Update content

This commit is contained in:
OpenTelekomCloud Proposal Bot 2024-02-22 02:34:41 +00:00
parent 1905b7e029
commit 0b15f652d1
21 changed files with 162 additions and 20 deletions

Binary file not shown.

After

Width:  |  Height:  |  Size: 1004 B

Binary file not shown.

After

Width:  |  Height:  |  Size: 1004 B

Binary file not shown.

After

Width:  |  Height:  |  Size: 128 B

Binary file not shown.

After

Width:  |  Height:  |  Size: 128 B

View File

@ -5,10 +5,10 @@
Differences Between Security Groups and Firewalls
=================================================
You can configure firewall and security group rules to protect the instances in your VPC, such as ECSs, databases, and CCI pods.
You can configure firewall and security group rules to protect the instances in your VPC, such as ECSs, databases, and CCI instances.
- A security group protects the instances in it.
- A Firewall protects associated subnets and all the resources in the subnets.
- A firewall protects associated subnets and all the resources in the subnets.
For details, see :ref:`Figure 1 <en-us_topic_0052003963__fig9582182315479>`.
@ -28,7 +28,7 @@ For details, see :ref:`Figure 1 <en-us_topic_0052003963__fig9582182315479>`.
+-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Category | Security Group | Firewall |
+=======================+========================================================================================================================================================================+===========================================================================================================================================================================================================================================================+
| Protection Scope | Protects instances in a security group, such as ECSs, databases, and CCI. | Protects subnets and all the instances in the subnets. |
| Protection Scope | Protects instances in a security group, such as ECSs, databases, and CCI instances. | Protects subnets and all the instances in the subnets. |
+-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Rules | Does not support **Allow** or **Deny** rules. | Supports both **Allow** and **Deny** rules. |
+-----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

View File

@ -31,7 +31,7 @@ Firewall Basics
- Firewalls use connection tracking to track traffic to and from instances. Changes to inbound and outbound rules do not take effect immediately for the existing traffic.
If you add, modify, or delete a firewall rule, or associate or diassociate a subnet with or from a firewall, all the inbound and outbound persistent connections will not be disconnected New rules will only be applied for the new connections.
If you add, modify, or delete a firewall rule, or associate or disassociate a subnet with or from a firewall, all the inbound and outbound persistent connections will not be disconnected. New rules will only be applied for the new connections.
.. important::

View File

@ -8,6 +8,10 @@ Change History
+-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Released On | Description |
+===================================+====================================================================================================================================================================================================================================================================================================================================+
| 2024-02-18 | This release incorporates the following changes: |
| | |
| | Added :ref:`Adding a Secondary IPv4 CIDR Block to a VPC <vpc_vpc_0007>`, :ref:`Deleting a Secondary IPv4 CIDR Block from a VPC <vpc_vpc_0008>`, and :ref:`What Are the Differences Between 5_bgp, 5_mailbgp, and 5_gray EIPs? <en-us_topic_0000001799161498>` |
+-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 2024-02-02 | This release incorporates the following changes: |
| | |
| | Modified figures in :ref:`Creating a Custom Route Table <vpc_route01_0005>` and :ref:`Adding a Custom Route <vpc_route01_0006>`. |
@ -22,8 +26,8 @@ Change History
+-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 2023-12-19 | This release incorporates the following changes: |
| | |
| | - Added screenshots in :ref:`How Do I Configure a Security Group for Multi-Channel Protocols? <vpc_faq_0059>`. |
| | - Modified the table in :ref:`Why Can't I Delete My VPCs and Subnets? <vpc_faq_0075>`. |
| | - Added screenshots in :ref:`How Do I Configure a Security Group for Multi-Channel Protocols? <vpc_faq_0059>` |
| | - Modified the table in :ref:`Why Can't I Delete My VPCs and Subnets? <vpc_faq_0075>` |
+-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 2023-12-18 | This release incorporates the following changes: |
| | |
@ -138,7 +142,7 @@ Change History
| | |
| | Updated the following content: |
| | |
| | Modified links in :ref:`What Is Virtual Private Cloud? <en-us_topic_0013748729>` and :ref:`Can I Bind an EIP to Multiple ECSs? <vpc_faq_0019>`. |
| | Modified links in :ref:`What Is Virtual Private Cloud? <en-us_topic_0013748729>` and :ref:`Can I Bind an EIP to Multiple ECSs? <vpc_faq_0019>` |
+-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 2023-01-10 | This release incorporates the following changes: |
| | |
@ -196,7 +200,7 @@ Change History
| 2021-03-16 | Added the following FAQ: |
| | |
| | - :ref:`What Bandwidth Types Are Available? <vpc_faq_0012>` |
| | - :ref:`What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth? Can a Dedicated Bandwidth Be Changed to a Shared Bandwidth or the Other Way Around? <faq_bandwidth_0003>` |
| | - :ref:`What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth? <faq_bandwidth_0003>` |
+-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 2020-12-16 | This release incorporates the following changes: |
| | |

