
ImportantNo refunds are issued after you manually release a subscription instance.
Pay-as-you-go: You can release Cloud Firewall at any time.
For instructions, see Release Cloud Firewall.
Does Cloud Firewall manage the traffic between ECS instances in an internal network?
No. Cloud Firewall does not manage traffic between Elastic Compute Service (ECS) instances on an internal network.
Can I switch the billing method between pay-as-you-go and subscription for Cloud Firewall?
Yes. You can switch in either direction. For instructions, see Switch the billing method between pay-as-you-go and subscription.
How do I check for excess traffic charges for a subscription Cloud Firewall?
To check if your subscription Cloud Firewall has incurred recent pay-as-you-go charges, follow these steps:
Check bills from the last 30 days: Log on to the Cloud Firewall console. In the navigation pane on the left, choose . If the value for Theoretical Fee on the Elastic Traffic Inspection and Sensitive Data Leak Detection tabs is greater than 0, you have incurred pay-as-you-go charges.
Check bills older than 30 days: Go to the Expenses and Costs console and check for pay-as-you-go bills for Cloud Firewall. For more information, see View and analyze bills.
How are instance fees calculated for the Cloud Firewall pay-as-you-go 2.0 billing method? Does the cost increase with more assets?
The calculation rules for instance fees and their relationship with the number of assets for the Cloud Firewall pay-as-you-go 2.0 billing method are as follows:
Instance fee calculation rules
The instance fee is based on the number of Cloud Firewall instances, which includes all border firewalls. The unit price is CNY 2.5/instance/hour. The number of instances is calculated based on the following criteria:
Internet firewall: One instance is required for each protected region. Within the same region, only one instance specification is consumed, regardless of the number of protected public IP addresses or whether the IP addresses are IPv4 or IPv6.
NAT firewall: One instance is required for each NAT Gateway instance.
VPC firewall:
In a Cloud Enterprise Network (CEN) Enterprise Edition architecture, one instance is required for each Transit Router (TR).
In a CEN Basic Edition architecture, one instance is required for each VPC.
In a VPC peering connection architecture, one instance is required for each pair of VPCs.
Multi-account Management: If you enable this feature, the assets of each member account consume a Cloud Firewall instance specification and incur a separate instance fee.
Relationship between instance fees and the number of assets
For Internet firewalls, the instance fee depends on the number of regions where your assets are located, not on the total number of assets. All assets within a single region are billed as one instance type, regardless of the number of assets. The more regions that contain your assets, the higher the instance fee.
Why can I not purchase the discounted pay-as-you-go edition of Cloud Firewall?
The discounted pay-as-you-go edition of Cloud Firewall is currently unavailable for purchase. Purchase the standard pay-as-you-go 2.0 edition or the subscription edition instead.