Purchase a subscription Cloud Firewall

Applicability

This topic applies only to users who have not activated Cloud Firewall. If you have already activated Cloud Firewall, refer to the following documents based on your business requirements:

• Billing model conversion: To switch from pay-as-you-go to a subscription, see Switch between subscription and pay-as-you-go.

• Billing method upgrade: If you use the legacy (1.0) billing method and want to upgrade to the new subscription (2.0) model, see Upgrade the billing method from 1.0 to 2.0.

  Note

  Starting from October 15, 2025 (UTC+8), Cloud Firewall will officially launch the Subscription 2.0 billing method. New purchases use this billing method by default.

Edition selection

Subscription-based Cloud Firewall is available in Premium, Enterprise, and Ultimate editions. Use the following table to select an edition based on its core features. For a complete feature comparison and billing details, see Feature comparison and Subscription 2.0.

How instances are calculated:

• Internet firewall: One instance is required for each protected region. Within the same region, only one instance specification is consumed, regardless of the number of protected public IP addresses or whether the IP addresses are IPv4 or IPv6.

• NAT firewall: One instance is required for each NAT Gateway instance.

• VPC firewall:

  • In a Cloud Enterprise Network (CEN) Enterprise Edition architecture, one instance is required for each Transit Router (TR).

  • In a CEN Basic Edition architecture, one instance is required for each VPC.

  • In a VPC peering connection architecture, one instance is required for each pair of VPCs.

• Multi-account Management: If you enable this feature, the assets of each member account consume a Cloud Firewall instance specification and incur a separate instance fee.

Purchase a subscription Cloud Firewall

1. Go to the Cloud Firewall buy page and set Product Type to Subscription 2.0.

2. Configure the following parameters.

   Parameter	Description
   Edition	Select a Cloud Firewall edition based on the selection guidance provided earlier.
   Auto-protect internet assets	If you select Yes, Cloud Firewall automatically protects all your public-facing assets after activation to reduce internet exposure risk. You can manually adjust this setting later to enable or disable protection for specific assets based on your business needs.
   Firewall extra instances	If your edition's included instances are insufficient, you can purchase more. This applies to the Internet boundary, VPC boundary, and NAT boundary. Note: The Premium edition does not support the VPC boundary firewall.
   Firewall extra bandwidth	If the included bandwidth is insufficient, you can purchase more. This applies to the Internet boundary, VPC boundary, and NAT boundary. Note: The Premium edition does not support the VPC boundary firewall.
   Firewall log analysis	By default, Cloud Firewall provides a 7-day log audit feature for free. For longer log retention or compliance, select Yes to enable the log analysis service. After you enable this service, you must also configure the Firewall log storage capacity. Higher traffic bandwidth requires more storage capacity. If you are unsure of your bandwidth requirements, you can keep the default capacity and manually scale it up later. Recommendation: For every 10 Mbps of business bandwidth, configure 1 TB of log storage capacity for a 6-month log retention period.
   Agentic NDR	Agentic NDR is a premium value-added service for Cloud Firewall. It uses a non-intrusive, out-of-path mirrored deployment and supports full inspection of north-south traffic over the internet. This service focuses on advanced threat detection and source tracing. It can analyze bidirectional traffic of requests and responses to determine attack outcomes, and retain full packet captures. It also supports the identification and deep parsing of application-layer protocols. For more information, see What is Agentic NDR. If you select Yes to enable this service, the system provides 200 Mbps of Agentic NDR bandwidth, 2 Agentic NDR instances, and 30 GB of attack packet storage capacity by default.
   NDR extra instances	If the default number of Agentic NDR instances is insufficient for your business needs, you can purchase extra instances.
   NDR extra bandwidth	If the default Agentic NDR bandwidth is insufficient for your business needs, you can purchase extra bandwidth. Agentic NDR bandwidth is the sum of inbound and outbound traffic bandwidth. This bandwidth quota is shared by both public and private traffic.
   NDR log storage capacity	This is the log analysis feature for Agentic NDR. This feature is billed separately and uses a storage space that is isolated from the Cloud Firewall log analysis service. Recommendation: At 200 Mbps of bandwidth, we recommend that you purchase 2 TB/month of log storage space. You can also configure custom log filtering rules to reduce storage usage.
   NDR full-traffic storage capacity	This feature stores complete raw network traffic. After purchase, when the default attack packet storage quota is exhausted, you can retain attack packets by using the full-traffic storage. Recommendation: For a scenario with 50 Mbps of public bandwidth and a 14-day full-traffic retention period, we recommend that you purchase 4 TB of storage space. You can also configure custom packet filtering rules to reduce storage usage.
   Elastic traffic	If your actual business bandwidth exceeds your purchased bandwidth, the excess traffic is billed on a pay-as-you-go basis to ensure continuous protection. The elastic traffic feature is enabled by default and cannot be disabled. The unit price is CNY 0.36/GB. Cost optimization tips: Purchase a savings plan: Purchase a pay-as-you-go savings plan to reduce pay-as-you-go costs. Increase bandwidth specification: If excess elastic traffic is frequently generated, we recommend that you purchase Firewall extra bandwidth to increase your bandwidth. Cost monitoring: You can go to the Settings > Alert Notification page to configure Elastic Billing Alert. When the peak bandwidth reaches a specified percentage of your purchased bandwidth, the system sends an alert to help you monitor costs in real time.
   Sensitive data leakage detection	This feature detects sensitive data in outbound traffic. After you enable this feature, it includes a monthly quota of 100 GB for detection traffic. Traffic that exceeds this quota incurs pay-as-you-go fees.
   Subscription duration	Select a subscription duration based on your business requirements. You can enable auto-renewal. If enabled, the service automatically renews upon expiration. For example, if you purchase a 6-month subscription and enable auto-renewal, the service is automatically renewed for one month upon expiration.

3. Click Buy Now and complete the payment.

Get started

After you enable Cloud Firewall, follow these steps to configure and use the service:

1. Confirm public asset protection status: Go to the Firewall > Internet Firewall page and verify that the status of your target public assets is Protected. For more information, see Internet Firewall.

2. Check intrusion prevention (IPS) configuration: IPS protection is enabled by default. To adjust the settings, go to the Protect > IPS Configuration page. For more information, see IPS configuration.

3. Configure access control (ACL) policies: Go to the Protect > Access Control > Policy Configuration page to set inbound and outbound traffic rules for each asset for fine-grained control. For more information, see Overview of access control policies.

4. Audit traffic logs: After your assets are protected and begin to generate traffic, go to the Detection & Response > Log Audit page to view and analyze logs. If you have enabled Log Analysis, go to the Detection & Response > Log Analysis page to view complete logs. For more information, see Log audit and Overview of Log Analysis.

FAQ