View File

@ -7,7 +7,7 @@ Bandwidth
- :ref:`What Is the Bandwidth Size Range? <vpc_faq_0011>`
- :ref:`What Bandwidth Types Are Available? <vpc_faq_0012>`
- :ref:`What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth? Can a Dedicated Bandwidth Be Changed to a Shared Bandwidth or the Other Way Around? <faq_bandwidth_0003>`
- :ref:`What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth? <faq_bandwidth_0003>`
.. toctree::
:maxdepth: 1
@ -15,4 +15,4 @@ Bandwidth
what_is_the_bandwidth_size_range
what_bandwidth_types_are_available
what_are_the_differences_between_a_dedicated_bandwidth_and_a_shared_bandwidth_can_a_dedicated_bandwidth_be_changed_to_a_shared_bandwidth_or_the_other_way_around
what_are_the_differences_between_a_dedicated_bandwidth_and_a_shared_bandwidth

View File

@ -2,8 +2,8 @@
.. _faq_bandwidth_0003:
What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth? Can a Dedicated Bandwidth Be Changed to a Shared Bandwidth or the Other Way Around?
==================================================================================================================================================================
What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth?
==============================================================================
A dedicated bandwidth can only be used by one EIP. An EIP can only be used by one cloud resource, such as an ECS, a NAT gateway, or a load balancer.

View File

@ -10,6 +10,7 @@ EIPs
- :ref:`How Do I Access an ECS with an EIP Bound from the Internet? <vpc_faq_0020>`
- :ref:`Can I Bind an EIP to a Cloud Resource in Another Region? <faq_eip_0012>`
- :ref:`Can I Change the Region of My EIP? <faq_eip_0014>`
- :ref:`What Are the Differences Between 5_bgp, 5_mailbgp, and 5_gray EIPs? <en-us_topic_0000001799161498>`
.. toctree::
:maxdepth: 1
@ -20,3 +21,4 @@ EIPs
how_do_i_access_an_ecs_with_an_eip_bound_from_the_internet
can_i_bind_an_eip_to_a_cloud_resource_in_another_region
can_i_change_the_region_of_my_eip
what_are_the_differences_between_5_bgp_5_mailbgp_and_5_gray_eips

