A VPC flow log records information about the traffic going to and from a VPC. VPC flow logs help you monitor network traffic, analyze network attacks, and determine whether security group and firewall rules require modification.
-VPC flow logs must be used together with the Log Tank Service (LTS). Before you create a VPC flow log, you need to create a log group and a log topic in LTS. Figure 1 shows the process for configuring the VPC flow log function.
- - -
Notes and Constraints
- Currently, only C3, M3, and S2 ECSs support VPC flow logs.
- By default, you can create a maximum of 10 VPC flow logs.
- By default, a maximum of 400,000 flow log records are supported.
A VPC flow log records information about the traffic going to and from a VPC. VPC flow logs help you monitor network traffic, analyze network attacks, and determine whether security group and firewall rules require modification.
+VPC flow logs must be used together with the Log Tank Service (LTS). Before you create a VPC flow log, you need to create a log group and a log topic in LTS. Figure 1 shows the process for configuring VPC flow logs.
+ + +Notes and Constraints
- Currently, only C3, M3, and S2 ECSs support VPC flow logs.
- By default, you can create a maximum of 10 VPC flow logs.
- By default, a maximum of 400,000 flow log records are supported.
Creating a VPC Flow Log
-Scenarios
A VPC flow log records information about the traffic going to and from a VPC.
+Scenarios
A VPC flow log records information about the traffic going to and from a VPC.
Prerequisites
Ensure that the following operations have been performed on the LTS console:
-- Create a log group.
- Create a log topic.
For more information about the LTS service, see the Log Tank Service User Guide.
+Prerequisites
Ensure that the following operations have been performed on the LTS console:
+- Create a log group.
- Create a log topic.
For more information about the LTS service, see the Log Tank Service User Guide.
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose VPC Flow Logs.
- In the upper right corner, click Create VPC Flow Log. On the displayed page, configure parameters as prompted.Figure 1 Create VPC Flow Log-
-Table 1 Parameter descriptions Parameter
+Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click
in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose VPC Flow Logs.
- In the upper right corner, click Create VPC Flow Log. On the displayed page, configure parameters as prompted.Figure 1 Create VPC Flow Log++-
Table 1 Parameter descriptions Parameter
Description
+Description
Example Value
+Example Value
Name
+Name
The VPC flow log name.
-The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
+The VPC flow log name.
+The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
flowlog-495d
+flowlog-495d
Resource Type
+Resource Type
The type of resources whose traffic is to be logged. You can select NIC, Subnet, or VPC.
+The type of resources whose traffic is to be logged. You can select NIC, Subnet, or VPC.
NIC
+NIC
Resource
+Resource
The specific NIC whose traffic is to be logged.
-NOTE:We recommend that you select an ECS that is in the running state. If an ECS in the stopped state is selected, restart the ECS after creating the VPC flow log for accurately recording the information about the traffic going to and from the ECS NIC.
+The specific NIC whose traffic is to be logged.
+NOTE:We recommend that you select an ECS that is in the running state. If an ECS in the stopped state is selected, restart the ECS after creating the VPC flow log for accurately recording the information about the traffic going to and from the ECS NIC.
N/A
+N/A
Filter
+Filter
- All traffic: specifies that both accepted and rejected traffic of the specified resource will be logged.
- Accepted traffic: specifies that only accepted traffic of the specified resource will be logged. Accepted traffic refers to the traffic permitted by the security group or firewall.
- Rejected traffic: specifies that only rejected traffic of the specified resource will be logged. Rejected traffic refers to the traffic denied by the firewall.
- All traffic: specifies that both accepted and rejected traffic of the specified resource will be logged.
- Accepted traffic: specifies that only accepted traffic of the specified resource will be logged. Accepted traffic refers to the traffic permitted by the security group or firewall.
- Rejected traffic: specifies that only rejected traffic of the specified resource will be logged. Rejected traffic refers to the traffic denied by the firewall.
All
+All
Log Group
+Log Group
The log group created in LTS.
+The log group created in LTS.
lts-group-wule
+lts-group-wule
Log Topic
+Log Topic
The log topic created in LTS.
+The log topic created in LTS.
LogTopic1
+LogTopic1
Description
+Description
Supplementary information about the VPC flow log. This parameter is optional.
-The VPC flow log description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+Supplementary information about the VPC flow log. This parameter is optional.
