{"id":54,"date":"2026-04-12T16:16:56","date_gmt":"2026-04-12T16:16:56","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/alibaba-cloud-firewall-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security\/"},"modified":"2026-04-12T16:16:56","modified_gmt":"2026-04-12T16:16:56","slug":"alibaba-cloud-firewall-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/alibaba-cloud-firewall-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security\/","title":{"rendered":"Alibaba Cloud Firewall Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Security"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Security<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Alibaba Cloud <strong>Cloud Firewall<\/strong> is a managed network security service that helps you centrally control and monitor traffic between the Internet and your cloud assets, and (depending on your edition and configuration) between networks such as VPCs. It is designed to reduce exposure, enforce least-privilege network access, and provide visibility into traffic and threats\u2014without requiring you to deploy and manage your own firewall appliances.<\/p>\n\n\n\n<p>In simple terms: <strong>Cloud Firewall sits \u201cin front of\u201d or \u201cbetween\u201d cloud network boundaries and enforces your security rules<\/strong>. You define what is allowed and denied (for example, only allow SSH from your office IP), and Cloud Firewall helps apply those rules at scale and provides logs for audit and troubleshooting.<\/p>\n\n\n\n<p>Technically, Cloud Firewall is a <strong>cloud-native firewall and policy management layer<\/strong> that integrates with Alibaba Cloud networking constructs (such as public IP assets, VPCs, and related gateways) to apply access control and (in supported scenarios) threat prevention capabilities. It complements\u2014rather than replaces\u2014controls like <strong>security groups<\/strong> and <strong>NACLs<\/strong>, while offering a centralized place to manage policies and gain traffic visibility.<\/p>\n\n\n\n<p>The core problem Cloud Firewall solves is this: <strong>as environments grow, network security becomes fragmented<\/strong> (security groups spread across teams, inconsistent rules, unclear traffic paths, missing logs). Cloud Firewall helps unify policy, improve governance, and strengthen perimeter and inter-network security with consistent rules and auditing.<\/p>\n\n\n\n<blockquote>\n<p>Service status \/ naming note: The official service name is <strong>Cloud Firewall<\/strong> under <strong>Alibaba Cloud Security<\/strong>. If you see variations in console menus or documentation structure, use the official docs to confirm the latest terminology and workflows:<br\/>\nhttps:\/\/www.alibabacloud.com\/help\/en\/cloud-firewall\/<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Cloud Firewall?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Official purpose<\/h3>\n\n\n\n<p>Cloud Firewall is Alibaba Cloud\u2019s managed firewall service used to <strong>centrally control network access<\/strong>, <strong>analyze traffic<\/strong>, and <strong>improve security posture<\/strong> for cloud assets that face the Internet and for network-to-network traffic where supported by the product.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities (high level)<\/h3>\n\n\n\n<p>Cloud Firewall typically provides capabilities in these areas (availability depends on your purchased edition and supported asset types):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Centralized access control policies<\/strong> for ingress\/egress traffic (allow\/deny rules)<\/li>\n<li><strong>Asset visibility<\/strong>: discover and list Internet-exposed and network-connected assets<\/li>\n<li><strong>Traffic logging and analysis<\/strong> for audit and incident investigation<\/li>\n<li><strong>Threat prevention \/ intrusion prevention features<\/strong> in supported modes (verify exact IPS features and coverage in official docs for your edition)<\/li>\n<li><strong>Alerting and reporting<\/strong> (for example, on blocked traffic, suspicious traffic, policy hits)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (conceptual)<\/h3>\n\n\n\n<p>While Alibaba Cloud may describe modules differently across editions and updates, you can generally think of Cloud Firewall as having:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Asset management \/ protection scope<\/strong>\n   &#8211; The set of public IPs, ECS instances, load balancers, NAT gateways, or VPC connections that Cloud Firewall can protect (exact asset types: verify in official docs for your account and region).<\/p>\n<\/li>\n<li>\n<p><strong>Policy engine (access control)<\/strong>\n   &#8211; Rule definitions (source\/destination, port, protocol, direction, action, priority)\n   &#8211; Policy evaluation and enforcement<\/p>\n<\/li>\n<li>\n<p><strong>Logging and analytics<\/strong>\n   &#8211; Event logs for allowed\/blocked flows (where enabled)\n   &#8211; Reporting dashboards and\/or export to a log platform (for example Log Service integration\u2014verify current integration options in docs)<\/p>\n<\/li>\n<li>\n<p><strong>Operations and governance<\/strong>\n   &#8211; Role-based access to manage policies\n   &#8211; Change visibility (often via audit services such as ActionTrail\u2014verify current integrations)<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Managed security service<\/strong> (SaaS-style control plane with cloud-native enforcement)<\/li>\n<li>You do not typically deploy firewall VMs or manage HA pairs; enforcement is integrated with Alibaba Cloud network paths supported by Cloud Firewall.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scope (regional vs global)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Firewall is <strong>account-scoped<\/strong> (within an Alibaba Cloud account) with configuration that can apply to assets across regions, depending on what the service supports in your account.  <\/li>\n<li>Some protected assets and enforcement points are inherently <strong>regional<\/strong> (because VPCs and many networking services are regional).  <\/li>\n<li><strong>Verify in official docs<\/strong> how Cloud Firewall applies across regions for your asset types and whether cross-region scenarios require separate configuration.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Alibaba Cloud ecosystem<\/h3>\n\n\n\n<p>Cloud Firewall is most effective when used alongside:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>ECS Security Groups<\/strong> (instance-level virtual firewall)<\/li>\n<li><strong>VPC Network ACLs (NACLs)<\/strong> (subnet-level stateless controls, where used)<\/li>\n<li><strong>Web Application Firewall (WAF)<\/strong> (Layer 7 protection for HTTP\/HTTPS workloads)<\/li>\n<li><strong>Anti-DDoS<\/strong> services (L3\/L4 volumetric and protocol DDoS mitigation)<\/li>\n<li><strong>Security Center<\/strong> (host and vulnerability management, baseline checks)<\/li>\n<li><strong>ActionTrail<\/strong> (audit trail for API and console actions)<\/li>\n<li><strong>Log Service (SLS)<\/strong> \/ <strong>CloudMonitor<\/strong> (central logging and monitoring, if integrated)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Cloud Firewall?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce breach risk from misconfigurations<\/strong>: Central policy reduces accidental \u201c0.0.0.0\/0:22\u201d exposures.<\/li>\n<li><strong>Improve audit readiness<\/strong>: Centralized logs and consistent policy management help with compliance evidence.<\/li>\n<li><strong>Faster incident response<\/strong>: Quickly block traffic patterns, IPs, or ports from one place.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Centralized network access control<\/strong> across many assets and environments.<\/li>\n<li><strong>Better visibility<\/strong> into north-south traffic (Internet \u2194 cloud) and, where supported, east-west traffic between networks.<\/li>\n<li><strong>Layered security<\/strong>: Cloud Firewall complements security groups and NACLs, reducing reliance on any one control.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Standardization<\/strong>: Enforce company-wide baseline policies (e.g., \u201cdeny all inbound by default\u201d).<\/li>\n<li><strong>Change control<\/strong>: Fewer distributed rule sets, more consistent management.<\/li>\n<li><strong>Troubleshooting<\/strong>: Flow logs and hit counts help explain connectivity issues.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Helps implement:<\/li>\n<li><strong>Least privilege<\/strong> networking<\/li>\n<li><strong>Segmentation<\/strong> between environments (prod vs dev), where supported<\/li>\n<li><strong>Audit logging<\/strong> for security investigations<\/li>\n<li>Supports a governance narrative aligned with common control frameworks (ISO 27001, SOC 2, PCI DSS). Map controls to your policy standards\u2014Cloud Firewall is a tool, not a compliance guarantee.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Scales to large numbers of assets and policies without requiring you to manage firewall appliances.<\/li>\n<li>Central policy can reduce duplicated rules across hundreds of security groups.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose Cloud Firewall when you need one or more of the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A <strong>central control point<\/strong> for Internet access rules across many public-facing assets<\/li>\n<li>Consistent <strong>deny-by-default<\/strong> enforcement with auditing<\/li>\n<li>Visibility into traffic and policy hits for operations and security teams<\/li>\n<li>A platform to implement network segmentation at scale (where supported)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<p>Cloud Firewall may not be the right fit if:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You only have a few assets and security groups already meet your needs, and you don\u2019t need centralized policy\/logging.<\/li>\n<li>You require <strong>deep Layer 7 application protections<\/strong> (use WAF for HTTP\/HTTPS).<\/li>\n<li>You require <strong>full custom packet inspection<\/strong> or appliance-specific features not offered by Cloud Firewall (consider third-party firewall appliances).