View File

@ -0,0 +1,26 @@
:original_name: en-us_topic_0000001799161498.html
.. _en-us_topic_0000001799161498:
What Are the Differences Between 5_bgp, 5_mailbgp, and 5_gray EIPs?
===================================================================
:ref:`Table 1 <en-us_topic_0000001799161498__en-us_topic_0000001797977244_faq_bandwidth_0008_table1031220574471>` lists the differences between **5_bgp**, **5_mailbgp**, and **5_gray** EIPs.
.. _en-us_topic_0000001799161498__en-us_topic_0000001797977244_faq_bandwidth_0008_table1031220574471:
.. table:: **Table 1** Differences between **5_bgp**, **5_mailbgp**, and **5_gray** EIPs
+----------------------+-------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------+
| Dimension | 5_bgp EIP | 5_gray EIP | 5_mailbgp EIP |
+======================+=======================================================================================================+===============================================================================================================================================================================+=======================================================================================================+
| Application scenario | Dynamic BGP provides automatic failover and chooses the optimal path when a network connection fails. | **5_gray** EIPs can be bound to dedicated or shared load balancers for Internet access. | **5_mailbgp** EIPs are used together with port 25, 465, or 587 for email services. |
| | | | |
| | **5_bgp** EIPs can be bound to cloud resources except dedicated load balancers. | | |
+----------------------+-------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------+
| Differences | - Cannot be bound to dedicated load balancers. | - Can only be bound to dedicated or shared load balancers. | - Cannot be bound to dedicated load balancers. |
| | - Cannot be used for email services. | - Cannot be used for email services. | - Can be used for email services. |
+----------------------+-------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------+
| Constraints | The selected EIP type cannot be changed after the EIP is assigned. | - In **eu-de**, EIPs of the Dedicated Load Balancer (**5_gray**) type cannot be assigned anymore. You can assign EIPs of the BGP (**5_bgp**) type. | If you need an EIP of this type, contact the account administrator to grant the required permissions. |
| | | - Do not add EIPs of the dedicated load balancer type (**5_gray**) and other types to the same shared bandwidth. Otherwise, the bandwidth limit policy will not take effect. | |
+----------------------+-------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------+

View File

@ -14,7 +14,7 @@ Does a Modified Security Group Rule or a Firewall Rule Take Effect Immediately f
- Firewalls use connection tracking to track traffic to and from instances. Changes to inbound and outbound rules do not take effect immediately for the existing traffic.
If you add, modify, or delete a firewall rule, or associate or diassociate a subnet with or from a firewall, all the inbound and outbound persistent connections will not be disconnected New rules will only be applied for the new connections.
If you add, modify, or delete a firewall rule, or associate or disassociate a subnet with or from a firewall, all the inbound and outbound persistent connections will not be disconnected. New rules will only be applied for the new connections.
.. important::

View File

@ -35,7 +35,7 @@ The issues here are described in order of how likely they are to occur.
| | | |
| | - The security group rules of the ECSs that need to communicate deny inbound traffic from each other. | |
| | - The firewall of the ECS NIC blocks traffic. | |
| | - The network ACL rules of the subnets connected by the VPC peering connection deny inbound traffic. | |
| | - The firewall rules of the subnets connected by the VPC peering connection deny inbound traffic. | |
| | - Check the policy-based routing configuration of an ECS with multiple NICs. | |
+-----------------------+--------------------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------+
| 4 | ECS network failure | Refer to :ref:`ECS Network Failure <vpc_faq_0069__section8357923710>`. |
@ -143,9 +143,9 @@ Incorrect Network Configuration
If the firewall blocks traffic, configure the firewall to allow inbound traffic.
#. Check whether network ACL rules of the subnets connected by the VPC peering connection deny inbound traffic.
#. Check whether firewall rules of the subnets connected by the VPC peering connection deny inbound traffic.
If the network ACL rules deny inbound traffic, configure the rules to allow the traffic.
If the firewall rules deny inbound traffic, configure the rules to allow the traffic.
#. If an ECS has more than one NIC, check whether correct policy-based routing has been configured for the ECS and packets with different source IP addresses match their own routes from each NIC.