+The VPC flow log description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
N/A
+N/A
Only two flow logs, each with a different filter, can be created for a single resource under the same log group and log topic. Each VPC flow log must be unique.
+- Only two flow logs, each with a different filter, can be created for a single resource under the same log group and log topic. Each VPC flow log must be unique.
- Click OK.
+- Click OK.
diff --git a/docs/vpc/umn/FlowLog_0004.html b/docs/vpc/umn/FlowLog_0004.html index e0df3bd2..b6f25c2f 100644 --- a/docs/vpc/umn/FlowLog_0004.html +++ b/docs/vpc/umn/FlowLog_0004.html @@ -1,139 +1,139 @@Viewing a VPC Flow Log
-Scenarios
View information about your flow log record.
-The capture window is approximately 10 minutes, which indicates that a flow log record will be generated every 10 minutes. After creating a VPC flow log, you need to wait about 10 minutes before you can view the flow log record.
- If an ECS is in the stopped state, its flow log records will not be displayed.
+-Scenarios
View information about your flow log record.
+The capture window is approximately 10 minutes, which indicates that a flow log record will be generated every 10 minutes. After creating a VPC flow log, you need to wait about 10 minutes before you can view the flow log record.
+ If an ECS is in the stopped state, its flow log records will not be displayed.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose VPC Flow Logs.
- Locate the target VPC flow log and click View Log Record in the Operation column to view information about the flow log record in LTS.Figure 1 Viewing a log record-
Figure 2 Flow log record-
The flow log record is in the following format:
-<version> <project-id> <interface-id> <srcaddr> <dstaddr> <srcport> <dstport> <protocol> <packets> <bytes> <start> <end> <action> <log-status>
-Example 1: The following is an example of a flow log record in which data was recorded during the capture window:
-1 5f67944957444bd6bb4fe3b367de8f3d 1d515d18-1b36-47dc-a983-bd6512aed4bd 192.168.0.154 192.168.3.25 38929 53 17 1 96 1548752136 1548752736 ACCEPT OK
-Value 1 indicates the VPC flow log version. Traffic with a size of 96 bytes to NIC 1d515d18-1b36-47dc-a983-bd6512aed4bd during the past 10 minutes (from 16:55:36 to 17:05:36 on January 29, 2019) was allowed. A data packet was transmitted over the UDP protocol from source IP address 192.168.0.154 and port 38929 to destination IP address 192.168.3.25 and port 53.
-Example 2: The following is an example of a flow log record in which no data was recorded during the capture window:
-1 5f67944957444bd6bb4fe3b367de8f3d 1d515d18-1b36-47dc-a983-bd6512aed4bd - - - - - - - 1431280876 1431280934 - NODATA
-Example 3: The following is an example of a flow log record in which data was skipped during the capture window:
-1 5f67944957444bd6bb4fe3b367de8f3d 1d515d18-1b36-47dc-a983-bd6512aed4bd - - - - - - - 1431280876 1431280934 - SKIPDATA
-Table 1 describes the fields of a flow log record.
+Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click
in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose VPC Flow Logs.
- Locate the target VPC flow log and click View Log Record in the Operation column to view information about the flow log record in LTS.Figure 1 Viewing a log record+Figure 2 Flow log record+
The flow log record is in the following format:
+<version> <project-id> <interface-id> <srcaddr> <dstaddr> <srcport> <dstport> <protocol> <packets> <bytes> <start> <end> <action> <log-status>
+Example 1: The following is an example of a flow log record in which data was recorded during the capture window:
+1 5f67944957444bd6bb4fe3b367de8f3d 1d515d18-1b36-47dc-a983-bd6512aed4bd 192.168.0.154 192.168.3.25 38929 53 17 1 96 1548752136 1548752736 ACCEPT OK
+Value 1 indicates the VPC flow log version. Traffic with a size of 96 bytes to NIC 1d515d18-1b36-47dc-a983-bd6512aed4bd during the past 10 minutes (from 16:55:36 to 17:05:36 on January 29, 2019) was allowed. A data packet was transmitted over the UDP protocol from source IP address 192.168.0.154 and port 38929 to destination IP address 192.168.3.25 and port 53.