<\/li>\n<li>Your architecture is highly specialized and depends on features that Cloud Firewall does not support for your asset type or region (verify in official docs).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Cloud Firewall used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<p>Common in regulated or security-sensitive industries such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>FinTech and payments<\/li>\n<li>E-commerce and marketplaces<\/li>\n<li>SaaS providers<\/li>\n<li>Healthcare and life sciences<\/li>\n<li>Gaming (anti-abuse controls)<\/li>\n<li>Manufacturing\/IoT backends<\/li>\n<li>Education platforms with large user bases<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud platform teams implementing shared guardrails<\/li>\n<li>Security engineering teams enforcing standards and monitoring exposure<\/li>\n<li>Network\/security operations (SecOps) for incident response<\/li>\n<li>DevOps\/SRE teams troubleshooting connectivity and enforcing policy-as-code patterns (where supported via API)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internet-facing APIs, web apps, and microservices<\/li>\n<li>Bastion\/jump host access patterns<\/li>\n<li>Hybrid connectivity (on-prem \u2194 cloud) when traffic traverses supported enforcement points<\/li>\n<li>Multi-VPC environments with shared services and segmentation needs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Single VPC with multiple public services<\/li>\n<li>Hub-and-spoke with shared services VPC<\/li>\n<li>Multi-environment (dev\/test\/prod) segmentation<\/li>\n<li>Internet ingress via SLB\/ALB, API Gateway, or direct public IPs (asset types depend on service support)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production<\/strong>: strict allowlists, logging enabled, change control, integration with alerting.<\/li>\n<li><strong>Dev\/test<\/strong>: lighter policies, but still benefit from \u201cdeny risky ports globally\u201d and centralized visibility.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where Alibaba Cloud Cloud Firewall is commonly used. For each, the exact implementation depends on your protected assets and edition\u2014always confirm capabilities in the official docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Centralized inbound policy for all public IP assets<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Security groups are managed by many teams and drift over time.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Provides a central policy layer to standardize inbound exposure rules.<\/li>\n<li><strong>Example:<\/strong> Organization enforces \u201conly ports 80\/443 allowed from Internet; management ports only from corporate IP ranges.\u201d<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Lock down SSH\/RDP to corporate IPs only<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Admin ports exposed to the world increase brute-force risk.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Create deny-by-default rules and allowlists for specific source IPs.<\/li>\n<li><strong>Example:<\/strong> Only allow TCP\/22 from office IPs to Linux ECS; block all other sources.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Temporary emergency block during an incident<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Active exploitation attempts from known IP ranges.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Quick centralized block rules, often faster than updating dozens of security groups.<\/li>\n<li><strong>Example:<\/strong> Add a high-priority deny rule for attacker IPs across all Internet-facing assets.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Outbound (egress) control to reduce data exfiltration risk<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Workloads can connect to the Internet freely (C2 risk, data exfil).<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Define outbound allowlists (e.g., only approved update mirrors).<\/li>\n<li><strong>Example:<\/strong> Allow outbound only to package repos and payment gateways; deny outbound to unknown destinations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Environment segmentation (prod\/dev) between VPCs (where supported)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Dev environment has weaker controls; lateral movement into prod is risky.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Enforce VPC-to-VPC allowlist rules.<\/li>\n<li><strong>Example:<\/strong> Allow dev to call specific staging APIs, but block any dev-to-prod access.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Control shared services access (DNS, logging, CI\/CD)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Shared services become overly open because multiple teams need access.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Central rules for who can reach shared endpoints.<\/li>\n<li><strong>Example:<\/strong> Only CI runners can access artifact repositories; only app subnets can access internal databases (when enforcement is supported).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Visibility and audit of network flows for investigations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> After an incident, you need to answer \u201cwho talked to what, when?\u201d<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Traffic logs and policy hit information.<\/li>\n<li><strong>Example:<\/strong> Investigate unexpected outbound connections from a production subnet.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Enforce baseline deny rules for risky ports<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams accidentally open SMB, database ports, or admin interfaces to the Internet.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Central block rules for known-risk ports (e.g., 3389, 445, DB ports), with exceptions only by approval.<\/li>\n<li><strong>Example:<\/strong> Deny inbound 3306\/5432\/6379 globally; allow only from trusted VPN IPs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Simplify security group sprawl<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Hundreds of security groups with inconsistent naming and rules.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Use security groups for instance-level needs, Cloud Firewall for global perimeter baseline.<\/li>\n<li><strong>Example:<\/strong> Security groups handle app-tier to DB-tier; Cloud Firewall handles Internet ingress standards.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Protect internet-exposed gateways and edge services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> NAT gateways, load balancers, and other edge services are common choke points.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Applies centralized policies and logging to supported edge asset types.<\/li>\n<li><strong>Example:<\/strong> Monitor and restrict inbound\/outbound flows at gateways, and export logs for SOC monitoring (verify exact supported assets).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Controlled partner access to APIs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> External partners need access, but you want tight control and audit.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> IP-based allowlists and clear logging of access.<\/li>\n<li><strong>Example:<\/strong> Allow partner IP ranges to reach API gateway endpoints; deny everything else.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Change-control-friendly policy management<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Network changes cause outages; you need predictable rollout and rollback.<\/li>\n<li><strong>Why Cloud Firewall fits:<\/strong> Central rules with ordering\/priority and visibility into hits.<\/li>\n<li><strong>Example:<\/strong> Implement staged allow rules, validate traffic, then remove old exceptions.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Cloud Firewall\u2019s exact feature set varies by edition and ongoing product updates. The features below reflect common Cloud Firewall capabilities; <strong>verify your edition\u2019s capabilities and supported asset types in official documentation<\/strong>:\nhttps:\/\/www.alibabacloud.com\/help\/en\/cloud-firewall\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6.1 Internet boundary access control (ingress\/egress)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you define allow\/deny policies for traffic between the Internet and your protected public-facing cloud assets (public IPs, and other supported asset types).<\/li>\n<li><strong>Why it matters:<\/strong> Reduces attack surface and enforces consistent exposure rules.<\/li>\n<li><strong>Practical benefit:<\/strong> \u201cDefault deny inbound; allow only 80\/443; allow SSH only from corp IP.\u201d<\/li>\n<li><strong>Caveats:<\/strong> Enforcement scope depends on what assets are included in Cloud Firewall protection. Some assets may still require security group controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.2 VPC boundary \/ inter-network firewalling (where supported)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Controls traffic between networks such as VPCs (and potentially between VPC and other networks, depending on supported connectivity and edition).<\/li>\n<li><strong>Why it matters:<\/strong> Segmentation reduces lateral movement and limits blast radius.<\/li>\n<li><strong>Practical benefit:<\/strong> Separate prod\/dev, isolate shared services, enforce strict east-west policy.<\/li>\n<li><strong>Caveats:<\/strong> Coverage depends on how your networks are connected (CEN, peering, etc.) and what Cloud Firewall supports for those paths. Verify supported topologies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.3 Policy prioritization, ordering, and hit visibility<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows multiple rules with a priority\/order and often provides hit counts to understand which rules are used.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents ambiguity; helps identify stale rules.<\/li>\n<li><strong>Practical benefit:<\/strong> You can safely add an allow exception above a broader deny rule and verify it\u2019s being used.