Common questions about Cloud Firewall billing, quotas, and billing method changes.
How do I increase the quota for a billable item if the quota is insufficient?
Purchase additional quota for the item you need. Cloud Firewall supports quota increases for the following billable items:
Protected Public IP Addresses
Protected Internet Traffic
Protected VPCs
Protected VPC Traffic
Quota for Additional Policy
For step-by-step instructions, see Upgrade and downgrade Cloud Firewall.
Does Cloud Firewall that uses the pay-as-you-go billing method support the log analysis and VPC Firewall features?
Yes. Both the log analysis and VPC Firewall features are available under pay-as-you-go. For a full list of supported features by billing method, see Functions and features.
Why are bills generated for a pay-as-you-go instance if Cloud Firewall is not used?
In addition to the border firewall, features such as log analysis, threat intelligence (IPS), and Sensitive Data Leak Detection are billed separately.
To stop all billing, Log on to the Cloud Firewall console. on the Overview page, go to the upper-right corner and select . After you release the instance, the system generates a final bill on the next day (T+1). This bill includes all charges up to the point of release. No new bills are generated afterward.
Why are bills generated after a pay-as-you-go instance is released?
If you are billed after a pay-as-you-go instance is released, it is usually for the following reasons:
Delayed billing: Pay-as-you-go instances are billed daily. After you release an instance, the system generates a bill on the next day (T+1). This bill includes charges incurred before the release. No new bills are generated after this.
Late instance release: If you do not manually release an instance after its free trial or savings plan expires, you will continue to be billed for the service at the standard rate.
Incorrect service termination: Disabling border firewall protection does not stop billing. To stop billing completely, Log on to the Cloud Firewall console. on the Overview page, in the upper-right corner, select .
Can I manually release Cloud Firewall before it expires?
Yes. The release window depends on your billing method:
Subscription: You can release Cloud Firewall up to 15 days before it expires, or within 7 days after it expires.
ImportantNo refunds are issued after you manually release a subscription instance.
Pay-as-you-go: You can release Cloud Firewall at any time.
For instructions, see Release Cloud Firewall.
Does Cloud Firewall manage the traffic between ECS instances in an internal network?
No. Cloud Firewall does not manage traffic between Elastic Compute Service (ECS) instances on an internal network.
Can I switch the billing method between pay-as-you-go and subscription for Cloud Firewall?
Yes. You can switch in either direction. For instructions, see Switch the billing method between pay-as-you-go and subscription.
How do I check for excess traffic charges for a subscription Cloud Firewall?
To check if your subscription Cloud Firewall has incurred recent pay-as-you-go charges, follow these steps:
Check bills from the last 30 days: Log on to the Cloud Firewall console. In the navigation pane on the left, choose . If the value for Theoretical Fee on the Elastic Traffic Inspection and Sensitive Data Leak Detection tabs is greater than 0, you have incurred pay-as-you-go charges.
Check bills older than 30 days: Go to the Expenses and Costs console and check for pay-as-you-go bills for Cloud Firewall. For more information, see View and analyze bills.