+Example 2: The following is an example of a flow log record in which no data was recorded during the capture window:
+1 5f67944957444bd6bb4fe3b367de8f3d 1d515d18-1b36-47dc-a983-bd6512aed4bd - - - - - - - 1431280876 1431280934 - NODATA
+Example 3: The following is an example of a flow log record in which data was skipped during the capture window:
+1 5f67944957444bd6bb4fe3b367de8f3d 1d515d18-1b36-47dc-a983-bd6512aed4bd - - - - - - - 1431280876 1431280934 - SKIPDATA
+Table 1 describes the fields of a flow log record.
-Table 1 Log field description Field
+-Table 1 Log field description Field
Description
+Description
Example Value
+Example Value
version
+version
The VPC flow log version.
+The VPC flow log version.
1
+1
project-id
+project-id
The project ID.
+The project ID.
5f67944957444bd6bb4fe3b367de8f3d
+5f67944957444bd6bb4fe3b367de8f3d
interface-id
+interface-id
The ID of the NIC for which the traffic is recorded.
+The ID of the NIC for which the traffic is recorded.
1d515d18-1b36-47dc-a983-bd6512aed4bd
+1d515d18-1b36-47dc-a983-bd6512aed4bd
srcaddr
+srcaddr
The source IP address.
+The source IP address.
192.168.0.154
+192.168.0.154
dstaddr
+dstaddr
The destination IP address.
+The destination IP address.
192.168.3.25
+192.168.3.25
srcport
+srcport
The source port.
+The source port.
38929
+38929
dstport
+dstport
The destination port.
+The destination port.
53
+53
protocol
+protocol
The Internet Assigned Numbers Authority (IANA) protocol number of the traffic. For details, see Assigned Internet Protocol Numbers.
+The Internet Assigned Numbers Authority (IANA) protocol number of the traffic. For details, see Assigned Internet Protocol Numbers.
17
+17
packets
+packets
The number of packets transferred during the capture window.
+The number of packets transferred during the capture window.
1
+1
bytes
+bytes
The number of bytes transferred during the capture window.
+The number of bytes transferred during the capture window.
96
+96
start
+start
The time, in Unix seconds, of the start of the capture window.
+The time, in Unix seconds, of the start of the capture window.
1548752136
+1548752136
end
+end
The time, in Unix seconds, of the end of the capture window.
+The time, in Unix seconds, of the end of the capture window.
1548752736
+1548752736
action
+action
The action associated with the traffic:
-- ACCEPT: The recorded traffic was allowed by the security groups or firewalls.
- REJECT: The recorded traffic was denied by the firewalls.
The action associated with the traffic:
+- ACCEPT: The recorded traffic was allowed by the security groups or firewalls.
- REJECT: The recorded traffic was denied by the security groups or firewalls.
ACCEPT
+ACCEPT
log-status
+log-status
The logging status of the VPC flow log:
-- OK: Data is logging normally to the chosen destinations.
- NODATA: There was no traffic of the Filter setting to or from the NIC during the capture window.
- SKIPDATA: Some flow log records were skipped during the capture window. This may be caused by an internal capacity constraint or an internal error.
Example:
-When Filter is set to Accepted traffic, if there is accepted traffic, the value of log-status is OK. If there is no accepted traffic, the value of log-status is NODATA regardless of whether there is rejected traffic. If some accepted traffic is abnormally skipped, the value of log-status is SKIPDATA.
+The logging status of the VPC flow log:
+- OK: Data is logging normally to the chosen destinations.
- NODATA: There was no traffic of the Filter setting to or from the NIC during the capture window.
- SKIPDATA: Some flow log records were skipped during the capture window. This may be caused by an internal capacity constraint or an internal error.
Example:
+When Filter is set to Accepted traffic, if there is accepted traffic, the value of log-status is OK. If there is no accepted traffic, the value of log-status is NODATA regardless of whether there is rejected traffic. If some accepted traffic is abnormally skipped, the value of log-status is SKIPDATA.
OK
+OK
You can enter a keyword on the log topic details page on the LTS console to search for flow log records.
+You can enter a keyword on the log topic details page on the LTS console to search for flow log records.
diff --git a/docs/vpc/umn/FlowLog_0005.html b/docs/vpc/umn/FlowLog_0005.html index daa80f02..1b1fed65 100644 --- a/docs/vpc/umn/FlowLog_0005.html +++ b/docs/vpc/umn/FlowLog_0005.html @@ -1,12 +1,12 @@Deleting a VPC Flow Log
-Scenarios
Delete a VPC flow log that is not required. Deleting a VPC flow log will not delete the existing flow log records in LTS.