<\/li>\n<li><strong>Caveats:<\/strong> Rule evaluation behavior (first-match vs best-match) must be confirmed in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.4 Address books \/ reusable objects (commonly available)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Create reusable IP sets (e.g., \u201cCorpOfficeIPs\u201d, \u201cPartnerA\u201d) referenced by multiple rules.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents repeated edits across many rules and reduces mistakes.<\/li>\n<li><strong>Practical benefit:<\/strong> Update one address book when office IP changes.<\/li>\n<li><strong>Caveats:<\/strong> Size limits may apply; verify quotas.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.5 Traffic logs and event history<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Records traffic events (allowed\/blocked) and policy match information, depending on configuration.<\/li>\n<li><strong>Why it matters:<\/strong> Essential for auditing, troubleshooting, and incident response.<\/li>\n<li><strong>Practical benefit:<\/strong> Confirm whether a blocked connection failed due to Cloud Firewall or a security group.<\/li>\n<li><strong>Caveats:<\/strong> Log retention may be limited or billable; export\/storage may incur additional costs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.6 Alerts and reporting<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Highlights security events, potential threats, and policy-related anomalies (feature names vary).<\/li>\n<li><strong>Why it matters:<\/strong> Supports security operations and compliance reporting.<\/li>\n<li><strong>Practical benefit:<\/strong> SOC can monitor spikes in blocked traffic or suspicious destinations.<\/li>\n<li><strong>Caveats:<\/strong> Alert quality depends on configuration; avoid alert fatigue.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.7 Threat intelligence \/ IPS-style prevention (edition dependent)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Blocks or detects known malicious patterns or sources based on threat intelligence and intrusion prevention capabilities (exact capabilities depend on product version\/edition).<\/li>\n<li><strong>Why it matters:<\/strong> Adds a layer beyond static allow\/deny.<\/li>\n<li><strong>Practical benefit:<\/strong> Automatically blocks known bad IPs attempting brute-force attacks.<\/li>\n<li><strong>Caveats:<\/strong> Do not rely solely on IPS; still implement least privilege. Verify coverage, supported protocols, and tuning options.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.8 Centralized management and governance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Consolidates firewall policy management for an Alibaba Cloud account, often enabling separation of duties.<\/li>\n<li><strong>Why it matters:<\/strong> Security teams can set baselines while app teams manage app-specific needs.<\/li>\n<li><strong>Practical benefit:<\/strong> Standardize naming, tagging, review workflows.<\/li>\n<li><strong>Caveats:<\/strong> Your organization must design the RBAC model carefully.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.9 API\/automation support (where available)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows managing resources and policies using APIs\/SDKs (availability depends on Alibaba Cloud OpenAPI coverage for Cloud Firewall).<\/li>\n<li><strong>Why it matters:<\/strong> Enables Infrastructure as Code and CI\/CD integration for policy changes.<\/li>\n<li><strong>Practical benefit:<\/strong> Apply standard policies to new accounts\/environments consistently.<\/li>\n<li><strong>Caveats:<\/strong> API coverage can differ by feature; verify current OpenAPI docs.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">7.1 High-level architecture<\/h3>\n\n\n\n<p>Cloud Firewall typically works as a <strong>central policy decision and enforcement system<\/strong> integrated with Alibaba Cloud networking.<\/p>\n\n\n\n<p>At a high level:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You <strong>enable protection<\/strong> for supported assets (for example, public IP assets, gateways, or network connections).<\/li>\n<li>You define <strong>access control policies<\/strong> (allow\/deny) and optional threat prevention settings.<\/li>\n<li>Cloud Firewall <strong>enforces<\/strong> those policies on traffic paths supported by the service.<\/li>\n<li>Logs and events are made available in the Cloud Firewall console and\/or via integration with logging services (verify exact options).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.2 Request\/data\/control flow (conceptual)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane<\/strong><\/li>\n<li>Admin configures policies in Cloud Firewall console or API.<\/li>\n<li>\n<p>Policies are stored and distributed to enforcement points.<\/p>\n<\/li>\n<li>\n<p><strong>Data plane<\/strong><\/p>\n<\/li>\n<li>Network traffic flows between sources and destinations (Internet \u2194 public IP assets, or between networks).<\/li>\n<li>Cloud Firewall evaluates traffic against the policy set and enforces allow\/deny (and optional prevention).<\/li>\n<li>Logs\/events are emitted.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.3 Integrations with related services (typical)<\/h3>\n\n\n\n<p>Integrations can include (verify exact, current integrations):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>ActionTrail<\/strong> for auditing who changed firewall policies<\/li>\n<li><strong>Log Service (SLS)<\/strong> for centralized log retention and querying<\/li>\n<li><strong>CloudMonitor<\/strong> for metrics\/alerts (where supported)<\/li>\n<li><strong>Security Center<\/strong> for broader posture management and host security context<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.4 Dependency services<\/h3>\n\n\n\n<p>Cloud Firewall depends on your networking services and assets to provide enforcement, such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ECS instances with public IP or EIP (or other public endpoints)<\/li>\n<li>VPCs and their connectivity constructs (CEN\/peering\/VPN\/Express Connect), if using inter-network controls<\/li>\n<li>Gateways (NAT, etc.), if protected by Cloud Firewall (verify asset support)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.5 Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Access to Cloud Firewall configuration is governed by <strong>Alibaba Cloud RAM (Resource Access Management)<\/strong>.<\/li>\n<li>Use least privilege RAM policies for:<\/li>\n<li>Viewing assets and logs<\/li>\n<li>Managing address books and policies<\/li>\n<li>Enabling protection and changing prevention settings<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.6 Networking model considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Firewall is not a replacement for:<\/li>\n<li>Security groups (instance-level controls)<\/li>\n<li>NACLs (subnet-level)<\/li>\n<li>WAF (application layer)<\/li>\n<li>Anti-DDoS (DDoS mitigation)<\/li>\n<li>Treat Cloud Firewall as a <strong>central network security control plane<\/strong> that strengthens boundary controls and visibility.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.7 Monitoring\/logging\/governance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Establish:<\/li>\n<li>A logging retention plan (how long logs must be kept, where)<\/li>\n<li>A change approval flow (who can modify policies)<\/li>\n<li>Standard rule naming conventions (environment\/app\/owner\/ticket)<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  Internet((Internet)) --&gt; CF[Alibaba Cloud\\nCloud Firewall]\n  CF --&gt; Pub[Public IP Assets\\n(ECS\/EIP\/SLB\/etc.)]\n  Pub --&gt; App[Applications]\n  Admin[Admin \/ SecOps] --&gt;|Policies| CF\n  CF --&gt; Logs[Logs\/Events]\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Users\n    U1[Customers]\n    U2[Partners]\n    U3[Admins]\n  end\n\n  subgraph AlibabaCloud[Alibaba Cloud Account]\n    CF[Cloud Firewall\\nCentral Policy + Logging]\n\n    subgraph Edge[Internet-facing Layer]\n      LB[Load Balancer \/ Public Endpoints\\n(asset types vary)]\n      NAT[NAT \/ Egress Gateway\\n(if supported)]\n    end\n\n    subgraph Networks[Network Segments]\n      VPC1[Prod VPC]\n      VPC2[Dev VPC]\n      SHARED[Shared Services VPC]\n    end\n\n    subgraph Workloads[Workloads]\n      WEB[Web\/API Tier]\n      DB[Database Tier]\n      BASTION[Bastion Host]\n      CICD[CI\/CD Runners]\n    end\n\n    Logs[(Central Logs\\n(SLS or other; verify))]\n    Audit[(ActionTrail\\n(verify))]\n  end\n\n  U1 --&gt; CF --&gt; LB --&gt; WEB --&gt; DB\n  U2 --&gt; CF --&gt; LB\n  U3 --&gt; CF --&gt; BASTION\n\n  NAT --&gt; CF\n  VPC2 --&gt; CF --&gt; VPC1\n  CICD --&gt; CF --&gt; SHARED\n\n  CF --&gt; Logs\n  CF --&gt; Audit\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Before you start with Cloud Firewall on Alibaba Cloud, ensure you have:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Account and billing<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An <strong>Alibaba Cloud account<\/strong> with billing enabled.<\/li>\n<li>A Cloud Firewall <strong>purchase\/subscription<\/strong> or enabled trial (if available in your region\/account).  <\/li>\n<li>Availability of trial\/free quota varies\u2014<strong>verify in the official pricing page<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions (RAM)<\/h3>\n\n\n\n<p>You need RAM permissions that allow you to:\n&#8211; Open\/enable Cloud Firewall and view protected assets\n&#8211; Create\/edit <strong>access control policies<\/strong>\n&#8211; View logs and events<\/p>\n\n\n\n<p>If you use a RAM user (recommended), ask your account admin to attach appropriate Cloud Firewall permissions.<br\/>\n<strong>Verify exact policy names and required actions<\/strong> in Alibaba Cloud RAM documentation and Cloud Firewall docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tools<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Alibaba Cloud console access<\/li>\n<li>Optional:<\/li>\n<li>ECS SSH client (OpenSSH on macOS\/Linux; PuTTY on Windows)<\/li>\n<li>A way to determine your public IP (for allowlisting)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Firewall availability and asset support can vary by region and edition.