FAQ about Cloud Firewall

FAQ about features

• Why do I need to assign the service-linked role AliyunServiceRoleForCloudFW to Cloud Firewall?

• How many members does the multi-account management feature support?

• Can Cloud Firewall defend against APT attacks?

• What are the main scenarios in which Cloud Firewall protects Internet-facing SLB instances?

• What are the core defense capabilities of the Internet firewall?

• What are the advantages of Alibaba Cloud Firewall over self-managed firewalls?

FAQ about pay-as-you-go billing

• How am I charged for Cloud Firewall that uses the pay-as-you-go billing method?

• How do I view the usage details of Cloud Firewall that uses the pay-as-you-go billing method?

• What is a pay-as-you-go savings plan and how do I use it?

• What are the differences between Cloud Firewall that uses the pay-as-you-go billing method and Cloud Firewall that uses the subscription billing method?

• How do I change the billing method of Cloud Firewall from subscription to pay-as-you-go and what are the impacts?

• How do I change the billing method of Cloud Firewall from pay-as-you-go to subscription and what are the impacts?

• How do I release Cloud Firewall that uses the pay-as-you-go billing method?

• Why are fees still deducted after I release Cloud Firewall that uses the pay-as-you-go billing method?

FAQ about protection scope

• Can Cloud Firewall protect Layer 2 EIPs?

• Does Cloud Firewall support the classic network?

• Can Cloud Firewall protect Internet-facing SLB instances?

• Can Cloud Firewall protect traffic on Express Connect or CEN?

• Can the Internet firewall protect traffic that is destined for a public VPN gateway?

• Can VPC firewall protect traffic that is destined for a VPC over IPsec-VPN?

• Which types of traffic consume the purchased protection bandwidth of Cloud Firewall?

FAQ about Cloud Firewall and other Alibaba Cloud services

• What is the relationship between Cloud Firewall and other cloud services in the Alibaba Cloud architecture?

• How does service traffic flow when I use Anti-DDoS Pro or Anti-DDoS Premium, WAF, and Cloud Firewall together?

• How do I use WAF and Cloud Firewall to manage Internet exposures?

• Why do users who use transit routers of CEN instances have higher requirements on Cloud Firewall?

Why am I unable to activate Cloud Firewall for my account?

Internet firewall

• What are the impacts of enabling the Internet firewall?

• What is the purpose of the Internet firewall?

• Can the Internet firewall protect IPv6 addresses?

• Is network traffic affected after I enable the Internet firewall?

• What are the impacts of enabling the Internet firewall?

• When I enable the Internet firewall, SLB instance-related network restriction prompts are displayed. Why?

• Why are my public IP addresses not displayed after I perform asset synchronization in Cloud Firewall Free Edition?

• How does Cloud Firewall match outbound traffic against access control policies of the Internet firewall, a NAT firewall, and a DNS firewall?

• How do I efficiently enable and configure access control policies for the Internet firewall?

NAT firewalls

• What are the impacts of enabling a NAT firewall?

• Why does Cloud Firewall create a route table and add the static route 0.0.0.0/0 to the route table after I enable a NAT firewall?

• How does Cloud Firewall match outbound traffic against access control policies of the Internet firewall, a NAT firewall, and a DNS firewall?

Virtual private cloud (VPC) firewalls

• What are the impacts of enabling a VPC firewall?

• Are the security group rules in ECS affected after VPC firewall is enabled?

• Why am I prompted that unauthorized network instances exist when I create a VPC firewall?

• I have enabled a VPC firewall for a Basic Edition transit router. Why is a routing policy whose Routing Policy Action is set to Deny added to the route table of the transit router?

FAQ about features

• If I enable both WAF in transparent proxy mode and the Internet firewall, can traffic over forwarding ports be controlled by access control policies of Cloud Firewall?

• Can I increase the default quota for access control policies?

• Can I increase the protected VPC traffic bandwidth?

• Can Cloud Firewall block traffic of IPv6 CIDR blocks?

• What are the differences between Cloud Firewall and security groups?

• What are the differences between common policy groups and enterprise policy groups?

FAQ about operations

• I configured an outbound access control policy whose application type is HTTP or HTTPS for a domain name. How do I check whether the policy is valid?

• How do I troubleshoot the error that is returned after I apply the default Allow policies to a security group?

• When I apply the default Allow policies, the system prompts that a conflict cannot be resolved. How do I troubleshoot the error?

• Why is the Quick Apply icon unavailable? How do I troubleshoot the error?

• How do I eliminate false positives for suspicious outbound connections that are caused by Internet-based scans?

• I configured an outbound Deny access control policy whose Source is set to 0.0.0.0/0 for the Internet firewall. However, some traffic is still allowed because no policy is matched. Why?

• How do I configure access control policies to allow access only to a specified subdomain name of a secondary domain name?

• How do I use Cloud Firewall to strengthen access control on the domain names of a bastion host?

Traffic from unknown applications accounts for a large proportion in traffic analysis. Does this occur because Cloud Firewall cannot identify the types of applications that generate traffic from the Internet?

When I view the results of all access activities, the system displays a large proportion of traffic from unknown ISPs. Why?

Intelligence tags are displayed on the Outbound Connection page. What are the meanings of the tags?

How do I troubleshoot network connection failures?

What are the priorities of rules that are used by Cloud Firewall to protect traffic?

What do I do if the volume of my business traffic exceeds the purchased bandwidth of Cloud Firewall?

Why is the total number of Cloud Firewall logs different from the total number of Anti-DDoS Proxy logs or WAF logs?

How do I reduce the storage occupied by logs?

Can I export traffic logs of Cloud Firewall to a third-party system?

How do I view the remaining log storage of Cloud Firewall?

Why are traffic logs of ICMP detection periodically sent by Cloud Firewall?

Why do traffic logs record traffic whose application type is Unknown?

Is log analysis data retained after I release Cloud Firewall?

Can I directly export log audit records?