- If a NIC that uses a VPC flow log is deleted, the flow log will be automatically deleted. However, the flow log records are not deleted.
+-Scenarios
Delete a VPC flow log that is not required. Deleting a VPC flow log will not delete the existing flow log records in LTS.
+ If a NIC that uses a VPC flow log is deleted, the flow log will be automatically deleted. However, the flow log records are not deleted.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose VPC Flow Logs.
- Locate the row that contains the VPC flow log to be deleted and click Delete in the Operation column.Figure 1 Deleting a VPC flow log-
- Click Yes in the displayed dialog box.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click
in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose VPC Flow Logs.
- Locate the row that contains the VPC flow log to be deleted and click Delete in the Operation column.Figure 1 Deleting a VPC flow log+
- Click Yes in the displayed dialog box.
diff --git a/docs/vpc/umn/FlowLog_0006.html b/docs/vpc/umn/FlowLog_0006.html index 08df5536..c61b7ada 100644 --- a/docs/vpc/umn/FlowLog_0006.html +++ b/docs/vpc/umn/FlowLog_0006.html @@ -1,9 +1,9 @@Enabling or Disabling VPC Flow Log
-Scenarios
After a VPC flow log is created, the VPC flow log is automatically enabled. If you do not need to record traffic data, you can disable the corresponding VPC flow log. The disabled VPC flow log can be enabled again.
+-Scenarios
After a VPC flow log is created, the VPC flow log is automatically enabled. If you do not need to record traffic data, you can disable the corresponding VPC flow log. The disabled VPC flow log can be enabled again.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose VPC Flow Logs.
- Locate the VPC flow log to be enabled or disabled, and click Enable or Disable in the Operation column.
- Click Yes.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click
in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose VPC Flow Logs.
- Locate the VPC flow log to be enabled or disabled, and choose More > Enable or More > Disable in the Operation column.
- Click Yes.
diff --git a/docs/vpc/umn/SecurityGroup_0003.html b/docs/vpc/umn/SecurityGroup_0003.html index c271560a..71a26ec1 100644 --- a/docs/vpc/umn/SecurityGroup_0003.html +++ b/docs/vpc/umn/SecurityGroup_0003.html @@ -1,43 +1,45 @@Default Security Groups and Security Group Rules
-Your account automatically comes with a default security group. The default security group allows all outbound traffic, denies all inbound traffic, and allows all traffic between cloud resources in the group. Your cloud resources in this security group can communicate with each other already without adding additional rules.
-Figure 1 shows the default security group rules. The following uses access between ECSs as an example.
- -Table 1 describes the default rules for the default security group.
+The system creates a default security group for each account. By default, the default security group rules:+- Allow all outbound packets: Instances in the default security group can send requests to and receive responses from instances in other security groups.
- Deny all inbound packets: Requests from instances in other security groups will be denied by the default security group.
Figure 1 Default security group+
+ - You cannot delete the default security group, but you can modify the rules for the default security group.
- If two ECSs are in the same security group but in different VPCs, the ECSs cannot communicate with each other. To enable communications between the ECSs, use a VPC peering connection to connect the two VPCs.
Table 1 describes the default rules for the default security group.
-Table 1 Default security group rules Direction
+Table 1 Default security group rules Direction
Protocol
+Protocol
Port/Range
+Port/Range
Source/Destination
+Source/Destination
Description
+Description
Outbound
+Outbound
All
+All
All
+All
Destination: 0.0.0.0/0
+Destination: 0.0.0.0/0
Allows all outbound traffic.
+Allows all outbound traffic.
Inbound
+Inbound
All
+All
All
+All
Source: the current security group (for example, sg-xxxxx)
+Source: the current security group (for example, sg-xxxxx)
Allows communications among ECSs within the security group and denies all inbound traffic (incoming data packets).
+Allows communications among ECSs within the security group and denies all inbound traffic (incoming data packets).
Fast-Adding Security Group Rules
-Scenarios
You can add multiple security group rules with different protocols and ports at the same time.
+-Scenarios
You can add multiple security group rules with different protocols and ports at the same time.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, locate the target security group and click Manage Rule in the Operation column to switch to the page for managing inbound and outbound rules.
- On the Inbound Rules tab, click Fast-Add Rule. In the displayed dialog box, select the protocols and ports you wish to add all at once.Figure 1 Fast-Add Inbound Rule- -
- On the Outbound Rules tab, click Fast-Add Rule. In the displayed dialog box, select required protocols and ports to add multiple rules at a time.