<br\/>\n<strong>Verify supported regions and protected asset types in official docs<\/strong>:\n  https:\/\/www.alibabacloud.com\/help\/en\/cloud-firewall\/<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Common quota areas to check (exact limits vary by edition):\n&#8211; Number of protected public IP assets\n&#8211; Number of policies\/rules\n&#8211; Address book size\n&#8211; Log retention duration<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services for this lab<\/h3>\n\n\n\n<p>For the hands-on tutorial in this article, you need:\n&#8211; An <strong>ECS instance<\/strong> in a VPC\n&#8211; A <strong>public IP<\/strong> (either an ECS public IP or an EIP attached to the instance\u2014choose what your account supports and what is cheapest\/standard in your region)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Cloud Firewall pricing changes by region, edition, and included quotas. Do not rely on blog posts or third-party summaries\u2014use official sources:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Product page: https:\/\/www.alibabacloud.com\/product\/cloud-firewall  <\/li>\n<li>Documentation: https:\/\/www.alibabacloud.com\/help\/en\/cloud-firewall\/  <\/li>\n<li>Pricing page (verify current URL and details): https:\/\/www.alibabacloud.com\/product\/cloud-firewall\/pricing<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.1 Pricing dimensions (typical model)<\/h3>\n\n\n\n<p>Cloud Firewall is commonly priced based on a combination of:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Edition \/ plan tier<\/strong><\/li>\n<li>Different editions include different capabilities (for example, baseline access control vs advanced threat prevention).<\/li>\n<li>\n<p>Edition names and inclusions can change\u2014<strong>verify in the official pricing page<\/strong>.<\/p>\n<\/li>\n<li>\n<p><strong>Protected asset quantity<\/strong><\/p>\n<\/li>\n<li>\n<p>Often measured by number of public IPs\/EIPs or other protected endpoints.<\/p>\n<\/li>\n<li>\n<p><strong>Traffic volume \/ bandwidth<\/strong><\/p>\n<\/li>\n<li>\n<p>Some plans include a traffic capacity; exceeding it may incur additional charges.<\/p>\n<\/li>\n<li>\n<p><strong>Log storage\/retention<\/strong><\/p>\n<\/li>\n<li>\n<p>Longer retention or exporting logs to a log service may cost extra.<\/p>\n<\/li>\n<li>\n<p><strong>Add-on features<\/strong><\/p>\n<\/li>\n<li>Advanced threat prevention, additional logs, or extended analysis features may be add-ons or edition features.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.2 Free tier \/ trial<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Alibaba Cloud sometimes offers trials or promotional pricing for security products.<br\/>\n<strong>Verify current free tier\/trial availability in your account and on the official pricing page<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.3 Main cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Number of protected Internet-facing assets (public IPs\/EIPs)<\/li>\n<li>Amount of traffic inspected\/processed<\/li>\n<li>Whether you enable advanced inspection\/prevention capabilities<\/li>\n<li>Log volume and retention duration<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.4 Hidden or indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Data transfer charges<\/strong>: Even if Cloud Firewall itself does not charge per GB in your plan, your architecture may incur:<\/li>\n<li>Internet egress charges from ECS, SLB, NAT, etc.<\/li>\n<li>\n<p>Cross-region traffic charges (if applicable)<\/p>\n<\/li>\n<li>\n<p><strong>Log retention<\/strong>:<\/p>\n<\/li>\n<li>\n<p>If you export logs to Log Service (SLS) or another system, you\u2019ll pay for ingest, storage, and query in that service.<\/p>\n<\/li>\n<li>\n<p><strong>Operational overhead<\/strong>:<\/p>\n<\/li>\n<li>Time spent maintaining policies, responding to alerts, and tuning rules.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.5 Cost optimization tips<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Protect only what needs protection (but don\u2019t under-protect critical assets).<\/li>\n<li>Start with <strong>deny-by-default inbound<\/strong> plus minimal allow rules.<\/li>\n<li>Use <strong>address books<\/strong> to reduce rule count and mistakes (operational cost).<\/li>\n<li>Tune logging:<\/li>\n<li>Keep high-value logs longer (blocked traffic, admin policy changes).<\/li>\n<li>Export to a centralized log platform only if needed for compliance\/SOC.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.6 Example low-cost starter estimate (non-numeric)<\/h3>\n\n\n\n<p>A low-cost starter setup usually includes:\n&#8211; One small Cloud Firewall subscription\/edition\n&#8211; Protecting <strong>a small number of public IP assets<\/strong>\n&#8211; Basic inbound policies (allow SSH from your IP, allow web ports)\n&#8211; Short log retention (or minimal logging)<\/p>\n\n\n\n<p>Because actual prices vary by region and promotions, <strong>use the Alibaba Cloud pricing page and your console cart to validate<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">9.7 Example production cost considerations (non-numeric)<\/h3>\n\n\n\n<p>For production, budget for:\n&#8211; Protecting all Internet-facing assets (public IPs, gateways, etc.)\n&#8211; Higher traffic volumes (more inspection capacity)\n&#8211; Longer log retention (compliance)\n&#8211; Possible add-ons for advanced prevention features\n&#8211; Centralized logging export (SLS) and SIEM ingestion costs<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Deploy a minimal, realistic Cloud Firewall configuration that:\n1. Protects an ECS instance reachable via a public IP\n2. Allows SSH only from <strong>your<\/strong> public IP\n3. Allows HTTP for a simple web test\n4. Blocks all other inbound traffic at the Cloud Firewall layer\n5. Verifies enforcement and reviews logs\n6. Cleans up all created resources<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n&#8211; Create (or reuse) an ECS instance with a public IP\n&#8211; Configure its security group to allow inbound traffic broadly (for demonstration)\n&#8211; Enable Cloud Firewall protection for the asset\n&#8211; Create Cloud Firewall inbound rules:\n  &#8211; Allow SSH (22) from your public IP\n  &#8211; Allow HTTP (80) from anywhere (or restrict to your IP)\n  &#8211; Deny all other inbound traffic\n&#8211; Validate with SSH and HTTP tests\n&#8211; Review Cloud Firewall logs\/events\n&#8211; Clean up policies and optionally release ECS<\/p>\n\n\n\n<blockquote>\n<p>Cost note: ECS + public IP + Cloud Firewall subscription can incur charges. If you already have a lab ECS instance, reuse it and clean up carefully.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Prepare an ECS instance with a public IP<\/h3>\n\n\n\n<p><strong>Option A (simplest):<\/strong> Create a new ECS instance with a public IPv4 address in your preferred region.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to the ECS console: https:\/\/ecs.console.aliyun.com\/<\/li>\n<li>Create an instance:\n   &#8211; Choose a low-cost instance type suitable for a lab\n   &#8211; Use a standard Linux image (for example Alibaba Cloud Linux \/ CentOS \/ Ubuntu)\n   &#8211; Ensure it is in a VPC\n   &#8211; Enable a <strong>public IPv4 address<\/strong> (or plan to attach an EIP)<\/li>\n<li>Configure login:\n   &#8211; Use an SSH key pair (recommended) or password (less recommended)<\/li>\n<li>Create or select a security group:\n   &#8211; For the lab, allow inbound SSH and HTTP from the Internet so Cloud Firewall\u2019s effect is obvious.<\/li>\n<\/ol>\n\n\n\n<p><strong>Security group inbound rules for the lab (example):<\/strong>\n&#8211; TCP 22 from <code>0.0.0.0\/0<\/code>\n&#8211; TCP 80 from <code>0.0.0.0\/0<\/code><\/p>\n\n\n\n<blockquote>\n<p>This is intentionally permissive for demonstration. In production, you would not do this.<\/p>\n<\/blockquote>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You have an ECS instance with:\n  &#8211; A public IPv4 address (or an EIP)\n  &#8211; Security group allowing SSH\/HTTP inbound<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Note the instance public IP from the ECS instance details page.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Install a simple web service (NGINX) on the ECS instance<\/h3>\n\n\n\n<p>SSH into the instance from your laptop:<\/p>\n\n\n\n<pre><code class=\"language-bash\">ssh &lt;username&gt;@&lt;public-ip&gt;\n<\/code><\/pre>\n\n\n\n<p>Install NGINX (commands vary by distro). Examples:<\/p>\n\n\n\n<p><strong>Ubuntu\/Debian:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">sudo apt-get update\nsudo apt-get install -y nginx\nsudo systemctl enable --now nginx\n<\/code><\/pre>\n\n\n\n<p><strong>CentOS\/RHEL\/Alibaba Cloud Linux (may vary):<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">sudo yum install -y nginx\nsudo systemctl enable --now nginx\n<\/code><\/pre>\n\n\n\n<p>Confirm NGINX is listening:<\/p>\n\n\n\n<pre><code class=\"language-bash\">sudo ss -lntp | grep ':80'\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; NGINX is running and listening on port 80.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\nFrom your laptop:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -I http:\/\/&lt;public-ip&gt;\/\n<\/code><\/pre>\n\n\n\n<p>You should see an HTTP response (for example <code>200 OK<\/code> or <code>301 Moved Permanently<\/code> depending on distro config).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Determine your public IP address for SSH allowlisting<\/h3>\n\n\n\n<p>From your laptop, find your public IP (examples):<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -s https:\/\/ifconfig.me\n<\/code><\/pre>\n\n\n\n<p>or:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -s https:\/\/api.ipify.org\n<\/code><\/pre>\n\n\n\n<p>Record the result as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>MY_IP = x.x.x.x<\/code><\/li>\n<\/ul>\n\n\n\n<p>You will use <code>MY_IP\/32<\/code> in firewall rules.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You know the exact public IP you will allow for SSH.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; If you are on a corporate VPN, verify whether the VPN changes your public IP.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Activate Cloud Firewall and locate your Internet-facing asset<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the Cloud Firewall console (from Alibaba Cloud console search for \u201cCloud Firewall\u201d), or go via product page links:\n   &#8211; https:\/\/www.alibabacloud.com\/product\/cloud-firewall<\/li>\n<li>If this is your first time:\n   &#8211; Follow prompts to <strong>activate\/subscribe<\/strong>.