Why Cannot Some Inter-VPC Firewall Switches Be Enabled?
Due to routing and IP range conflicts or other reasons, CFW restricts the toggles that cause conflicts. You can eliminate the conflicts according to the toggle error prompts before trying to enable the inter-VPC firewall.
What Are the Firewall Subnet Automatically Created in the VPC and the Firewall Route in the Route Table?
After you enable the VPC Firewall toggle, the firewall subnets and firewall routes required for traffic steering are automatically created. Do not delete them manually, as this may affect the use of CFW. If you want to change the CIDR blocks of the firewall subnets, you can submit a ticket to contact us. Which Subnets' VPC Traffic Does VPC Firewall Redirect?
The traffic diversion scope of the VPC Firewall depends on your route configuration at the VPC boundary. CFW diverts traffic only from subnets with correctly configured VPC boundary routes.
What Happens When VPC Firewall Bandwidth Reaches the Specification Limit and How to Handle It?
In the current version, elastic scaling is not supported because the VPC Firewall is deployed with user-exclusive resources.
Therefore, when the bandwidth of the VPC Firewall exceeds its capacity specification, the firewall drops the excess packets, which may cause network latency, congestion, or blockage. To ensure normal business operation, we recommend that you properly estimate the bandwidth specification and scale out the firewall bandwidth in advance.
Can VPC Firewall Protect Traffic from Third-Party VPCs?
You can use the VPC Firewall CCN mode for protection.
What Is the Maximum Bandwidth Supported by VPC Firewall?
20G.
Does VPC Firewall Support Blocking UDP?
The VPC Firewall is deployed inline in the user network and actually modifies user routes. It can block all UDP traffic.
Can VPC Firewall Cover Protection Between VPN and Direct Connect?
Why Split VPC Firewall Instances?
A firewall is essentially composed of multiple firewall instances. In previous versions, the instance concept was weakened, making it difficult to monitor and analyze the status of each firewall instance. Therefore, in the new version, we have strengthened the firewall instance concept to align its information hierarchy with that of the NAT firewall, making the page structure clearer.
What Problems Do Multiple Instances in the Same Region Solve?
In previous versions, we deployed one firewall instance in each region for network access. However, due to routing policy restrictions, effective protection cannot be achieved when the number of VPCs is too large.
Currently, the VPC Firewall supports deploying multiple firewall instances in the same region (VPC mode), thereby protecting more VPCs.
What Pain Points Does Route Mode Configuration Solve?
Because different users have different network structures, the number of toggles becomes complex and difficult to maintain when there are too many VPCs. By flexibly selecting from single-point mode, multi-point mode, full-mesh mode, and custom routing mode, you can choose an appropriate route traffic diversion solution based on the network topology, thereby simplifying the toggle control logic.
Does CCN Mode VPC Firewall Support Adding Firewall Deployment Regions After Access?
This is not supported. To add a deployment region, you must terminate the instance and recreate it.
What Is the Blocking Logic of CFW for UDP Resolution Requests on Port 53?
When an ACL blocking rule is triggered, CFW forges a DNS response packet. Specifically, CFW sends an NXDOMAIN response packet on behalf of the DNS server to block the DNS request. This prevents the blocked DNS request from being retried and passed. To allow DNS requests, we recommend that you place the DNS allow rule at the top of the configuration. This configuration prevents the DNS server specified in the /etc/resolv.conf file from attempting to resolve the next address.
Does VPC Firewall Rollback or Bypass Affect Existing Business Connections?
Rollback or Bypass triggers the route table to switch back to the original path. During the switchover, network jitter of about 1 second may occur, manifesting as increased latency or minor packet loss.
Existing sessions are interrupted and network disconnection occurs in the following two cases:
Cross-VPC access to basic services (such as Tencent Cloud PaaS services like redis, db, kafka, cfs, and tdsql). These cross-VPC persistent connections are prone to interruption during route table switchover, so it is recommended to perform the operation during off-peak business hours. If the business system has an automatic reconnection mechanism, the connections can recover after reconnection. If no reconnection mechanism is available, you can manually reset sessions or restart services. New sessions are not affected.
TKE is connected to CFS without the noresvport parameter configured. When the source port, destination port, and IP address of the request remain unchanged, existing sessions cannot reuse the original connection after the switchback, which may cause network disconnection. To restore connectivity, you must manually reset the connection and change the port. Recovery command: mount -t nfs -o noresvport,vers=4.0 <server IP address>:/<shared directory> <local mount point>.