Subscription 2.0
The subscription billing method is a prepaid option suitable for scenarios with stable and predictable resource demands or for long-term protection. Compared to the pay-as-you-go model, subscription offers more favorable unit prices, which helps reduce your security costs. This document describes the billing rules for the subscription edition of Cloud Firewall.
Effective October 15, 2025, Cloud Firewall billable items have been upgraded to Billing 2.0. New purchases use Billing 2.0 by default. Existing users can continue with Billing 1.0 and can optionally upgrade to Billing 2.0.
This document describes Billing 2.0. If you are on Billing 1.0, see Billing 1.0 and upgrade instructions for information about Billing 1.0 billable items and how to upgrade to Billing 2.0.
How it works
The fees for a subscription Cloud Firewall consist of base fees and value-added fees.
Base fees: A prepaid fee for the default protection capabilities of your selected Cloud Firewall edition, such as Premium Edition or Enterprise Edition.
Value-added fees: These fees apply when the default protection capabilities are insufficient for your business needs and you require additional features or specifications. Billing is as follows:
Elastic traffic and sensitive data leak detection traffic: Billed daily based on actual usage (postpaid).
Other value-added services: are prepaid.
Billable items
This topic describes only the pricing for the billable items of a subscription Cloud Firewall. For information about the differences in features among the editions, see Feature comparison by edition.
Base fees
Subscription edition | Unit price | Included specifications |
Premium Edition | CNY 2,800/month |
|
Enterprise Edition | CNY 9,600/month |
|
Ultimate Edition | CNY 26,000/month |
|
Value-added fees (prepaid)
Billable item | Unit price | Description |
Additional instances | CNY 1,500/instance/month | If the number of included instances is insufficient for your business needs, you can purchase additional instances. These can be used for any border firewall. |
Additional bandwidth |
| If the included bandwidth is insufficient for your business, you can purchase additional bandwidth for any border firewall. Tiered pricing applies. Purchase limits:
|
Temporary additional bandwidth | Billed by day: CNY 2.5/Mbps/day | Ideal for predictable traffic fluctuations. This feature lets you temporarily increase your traffic processing capacity on a daily basis. The bandwidth automatically reverts to its original specification upon expiration. Maximum purchasable bandwidth: 10 Gbps. For a custom quota, contact your business manager or architect. |
Log analysis storage capacity | CNY 500/TB/month | Cloud Firewall stores audit logs for 7 days by default. To extend the retention period for purposes such as compliance, you must purchase this service. Purchase increment: 1 TB. Purchase range:
|
Sensitive data leak detection: feature fee | CNY 2,000/month | This feature detects sensitive data leaks in active outbound traffic.
|
Value-added fees (postpaid)
These postpaid items can be offset by a pay-as-you-go savings plan, which helps reduce costs. For more information, see pay-as-you-go savings plan.
Billable item | Unit price | Description |
Sensitive data leak detection: overage traffic fee | CNY 0.18/GB | This feature detects sensitive data leaks in active outbound traffic.
|
Elastic traffic | CNY 0.36/GB | If your actual service bandwidth exceeds your purchased bandwidth, the excess portion is billed based on the actual inspected traffic (postpaid). To prevent service interruptions due to traffic bursts, this feature is enabled by default and cannot be disabled. The bandwidth limit for this feature is 10 Gbps. To request a higher quota, contact your business manager or architect. Cost optimization recommendations:
|
Billing example
An enterprise purchases a 6-month subscription to Cloud Firewall Enterprise Edition, adds 1 additional firewall instance, and has a peak bandwidth of 250 Mbps (which includes the 200 Mbps from the Enterprise Edition and 50 Mbps of additional bandwidth).
The fee is calculated as follows: (CNY 9,600 + 1 additional instance × CNY 1,500 + 50 Mbps additional bandwidth × CNY 50) × 6
Billing cycle
The billing cycle starts on the purchase date and ends on the expiration date of your instance.
The billing cycle for the prepaid portion of a subscription is your selected purchase duration (UTC+8). A billing cycle starts when a resource is activated or renewed and ends at 00:00:00 on the day after the expiration date.
The fees for postpaid value-added items are settled once per day (UTC+8). A new settlement cycle begins after the previous one is complete.
FAQ
How to purchase a subscription Cloud Firewall
Go to the Cloud Firewall purchase page to make a purchase.
Bandwidth type differences
Included bandwidth: The default protection bandwidth included in the base price of each edition. No additional purchase is required.
Additional bandwidth: Long-term bandwidth that you can purchase if the included bandwidth is insufficient for your business needs. It is prepaid on a monthly basis.
Temporary additional bandwidth: Ideal for predictable traffic fluctuations. This allows you to temporarily increase bandwidth on a daily basis. The bandwidth automatically reverts to its original specification upon expiration.
Elastic traffic: If your actual traffic exceeds your purchased bandwidth (the sum of included bandwidth, additional bandwidth, and temporary additional bandwidth), the excess portion is billed on a pay-as-you-go basis. This feature is enabled by default and cannot be disabled. See the cost optimization recommendations for elastic traffic.
Firewall instance calculation
Internet firewall: One instance is required for each protected region. Within the same region, only one instance type is consumed, regardless of the number of protected public IP addresses or whether the IP addresses are IPv4 or IPv6.
NAT border firewall: One instance is required for each NAT Gateway instance.
VPC border firewall:
In a Cloud Enterprise Network (CEN) Enterprise Edition architecture, one instance is required for each TransitRouter (TR).
In a CEN Basic Edition architecture, one instance is required for each VPC.
In a VPC peering connection architecture, one instance is required for each pair of VPCs.
Multi-account management: If you enable this feature, the assets of each member account consume a Cloud Firewall instance type and incur a separate instance fee.
How to check for recent excess traffic on a subscription Cloud Firewall
To check for recent excess traffic on your subscription Cloud Firewall, follow these steps:
Check for excess traffic in the last 30 days: Log on to the Cloud Firewall console. In the navigation pane on the left, choose . If the value for Elastic Traffic is greater than 0, you have generated excess traffic.
Check for excess traffic older than 30 days: Go to the Expenses and Costs console to check for pay-as-you-go bills for Cloud Firewall. For more information, see View and analyze bills.
How to view billing information
Log on to the Cloud Firewall console. In the left-side navigation pane, choose Overview. In the Version Information area, you can view the current edition and expiration date.
Billing method and corresponding edition:
pay-as-you-go: Displayed as Pay-as-you-go.
subscription: Displayed as Premium Edition, Enterprise Edition, or Ultimate Edition.