<\/li>\n<li>In Cloud Firewall, find the section that lists Internet-exposed\/protected assets (often labeled similar to \u201cInternet Firewall\u201d or \u201cAssets\u201d depending on console version).<\/li>\n<li>Confirm your ECS public IP (or EIP) appears in the asset list.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Cloud Firewall is active in your account.\n&#8211; Your public IP asset is visible and can be placed under Cloud Firewall protection.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; If the asset does not appear:\n  &#8211; Confirm the ECS has a public IPv4\/EIP.\n  &#8211; Confirm you are in the correct account.\n  &#8211; Check region-related views in the console.\n  &#8211; Verify supported asset types in docs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Enable protection for the ECS public IP (if required)<\/h3>\n\n\n\n<p>Depending on how Cloud Firewall presents assets, you may need to:\n&#8211; \u201cEnable protection\u201d for the public IP, or\n&#8211; Add it to a protected asset scope.<\/p>\n\n\n\n<p>In the Cloud Firewall console:\n1. Select the asset representing your ECS public IP\/EIP.\n2. Choose the action to enable protection.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The public IP asset is marked as protected\/managed by Cloud Firewall.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Look for a status such as \u201cProtected\u201d, \u201cEnabled\u201d, or similar.<\/p>\n\n\n\n<blockquote>\n<p>If you cannot find an explicit enable step, Cloud Firewall may be protecting assets by default once subscribed. <strong>Verify in official docs<\/strong> for your console version.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Create Cloud Firewall inbound access control policies<\/h3>\n\n\n\n<p>Go to the Cloud Firewall access control policy area for <strong>Internet inbound<\/strong> rules (menu labels vary; commonly \u201cInternet Firewall\u201d \u2192 \u201cAccess Control\u201d).<\/p>\n\n\n\n<p>Create rules in this order (high priority first). If Cloud Firewall uses numeric priorities, use smaller numbers for higher priority; <strong>verify rule evaluation logic in your console<\/strong>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Rule 1: Allow SSH from your IP only<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Direction: Inbound<\/li>\n<li>Action: Allow<\/li>\n<li>Protocol: TCP<\/li>\n<li>Source: <code>MY_IP\/32<\/code><\/li>\n<li>Destination: your ECS public IP asset (or \u201call protected assets\u201d if you want a broader rule\u2014use caution)<\/li>\n<li>Destination port: <code>22<\/code><\/li>\n<li>Description: <code>Allow SSH from my IP<\/code><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Rule 2: Allow HTTP (port 80)<\/h4>\n\n\n\n<p>For a safer lab, you can also restrict to your IP, but allowing from anywhere makes it easier to validate quickly.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Direction: Inbound<\/li>\n<li>Action: Allow<\/li>\n<li>Protocol: TCP<\/li>\n<li>Source: <code>0.0.0.0\/0<\/code> (or <code>MY_IP\/32<\/code>)<\/li>\n<li>Destination: your ECS public IP asset<\/li>\n<li>Destination port: <code>80<\/code><\/li>\n<li>Description: <code>Allow HTTP<\/code><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Rule 3: Deny all other inbound traffic<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Direction: Inbound<\/li>\n<li>Action: Deny<\/li>\n<li>Protocol: Any (or TCP\/UDP\/ICMP as supported)<\/li>\n<li>Source: <code>0.0.0.0\/0<\/code><\/li>\n<li>Destination: your ECS public IP asset<\/li>\n<li>Destination port: Any<\/li>\n<li>Description: <code>Default deny inbound<\/code><\/li>\n<\/ul>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Cloud Firewall rules now define an explicit allowlist and a default deny.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Confirm the policies are \u201cEnabled\/Effective\u201d.\n&#8211; Confirm rule order is correct (allow rules above deny-all).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Validate enforcement (SSH and HTTP)<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Validate SSH works from your IP<\/h4>\n\n\n\n<p>From your laptop:<\/p>\n\n\n\n<pre><code class=\"language-bash\">ssh &lt;username&gt;@&lt;public-ip&gt;\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; SSH succeeds from your allowlisted IP.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Validate HTTP works (if allowed)<\/h4>\n\n\n\n<p>From your laptop:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -I http:\/\/&lt;public-ip&gt;\/\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; HTTP returns headers successfully.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Validate \u201cdeny all other inbound\u201d is effective<\/h4>\n\n\n\n<p>You need a source IP <strong>not in your allowlist<\/strong> to test. Options:\n&#8211; Disable VPN (if it changes your IP) and retry SSH; or\n&#8211; Use a different network (mobile hotspot) and retry SSH; or\n&#8211; Ask a colleague to try SSH from their IP (do not share credentials).<\/p>\n\n\n\n<p>If you attempt SSH from a non-allowed IP, you should see a timeout or connection failure.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; SSH from non-allowlisted IP fails.\n&#8211; Allowed services still work as configured.<\/p>\n\n\n\n<p><strong>Important note about troubleshooting:<\/strong> If SSH fails even from your allowlisted IP, the cause could be:\n&#8211; Rule order\/priority\n&#8211; Wrong source IP (your IP changed)\n&#8211; Security group\/NACL issues\n&#8211; OS firewall (iptables\/nftables\/ufw)\n&#8211; Cloud Firewall asset protection not enabled<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Review Cloud Firewall logs\/events for the blocked traffic<\/h3>\n\n\n\n<p>In Cloud Firewall console:\n1. Navigate to logs\/events\/traffic analysis (menu names vary).\n2. Filter:\n   &#8211; Asset = your public IP\n   &#8211; Direction = inbound\n   &#8211; Ports = 22 or 80\n3. Look for:\n   &#8211; Allowed SSH from your IP\n   &#8211; Blocked SSH attempts (if you tested from another IP)\n   &#8211; Deny-all rule hits<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You can see policy hits and traffic events that match your tests.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; If you see no logs:\n  &#8211; Confirm logging is enabled in your Cloud Firewall edition\/configuration.\n  &#8211; Verify log latency (some logs appear after a delay).\n  &#8211; Verify whether logs require additional configuration or paid retention.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>ECS security group allows inbound 22\/80 from <code>0.0.0.0\/0<\/code> (lab setup).<\/li>\n<li>Cloud Firewall allows:\n   &#8211; SSH only from <code>MY_IP\/32<\/code>\n   &#8211; HTTP as configured<\/li>\n<li>Cloud Firewall denies all other inbound.<\/li>\n<li>SSH works from your IP.<\/li>\n<li>SSH fails from non-allowlisted IP.<\/li>\n<li>Logs show allowed\/blocked events and rule hits.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Problem: SSH fails even from MY_IP<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm your current public IP:\n  <code>bash\n  curl -s https:\/\/api.ipify.org<\/code><\/li>\n<li>Update the Cloud Firewall allow rule to the correct <code>MY_IP\/32<\/code>.<\/li>\n<li>Check rule order: allow rule must be above deny-all.<\/li>\n<li>Check ECS security group allows inbound 22 from your source.<\/li>\n<li>Check OS firewall:<\/li>\n<li>Ubuntu: <code>sudo ufw status<\/code><\/li>\n<li>General: <code>sudo iptables -S<\/code> or <code>sudo nft list ruleset<\/code> (varies)<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Problem: Policies exist but don\u2019t seem to take effect<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm the asset is actually under Cloud Firewall protection.<\/li>\n<li>Confirm the rule targets the correct asset (public IP vs EIP vs \u201call assets\u201d).<\/li>\n<li>Verify Cloud Firewall supports that asset type\/path in your region\/edition.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Problem: No logs appear<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Verify logging is enabled and supported by your edition.<\/li>\n<li>Check if log viewing requires additional configuration or retention purchase.<\/li>\n<li>Look for delays; retry after a few minutes.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Problem: HTTP works but logs show it blocked (or vice versa)<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure you are testing the correct IP and port.<\/li>\n<li>Confirm there isn\u2019t another listener (like a different service) redirecting traffic.<\/li>\n<li>Re-check rule evaluation logic (first match vs other behavior).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing charges and reduce risk exposure:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Delete or disable Cloud Firewall policies<\/strong> created for the lab:\n   &#8211; Remove allow SSH\/HTTP rules and deny-all rules (or disable them).<\/li>\n<li><strong>Disable protection<\/strong> for the lab asset (if your console provides that control).<\/li>\n<li><strong>ECS cleanup (optional but recommended):<\/strong>\n   &#8211; Stop and release the ECS instance if it was created only for this lab.<\/li>\n<li><strong>Release public IP resources<\/strong> if applicable:\n   &#8211; Release EIP (if you allocated one separately).<\/li>\n<li><strong>Log retention\/export cleanup:<\/strong>\n   &#8211; If you enabled log export to an external logging service, disable export and clean up log stores (only if safe and compliant).<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>layered controls<\/strong>:<\/li>\n<li>Cloud Firewall for centralized boundary policy and logging<\/li>\n<li>Security groups for instance-level segmentation<\/li>\n<li>NACLs where subnet-level stateless control is needed<\/li>\n<li>WAF for HTTP\/HTTPS application-layer protections<\/li>\n<li>Design <strong>network segmentation<\/strong> explicitly:<\/li>\n<li>Separate prod\/dev\/test<\/li>\n<li>Separate public subnets (DMZ) from private app\/data subnets<\/li>\n<li>Prefer <strong>private connectivity<\/strong> for internal services (use internal SLB, private endpoints) and expose only necessary public endpoints.