View File

@ -49,6 +49,8 @@ Procedure
| | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | |
+--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 |
| | | |
| | If the VPC has a secondary CIDR block, you can select the primary or the secondary CIDR block that the subnet will belong to based on service requirements. | |
+--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` |
| | | |

View File

@ -49,6 +49,8 @@ Procedure
| | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | |
+--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 |
| | | |
| | If the VPC has a secondary CIDR block, you can select the primary or the secondary CIDR block that the subnet will belong to based on service requirements. | |
+--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` |
| | | |

View File

@ -54,5 +54,5 @@ Advantage Comparison
+-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Flexibility | provides a variety of network services for you to choose from. If you need more network resources (for instance, if you need more bandwidth), you can expand resources on the fly. | You have to strictly comply with the network plan to complete the service deployment. If there are changes in your service requirements, it is difficult to dynamically adjust the network. |
+-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Security | VPCs are logically isolated from each other. You can use security features such as network ACLs and security groups, and even security services like Advanced Anti-DDoS (AAD) to protect your cloud resources. | The network is insecure and difficult to maintain. You need professional technical personnel to ensure network security. |
| Security | VPCs are logically isolated from each other. You can use security features such as firewalls and security groups, and even security services like Advanced Anti-DDoS (AAD) to protect your cloud resources. | The network is insecure and difficult to maintain. You need professional technical personnel to ensure network security. |
+-----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

View File

@ -28,7 +28,7 @@ Notes and Constraints
To check which ECSs support IPv6:
- On the ECS console, click **Buy ECS**. On the displayed page, view the ECS specifications.
- On the ECS console: Click **Create ECS**. On the displayed page, view the ECS specifications.
If there is the **IPv6** parameter with the value of **Yes**, the ECS specifications support IPv6.
@ -70,9 +70,9 @@ In the subnet list, click the subnet name. On the displayed page, view in-use IP
Add a security group rule with **Type** set to **IPv6** and **Source** or **Destination** set to an IPv6 address or IPv6 CIDR block.
**Adding a Network ACL Rule (IPv6)**
Adding an IPv6 Firewall Rule
Add a network ACL rule with **Type** set to **IPv6** and **Source** or **Destination** set to an IPv6 address or IPv6 CIDR block.
Add a firewall rule with **Type** set to **IPv6** and **Source** or **Destination** set to an IPv6 address or IPv6 CIDR block.
**Adding a Route (IPv6)**

View File

@ -49,6 +49,8 @@ Procedure
| | The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces. | |
+--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| IPv4 CIDR Block | The CIDR block for the subnet. This value must be within the VPC CIDR block. | 192.168.0.0/24 |
| | | |
| | If the VPC has a secondary CIDR block, you can select the primary or the secondary CIDR block that the subnet will belong to based on service requirements. | |
+--------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| IPv6 CIDR Block | Specifies whether to set **IPv6 CIDR Block** to **Enable**. | ``-`` |
| | | |