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>RAM roles\/users<\/strong>; avoid using the root account for daily operations.<\/li>\n<li>Apply <strong>least privilege<\/strong>:<\/li>\n<li>Security engineers can manage baseline policies<\/li>\n<li>App teams can request exceptions via a controlled workflow<\/li>\n<li>Enable <strong>MFA<\/strong> for privileged users.<\/li>\n<li>Use <strong>ActionTrail<\/strong> (or equivalent audit logging) for policy changes (verify integration).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keep protected scope aligned to risk:<\/li>\n<li>Protect all Internet-facing assets in production<\/li>\n<li>Avoid protecting unused\/temporary public IPs<\/li>\n<li>Control logging costs:<\/li>\n<li>Define a retention period<\/li>\n<li>Export only required logs to SIEM<\/li>\n<li>Regularly prune unused rules and address books.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keep rule sets manageable and well-structured:<\/li>\n<li>Use address books for IP ranges<\/li>\n<li>Group rules by environment and application<\/li>\n<li>Avoid overly broad allow rules that negate security value.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Treat policy changes as production changes:<\/li>\n<li>Use change windows for risky rules<\/li>\n<li>Validate with staging first<\/li>\n<li>Maintain rollback procedures (previous rule snapshots)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create a standard <strong>rule naming convention<\/strong>:<\/li>\n<li><code>env-app-direction-action-port-owner-ticket<\/code><\/li>\n<li>Review rule hit counts and logs regularly.<\/li>\n<li>Set up alerting for:<\/li>\n<li>Spikes in denied traffic<\/li>\n<li>Newly detected public exposures (if Cloud Firewall provides exposure insights)<\/li>\n<li>Changes to critical deny\/allow rules<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use consistent naming for:<\/li>\n<li>Address books (e.g., <code>AB-CORP-OFFICE-IPV4<\/code>)<\/li>\n<li>Policies (e.g., <code>PROD-WEB-INBOUND-ALLOW-443<\/code>)<\/li>\n<li>Track ownership and ticket references in rule descriptions.<\/li>\n<li>Periodically run access reviews (quarterly is common in regulated environments).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Firewall management is controlled through <strong>Alibaba Cloud RAM<\/strong>.<\/li>\n<li>Implement separation of duties:<\/li>\n<li>Read-only access for auditors and most engineers<\/li>\n<li>Change access for a small group with approvals<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Firewall is a managed service; encryption at rest and in transit for control plane data is handled by Alibaba Cloud according to product design.<\/li>\n<li>For logs exported to other services:<\/li>\n<li>Ensure encryption is enabled in the destination logging\/storage service (for example, Log Service settings\u2014verify).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Firewall helps reduce exposure, but you must still:<\/li>\n<li>Close unnecessary ports at security group level<\/li>\n<li>Avoid public IPs for private services<\/li>\n<li>Use bastions\/VPN for admin access<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not store secrets in firewall rule descriptions or address books.<\/li>\n<li>Use Secrets Manager or equivalent secret stores for credentials used to access ECS.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable audit trails for Cloud Firewall configuration changes (ActionTrail).<\/li>\n<li>Enable traffic logging where required for compliance.<\/li>\n<li>Define retention and access policies for logs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<p>Cloud Firewall can support compliance evidence by providing:\n&#8211; Central policy definitions\n&#8211; Change history (via audit trails)\n&#8211; Traffic logs demonstrating enforcement<\/p>\n\n\n\n<p>However:\n&#8211; Compliance frameworks require process and governance; Cloud Firewall is only one part of a control system.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Leaving a broad allow rule above a deny-all (accidental exposure).<\/li>\n<li>Allowlisting \u201ctemporary\u201d IP ranges and never removing them.<\/li>\n<li>Assuming Cloud Firewall replaces security groups and then leaving SGs overly open.<\/li>\n<li>Not validating rule order\/priority after changes.<\/li>\n<li>Not monitoring logs; blocking critical traffic unintentionally.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with <strong>deny-by-default inbound<\/strong>, then explicitly allow required ports.<\/li>\n<li>Restrict management access (SSH\/RDP) to:<\/li>\n<li>Corporate IPs, VPN egress IPs, or bastion hosts<\/li>\n<li>Keep production logging enabled and protected from tampering (least privilege, retention policies).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Because Cloud Firewall capabilities evolve and vary by edition\/region, treat the following as common considerations and <strong>verify details in official docs<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations \/ constraints to check<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Supported asset types<\/strong>: Not every network product\/path may be protectable.<\/li>\n<li><strong>Regional support<\/strong>: Some features may be limited to certain regions.<\/li>\n<li><strong>Protocol\/port coverage<\/strong>: Verify which protocols (TCP\/UDP\/ICMP) and which traffic directions are supported for each firewall type.<\/li>\n<li><strong>IPv6<\/strong>: Verify whether IPv6 traffic is supported for your scenario.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<p>Common quota categories:\n&#8211; Maximum number of protected assets (public IPs\/EIPs)\n&#8211; Maximum number of access control rules\n&#8211; Address book size and number of objects\n&#8211; Log retention and storage limits<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log retention\/export can become expensive at scale.<\/li>\n<li>Traffic-based pricing components (if applicable in your edition) can be a major driver.<\/li>\n<li>Protecting large numbers of public IPs across multiple teams can increase subscription size.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Overlapping controls: Security groups, NACLs, route tables, and Cloud Firewall can all affect traffic.<\/li>\n<li>If you use multiple enforcement layers, troubleshooting requires checking each layer in order.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Rule order matters<\/strong>: A deny-all placed above allow rules will break access.<\/li>\n<li><strong>Your source IP changes<\/strong>: VPN and ISP changes can cause lockouts if you rely on IP allowlisting.<\/li>\n<li><strong>Log delay<\/strong>: Some event logs may appear after a short delay; don\u2019t assume \u201cno logs\u201d means \u201cno enforcement.\u201d<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Moving from \u201csecurity groups only\u201d to Cloud Firewall requires:<\/li>\n<li>Rule normalization<\/li>\n<li>Ownership mapping (who owns which exceptions)<\/li>\n<li>Testing to avoid outages<\/li>\n<li>A rollback plan<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Vendor-specific nuances<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Console menus and terminology may change over time. Always cross-check the latest:<\/li>\n<li>Cloud Firewall docs: https:\/\/www.alibabacloud.com\/help\/en\/cloud-firewall\/<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Cloud Firewall is part of a broader set of network and security controls. The best choice often depends on the traffic layer (L3\/L4 vs L7), where you want enforcement, and operational needs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How Cloud Firewall differs from nearby Alibaba Cloud services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Security Groups (ECS):<\/strong> Instance-level virtual firewall rules, great for micro-segmentation but decentralized across teams.<\/li>\n<li><strong>Network ACLs (VPC):<\/strong> Subnet-level stateless controls; useful for coarse segmentation.<\/li>\n<li><strong>WAF:<\/strong> L7 protection for HTTP\/HTTPS (OWASP Top 10, bot protection depending on product).<\/li>\n<li><strong>Anti-DDoS:<\/strong> DDoS mitigation, not a policy-based firewall replacement.<\/li>\n<li><strong>Third-party firewall appliances on ECS:<\/strong> Full control and deep features, but you manage scaling\/HA and operational overhead.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Alibaba Cloud Cloud Firewall<\/strong><\/td>\n<td>Centralized network policy, visibility, audit across many assets<\/td>\n<td>Central control, unified policies, logging\/visibility, reduces SG sprawl<\/td>\n<td>Edition\/asset-type constraints; cost grows with assets\/logs; needs governance<\/td>\n<td>You need centralized control and audit for Internet and supported inter-network traffic<\/td>\n<\/tr>\n<tr>\n<td><strong>ECS Security Groups<\/strong><\/td>\n<td>Instance-level segmentation<\/td>\n<td>Simple, close to workloads, no extra subscription<\/td>\n<td>Decentralized management, inconsistent policies, harder auditing<\/td>\n<td>Small environments or when you need workload-level micro-segmentation primarily<\/td>\n<\/tr>\n<tr>\n<td><strong>VPC Network ACL (NACL)<\/strong><\/td>\n<td>Subnet-level coarse control<\/td>\n<td>Stateless, can enforce at subnet boundary<\/td>\n<td>Harder to manage at scale; limited context; can be error-prone<\/td>\n<td>You need subnet-level deny\/allow independent of instance SGs<\/td>\n<\/tr>\n<tr>\n<td><strong>Alibaba Cloud WAF<\/strong><\/td>\n<td>Web apps\/APIs over HTTP\/HTTPS<\/td>\n<td>L7 protections, virtual patching, bot and application threat mitigation (product-dependent)<\/td>\n<td>Only for HTTP\/HTTPS; not for generic TCP services<\/td>\n<td>You expose web workloads and need OWASP and L7 security<\/td>\n<\/tr>\n<tr>\n<td><strong>Alibaba Cloud Anti-DDoS<\/strong><\/td>\n<td>DDoS mitigation<\/td>\n<td>Handles volumetric\/protocol attacks<\/td>\n<td>Not an access-control firewall<\/td>\n<td>You\u2019re under DDoS risk and need mitigation at scale<\/td>\n<\/tr>\n<tr>\n<td><strong>Self-managed firewall appliance (3rd party) on ECS<\/strong><\/td>\n<td>Custom firewall features, deep inspection, complex routing<\/td>\n<td>Full feature control, vendor ecosystem<\/td>\n<td>You manage HA, scaling, upgrades; higher ops cost<\/td>\n<td>You need appliance-specific features not provided by Cloud Firewall<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: regulated fintech with multi-environment segmentation<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA fintech runs multiple products on Alibaba Cloud across prod, staging, and dev VPCs. Different teams manage security groups inconsistently. Audit requires clear evidence of inbound restrictions and change tracking.