View File

@ -0,0 +1,64 @@
:original_name: vpc_vpc_0007.html
.. _vpc_vpc_0007:
Adding a Secondary IPv4 CIDR Block to a VPC
===========================================
Scenarios
---------
When you create a VPC, you specify a primary IPv4 CIDR block for the VPC, which cannot be changed. To extend the IP address range of your VPC, you can add a secondary CIDR block to the VPC.
Notes and Constraints
---------------------
- You can allocate a subnet from either a primary or a secondary CIDR block of a VPC. A subnet cannot use both the primary and the secondary CIDR blocks.
Subnets in the same VPC can communicate with each other by default, even if some subnets are allocated from the primary CIDR block and some are from the secondary CIDR block of a VPC.
- If a subnet in a secondary CIDR block of your VPC is the same as or overlaps with the destination of an existing route in the VPC route table, the existing route does not take effect.
If you create a subnet in a secondary CIDR block of your VPC, a route (the destination is the subnet CIDR block and the next hop is **Local**) is automatically added to your VPC route table. This route allows communications within the VPC and has a higher priority than any other routes in the VPC route table. For example, if a VPC route table has a route with the VPC peering connection as the next hop and 100.20.0.0/24 as the destination, and a route for the subnet in the secondary CIDR block has a destination of 100.20.0.0/16, 100.20.0.0/16 and 100.20.0.0/24 overlaps and traffic will be forwarded through the route of the subnet.
- :ref:`Table 1 <vpc_vpc_0007__table1060431941314>` lists the secondary CIDR blocks that are not supported.
.. _vpc_vpc_0007__table1060431941314:
.. table:: **Table 1** Restricted secondary CIDR blocks
+-----------------------------------+-----------------------------------+
| Type | CIDR Block (Not Supported) |
+===================================+===================================+
| Reserved system CIDR blocks | - 100.64.0.0/10 |
| | - 214.0.0.0/7 |
| | - 198.18.0.0/15 |
| | - 169.254.0.0/16 |
+-----------------------------------+-----------------------------------+
| Reserved public CIDR blocks | - 0.0.0.0/8 |
| | - 127.0.0.0/8 |
| | - 240.0.0.0/4 |
| | - 255.255.255.255/32 |
+-----------------------------------+-----------------------------------+
Procedure
---------
#. Log in to the management console.
#. Click |image1| in the upper left corner and select the desired region and project.
#. Click |image2| in the upper left corner and choose **Network** > **Virtual Private Cloud**.
The **Virtual Private Cloud** page is displayed.
#. In the VPC list, locate the row that contains the VPC and click **Edit CIDR Block** in the **Operation** column.
The **Edit CIDR Block** dialog box is displayed.
#. Click **Add Secondary IPv4 CIDR Block**.
#. Enter the secondary CIDR block and click **OK**.
.. |image1| image:: /_static/images/en-us_image_0000001429281925.png
.. |image2| image:: /_static/images/en-us_image_0000001626574374.png

View File

@ -0,0 +1,36 @@
:original_name: vpc_vpc_0008.html
.. _vpc_vpc_0008:
Deleting a Secondary IPv4 CIDR Block from a VPC
===============================================
Scenarios
---------
If a secondary CIDR block of a VPC is no longer required, you can delete it.
- A secondary IPv4 CIDR block of a VPC can be deleted, but the primary CIDR block cannot be deleted.
- If you want to delete a secondary CIDR block that contains subnets, you need to delete the subnets first.
Procedure
---------
#. Log in to the management console.
#. Click |image1| in the upper left corner and select the desired region and project.
#. Click |image2| in the upper left corner and choose **Network** > **Virtual Private Cloud**.
The **Virtual Private Cloud** page is displayed.
#. In the VPC list, locate the row that contains the VPC and click **Edit CIDR Block** in the **Operation** column.
The **Edit CIDR Block** dialog box is displayed.
#. Locate the row that contains the secondary CIDR block to be deleted and click **Delete** in the **Operation** column.
#. Click **OK**.
.. |image1| image:: /_static/images/en-us_image_0000001429973081.png
.. |image2| image:: /_static/images/en-us_image_0000001627054074.png

View File

@ -7,6 +7,8 @@ VPC
- :ref:`Creating a VPC <en-us_topic_0013935842>`
- :ref:`Modifying a VPC <en-us_topic_0030969462>`
- :ref:`Adding a Secondary IPv4 CIDR Block to a VPC <vpc_vpc_0007>`
- :ref:`Deleting a Secondary IPv4 CIDR Block from a VPC <vpc_vpc_0008>`
- :ref:`Deleting a VPC <vpc_vpc_0003>`
- :ref:`Managing VPC Tags <vpc_vpc_0004>`
- :ref:`Exporting VPC List <vpc_vpc_0006>`
@ -19,6 +21,8 @@ VPC
creating_a_vpc
modifying_a_vpc
adding_a_secondary_ipv4_cidr_block_to_a_vpc
deleting_a_secondary_ipv4_cidr_block_from_a_vpc
deleting_a_vpc
managing_vpc_tags
exporting_vpc_list