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; Internet-facing endpoints behind supported public assets (for example load balancers or public IPs).\n&#8211; Cloud Firewall:\n  &#8211; Central inbound allowlist for web ports and admin ports\n  &#8211; Deny risky ports globally\n  &#8211; Environment segmentation rules (where supported) between VPCs\n  &#8211; Centralized logging and export to SIEM (via log integration\u2014verify)\n&#8211; Security groups:\n  &#8211; Service-to-service micro-segmentation within each VPC\n&#8211; ActionTrail enabled for audit of policy changes\n&#8211; WAF in front of web apps for L7 threats (if web traffic)<\/p>\n\n\n\n<p><strong>Why Cloud Firewall was chosen<\/strong>\n&#8211; Central policy management for audit and governance\n&#8211; Visibility and investigation support through logs\n&#8211; Reduced configuration drift across many teams<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Reduced public exposure incidents\n&#8211; Faster audit reporting (clear rules and change history)\n&#8211; Improved incident response: quick blocks and verifiable enforcement<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: SaaS team securing a small fleet of ECS instances<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA SaaS startup has a small number of ECS instances with public IPs. They need to reduce brute-force attempts and avoid accidentally exposing admin ports.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; Cloud Firewall:\n  &#8211; Allow SSH only from founders\u2019 fixed IPs \/ VPN\n  &#8211; Allow 80\/443 publicly\n  &#8211; Deny all else\n  &#8211; Basic logging for troubleshooting\n&#8211; Security groups remain minimal and aligned with Cloud Firewall\n&#8211; Optional: WAF once the web app grows and becomes a target<\/p>\n\n\n\n<p><strong>Why Cloud Firewall was chosen<\/strong>\n&#8211; Central, simple rules rather than per-instance security group complexity\n&#8211; Quick way to enforce \u201cno public SSH\u201d except for trusted IPs<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Fewer intrusion attempts reaching the hosts\n&#8211; Clear visibility into blocked traffic\n&#8211; Reduced chance of misconfiguration as the team scales<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is Cloud Firewall a replacement for ECS security groups?<\/strong><br\/>\nNo. Use Cloud Firewall for centralized boundary policies and visibility; use security groups for instance-level controls and micro-segmentation. In most environments, you use both.<\/p>\n\n\n\n<p>2) <strong>Does Cloud Firewall protect Layer 7 (HTTP) attacks like SQL injection?<\/strong><br\/>\nCloud Firewall is primarily a network firewall service. For HTTP\/HTTPS application-layer protections, use <strong>Alibaba Cloud WAF<\/strong>. Confirm any L7 features in Cloud Firewall (if mentioned) in official docs for your edition.<\/p>\n\n\n\n<p>3) <strong>Can I restrict SSH to my office IP using Cloud Firewall?<\/strong><br\/>\nYes, that\u2019s a common pattern: allow TCP\/22 from <code>your_ip\/32<\/code> and deny other inbound traffic. Ensure rule priority is correct.<\/p>\n\n\n\n<p>4) <strong>Why do I still need security groups if Cloud Firewall blocks traffic?<\/strong><br\/>\nDefense in depth. Security groups provide local segmentation and prevent lateral movement within a VPC. Also, some traffic paths may not be covered by Cloud Firewall depending on asset type.<\/p>\n\n\n\n<p>5) <strong>How do I know if Cloud Firewall is actually enforcing policies?<\/strong><br\/>\nValidate with controlled tests (allow then deny), check policy hit counters (if available), and review traffic logs for allowed\/blocked events.<\/p>\n\n\n\n<p>6) <strong>Can Cloud Firewall control outbound traffic?<\/strong><br\/>\nOften yes for supported scenarios, but outbound coverage depends on protected asset type and edition. Verify outbound policy support in official docs.<\/p>\n\n\n\n<p>7) <strong>Does Cloud Firewall support IPv6?<\/strong><br\/>\nIPv6 support varies by product and scenario. Verify IPv6 coverage in the Cloud Firewall documentation.<\/p>\n\n\n\n<p>8) <strong>What is the biggest operational risk when using Cloud Firewall?<\/strong><br\/>\nLockouts due to rule ordering and incorrect allowlisting (for example, your IP changes). Always keep an emergency access path and test changes.<\/p>\n\n\n\n<p>9) <strong>How should I structure rules for large organizations?<\/strong><br\/>\nStart with baseline global denies and minimal global allows, then add scoped exceptions per application\/environment using address books and clear naming conventions.<\/p>\n\n\n\n<p>10) <strong>Can I export Cloud Firewall logs to a SIEM?<\/strong><br\/>\nMany organizations export logs via a centralized logging service (often Log Service). Verify current supported export\/integration options in official docs.<\/p>\n\n\n\n<p>11) <strong>How do I troubleshoot a connection issue when both Cloud Firewall and security groups exist?<\/strong><br\/>\nCheck in order:\n&#8211; Cloud Firewall policy matches\/logs\n&#8211; Security group inbound\/outbound rules\n&#8211; NACLs (if used)\n&#8211; Route tables and gateways\n&#8211; OS firewall\n&#8211; Application listener\/service health<\/p>\n\n\n\n<p>12) <strong>Does Cloud Firewall block DDoS attacks?<\/strong><br\/>\nDDoS mitigation is typically handled by Anti-DDoS services. Cloud Firewall can help with policy-based blocking, but it\u2019s not a DDoS scrubbing service.<\/p>\n\n\n\n<p>13) <strong>How do I avoid paying too much for logs?<\/strong><br\/>\nKeep only required retention, filter\/export selectively, and implement a data lifecycle policy in your logging backend.<\/p>\n\n\n\n<p>14) <strong>Can I apply Cloud Firewall policies across multiple accounts?<\/strong><br\/>\nMulti-account governance depends on Alibaba Cloud\u2019s account management features and Cloud Firewall\u2019s support for centralized management. Verify current best practice for multi-account setups in official docs.<\/p>\n\n\n\n<p>15) <strong>What\u2019s the safest way to roll out a deny-by-default policy?<\/strong><br\/>\nStart in staging, add allow rules for required services, monitor logs, then roll out gradually to production. Keep a rollback plan and avoid making simultaneous large changes.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Cloud Firewall<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>Cloud Firewall Documentation (Alibaba Cloud Help Center) \u2013 https:\/\/www.alibabacloud.com\/help\/en\/cloud-firewall\/<\/td>\n<td>Most accurate and current feature\/workflow reference<\/td>\n<\/tr>\n<tr>\n<td>Official product page<\/td>\n<td>Cloud Firewall Product Page \u2013 https:\/\/www.alibabacloud.com\/product\/cloud-firewall<\/td>\n<td>High-level overview, links to docs and getting started<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Cloud Firewall Pricing \u2013 https:\/\/www.alibabacloud.com\/product\/cloud-firewall\/pricing<\/td>\n<td>Current pricing model, editions, and billing dimensions (verify details per region)<\/td>\n<\/tr>\n<tr>\n<td>Official RAM docs<\/td>\n<td>Resource Access Management (RAM) \u2013 https:\/\/www.alibabacloud.com\/help\/en\/ram<\/td>\n<td>Required for least-privilege access and operational governance<\/td>\n<\/tr>\n<tr>\n<td>Official audit logging<\/td>\n<td>ActionTrail \u2013 https:\/\/www.alibabacloud.com\/help\/en\/actiontrail<\/td>\n<td>Track who changed firewall configuration (verify integration patterns)<\/td>\n<\/tr>\n<tr>\n<td>Official logging<\/td>\n<td>Log Service (SLS) \u2013 https:\/\/www.alibabacloud.com\/help\/en\/log-service<\/td>\n<td>Centralized retention, search, and SIEM export for security logs<\/td>\n<\/tr>\n<tr>\n<td>Official compute docs<\/td>\n<td>ECS Documentation \u2013 https:\/\/www.alibabacloud.com\/help\/en\/ecs<\/td>\n<td>Needed for lab setup, security groups, networking<\/td>\n<\/tr>\n<tr>\n<td>Official networking docs<\/td>\n<td>VPC Documentation \u2013 https:\/\/www.alibabacloud.com\/help\/en\/vpc<\/td>\n<td>Concepts for VPC segmentation and traffic paths that Cloud Firewall may control<\/td>\n<\/tr>\n<tr>\n<td>Architecture guidance<\/td>\n<td>Alibaba Cloud Architecture Center \u2013 https:\/\/www.alibabacloud.com\/solutions\/architecture<\/td>\n<td>Reference architectures and security patterns (verify relevant ones for Cloud Firewall)<\/td>\n<\/tr>\n<tr>\n<td>Video learning<\/td>\n<td>Alibaba Cloud YouTube Channel \u2013 https:\/\/www.youtube.com\/c\/AlibabaCloud<\/td>\n<td>Webinars, demos, and product walkthroughs (availability varies)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>DevOpsSchool.com<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps engineers, SREs, platform and security engineers<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> DevOps + cloud operations; may include cloud security fundamentals and firewalling concepts<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>ScmGalaxy.com<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Beginners to intermediate IT professionals<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> DevOps tooling, SCM, automation fundamentals that support secure operations<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.scmgalaxy.com\/<\/p>\n<\/li>\n<li>\n<p><strong>CLoudOpsNow.in<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Cloud operations and platform teams<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> CloudOps practices, monitoring, governance, operational security basics<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/cloudopsnow.in\/<\/p>\n<\/li>\n<li>\n<p><strong>SreSchool.com<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> SREs, operations engineers, reliability-focused teams<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> Reliability engineering, incident response, production operations (including security operationalization)<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/sreschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>AiOpsSchool.com<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Ops teams adopting AIOps\/automation<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> Monitoring automation, event correlation, operational analytics that can complement security monitoring<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/aiopsschool.com\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>RajeshKumar.xyz<\/strong><br\/>\n   &#8211; <strong>Likely specialization:<\/strong> Cloud\/DevOps training content (verify specific course offerings on site)<br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Engineers seeking practical DevOps and cloud guidance<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/rajeshkumar.xyz\/<\/p>\n<\/li>\n<li>\n<p><strong>devopstrainer.in<\/strong><br\/>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps training and mentoring (verify cloud security topics on site)<br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Beginners to professionals building DevOps skills<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/devopstrainer.in\/<\/p>\n<\/li>\n<li>\n<p><strong>devopsfreelancer.com<\/strong><br\/>\n   &#8211; <strong>Likely specialization:<\/strong> Freelance DevOps services\/training resources (verify current offerings)<br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Teams\/individuals seeking hands-on guidance<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/devopsfreelancer.com\/<\/p>\n<\/li>\n<li>\n<p><strong>devopssupport.in<\/strong><br\/>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps support and enablement (verify training vs support offerings)<br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Teams needing operational support and knowledge transfer<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/devopssupport.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>cotocus.com<\/strong><br\/>\n   &#8211; <strong>Likely service area:<\/strong> Cloud\/DevOps consulting and implementation support (verify specific services on site)<br\/>\n   &#8211; <strong>Where they may help:<\/strong> Cloud migrations, secure cloud architecture reviews, DevOps enablement<br\/>\n   &#8211; <strong>Consulting use case examples:<\/strong> <\/p>\n<ul>\n<li>Designing network segmentation and firewall policies  <\/li>\n<li>Setting up centralized logging and audit trails  <\/li>\n<li>Implementing infrastructure governance patterns  <\/li>\n<li><strong>Website:<\/strong> https:\/\/cotocus.com\/<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>DevOpsSchool.com<\/strong><br\/>\n   &#8211; <strong>Likely service area:<\/strong> DevOps and cloud consulting, training-led enablement<br\/>\n   &#8211; <strong>Where they may help:<\/strong> Platform engineering, CI\/CD, operational readiness, basic security guardrails<br\/>\n   &#8211; <strong>Consulting use case examples:<\/strong> <\/p>\n<ul>\n<li>Building standard operating procedures for firewall policy changes  <\/li>\n<li>Designing a multi-environment rollout plan  <\/li>\n<li>Operations playbooks for troubleshooting and incident response  <\/li>\n<li><strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>DEVOPSCONSULTING.IN<\/strong><br\/>\n   &#8211; <strong>Likely service area:<\/strong> DevOps consulting services (verify scope on site)<br\/>\n   &#8211; <strong>Where they may help:<\/strong> Cloud operations, automation, governance, production readiness<br\/>\n   &#8211; <strong>Consulting use case examples:<\/strong> <\/p>\n<ul>\n<li>Policy standardization and rule lifecycle management  <\/li>\n<li>Logging\/monitoring integration design  <\/li>\n<li>Secure baseline implementation across multiple teams  <\/li>\n<li><strong>Website:<\/strong> https:\/\/devopsconsulting.in\/<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Cloud Firewall<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Networking fundamentals:<\/li>\n<li>TCP\/IP, ports, routing, NAT basics<\/li>\n<li>Cloud networking on Alibaba Cloud:<\/li>\n<li>VPC, subnets\/vSwitches, route tables<\/li>\n<li>Security groups vs NACLs<\/li>\n<li>Public IP vs EIP concepts<\/li>\n<li>Linux administration basics (for validation and troubleshooting)<\/li>\n<li>IAM basics:<\/li>\n<li>Alibaba Cloud RAM users, roles, policies<\/li>\n<li>Logging fundamentals:<\/li>\n<li>What to log, retention, and access control<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after Cloud Firewall<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Alibaba Cloud <strong>WAF<\/strong> for application-layer security<\/li>\n<li><strong>Security Center<\/strong> for host security, vulnerability management, baseline hardening<\/li>\n<li><strong>ActionTrail<\/strong> + <strong>Log Service<\/strong> pipelines for centralized audit and SIEM integration<\/li>\n<li>Threat modeling and incident response playbooks<\/li>\n<li>Infrastructure as Code:<\/li>\n<li>Automating firewall policies via OpenAPI\/SDKs (verify Cloud Firewall API coverage)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Security Engineer<\/li>\n<li>Security Operations Engineer (SecOps)<\/li>\n<li>Cloud Network Engineer<\/li>\n<li>Platform Engineer<\/li>\n<li>SRE \/ Production Engineer<\/li>\n<li>DevOps Engineer (with security responsibility)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Alibaba Cloud certifications and security specialty paths change over time.<br\/>\n&#8211; Check Alibaba Cloud certification portal and official training pages for current security-related certifications.<br\/>\n&#8211; If a Cloud Firewall-specific credential exists, <strong>verify in official Alibaba Cloud training\/certification resources<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Build a baseline policy set:\n   &#8211; Deny risky ports globally\n   &#8211; Allow web ports only where needed<\/li>\n<li>Implement a bastion-only admin access design:\n   &#8211; No direct SSH to app servers from Internet<\/li>\n<li>Create environment segmentation (dev\/staging\/prod) and validate allowed flows<\/li>\n<li>Export firewall logs to Log Service and build dashboards for:\n   &#8211; Top denied sources\n   &#8211; Top targeted ports\n   &#8211; New destination anomalies (egress)<\/li>\n<li>Create an \u201cemergency response\u201d runbook:\n   &#8211; How to block an IP range quickly\n   &#8211; How to confirm enforcement and rollback<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Access control policy:<\/strong> A rule that allows or denies traffic based on source, destination, port, protocol, and direction.<\/li>\n<li><strong>Address book:<\/strong> A reusable set of IP addresses or CIDR blocks used in multiple firewall rules.<\/li>\n<li><strong>CIDR:<\/strong> Notation for IP ranges (e.g., <code>203.0.113.5\/32<\/code> for a single IP).<\/li>\n<li><strong>Defense in depth:<\/strong> Using multiple layers of controls (Cloud Firewall + security groups + WAF) so one failure doesn\u2019t cause a breach.<\/li>\n<li><strong>ECS:<\/strong> Elastic Compute Service; Alibaba Cloud virtual machine service.<\/li>\n<li><strong>EIP:<\/strong> Elastic IP; a public IP that can be associated with cloud resources.<\/li>\n<li><strong>Egress traffic:<\/strong> Outbound traffic leaving your cloud network to the Internet or other networks.<\/li>\n<li><strong>Ingress traffic:<\/strong> Inbound traffic entering your cloud network from the Internet or other networks.<\/li>\n<li><strong>Least privilege:<\/strong> Granting only the minimum access required to do a job.<\/li>\n<li><strong>North-south traffic:<\/strong> Traffic between the Internet and your environment.<\/li>\n<li><strong>East-west traffic:<\/strong> Traffic within or between internal networks (e.g., VPC-to-VPC).<\/li>\n<li><strong>NACL:<\/strong> Network Access Control List; subnet-level stateless filtering.<\/li>\n<li><strong>RAM:<\/strong> Resource Access Management; Alibaba Cloud identity and access service.<\/li>\n<li><strong>Security group:<\/strong> Instance-level stateful virtual firewall for ECS and related resources.<\/li>\n<li><strong>WAF:<\/strong> Web Application Firewall; protects HTTP\/HTTPS applications from common web attacks.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Alibaba Cloud <strong>Cloud Firewall<\/strong> is a managed <strong>Security<\/strong> service that centralizes firewall policy, visibility, and (edition-dependent) prevention capabilities for Internet-facing and supported inter-network traffic paths. It matters because it reduces configuration drift, improves auditability, and gives security and operations teams a clear, scalable way to enforce least-privilege network access across many assets.<\/p>\n\n\n\n<p>Cost is driven mainly by <strong>edition<\/strong>, <strong>number of protected assets<\/strong>, <strong>traffic volume<\/strong>, and <strong>log retention\/export<\/strong>. Security-wise, Cloud Firewall should be used as part of <strong>defense in depth<\/strong>\u2014alongside security groups, NACLs where appropriate, WAF for web apps, and strong IAM\/auditing with RAM and ActionTrail.<\/p>\n\n\n\n<p>Use Cloud Firewall when you need centralized control and logging at scale; avoid relying on it alone for application-layer security or for traffic paths it doesn\u2019t support in your region\/edition. Next, deepen your skills by integrating Cloud Firewall logs with centralized logging (Log Service) and building a standard operating model for policy change control and incident response.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,10],"tags":[],"class_list":["post-54","post","type-post","status-publish","format-standard","hentry","category-alibaba-cloud","category-security"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/54","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=54"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/54\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=54"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=54"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=54"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}