-Figure 2 Fast-Add Outbound Rule- -
- Click OK.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click
in the upper left corner and choose Network > Virtual Private Cloud. - In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, locate the target security group and click Manage Rule in the Operation column to switch to the page for managing inbound and outbound rules.
- On the Inbound Rules tab, click Fast-Add Rule. In the displayed dialog box, select the protocols and ports you wish to add all at once.Figure 1 Fast-Add Inbound Rule+ ++
+Table 1 Inbound rule parameter description Parameter
+Description
+Example Value
+Protocols and Ports
+Common protocols and ports are provided for:
+- Remote login and ping
- Web services
- Databases
SSH (22)
+Source
+- xxx.xxx.xxx.xxx/32 (IPv4 address)
- xxx.xxx.xxx.0/24 (IPv4 address range)
- 0.0.0.0/0 (all IPv4 addresses)
- sg-abc (security group)
If the source is a security group, this rule will apply to all instances associated with the selected security group.
+0.0.0.0/0
+Description
+(Optional) Supplementary information about the security group rule.
+The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+-
+ - On the Outbound Rules tab, click Fast-Add Rule. In the displayed dialog box, select required protocols and ports to add multiple rules at a time.Figure 2 Fast-Add Outbound Rule+ ++
+Table 2 Outbound rule parameter description Parameter
+Description
+Example Value
+Protocols and Ports
+Common protocols and ports are provided for:
+- Remote login and ping
- Web services
- Databases
SSH (22)
+Destination
+- xxx.xxx.xxx.xxx/32 (IPv4 address)
- xxx.xxx.xxx.0/24 (IPv4 address range)
- 0.0.0.0/0 (all IPv4 addresses)
- sg-abc (security group)
0.0.0.0/0
+Description
+(Optional) Supplementary information about the security group rule.
+The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+-
+ - Click OK.
diff --git a/docs/vpc/umn/SecurityGroup_0006.html b/docs/vpc/umn/SecurityGroup_0006.html index 551767a6..66e3f308 100644 --- a/docs/vpc/umn/SecurityGroup_0006.html +++ b/docs/vpc/umn/SecurityGroup_0006.html @@ -1,15 +1,15 @@Changing the Security Group of an ECS
-Scenarios
Change the security group associated with an ECS NIC.
+-Scenarios
Change the security group associated with an ECS NIC.
Procedure
- Log in to the management console.
- Click
in the upper left corner and select your region and project. - Under Computing, click Elastic Cloud Server.
- In the ECS list, locate the row that contains the target ECS. Click More in the Operation column and select Manage Network > Change Security Group.
The Change Security Group dialog box is displayed.
-Figure 1 Change Security Group-
- Select the target NIC and security groups as prompted.
You can select multiple security groups. In such a case, the rules of all the selected security groups will be aggregated to apply on the ECS.
-To create a security group, click Create Security Group.
- Using multiple security groups may deteriorate ECS network performance. You are suggested to select no more than five security groups.
+Procedure
- Log in to the management console.
- Click in the upper left corner and select your region and project.
- Under Computing, click Elastic Cloud Server.
- In the ECS list, locate the row that contains the target ECS. Click More in the Operation column and select Manage Network > Change Security Group.
The Change Security Group dialog box is displayed.
+Figure 1 Change Security Group+ - Select the target NIC and security groups as prompted.
You can select multiple security groups. In such a case, the rules of all the selected security groups will be aggregated to apply on the ECS.
+To create a security group, click Create Security Group.
+- Using multiple security groups may deteriorate ECS network performance. You are suggested to select no more than five security groups.
- Click OK.
- Click OK.
diff --git a/docs/vpc/umn/SecurityGroup_0017.html b/docs/vpc/umn/SecurityGroup_0017.html index 714bbb85..77042e6f 100644 --- a/docs/vpc/umn/SecurityGroup_0017.html +++ b/docs/vpc/umn/SecurityGroup_0017.html @@ -1,15 +1,16 @@Adding Instances to and Removing Them from a Security Group
-Scenarios
After a security group is created, you can add instances to the security group to protect the instances. You can also remove them from the security group as required.
-You can add multiple instances to or remove them from a security group.
+-Scenarios
After a security group is created, you can add instances to the security group to protect the instances. You can also remove them from the security group as required.
+You can add multiple instances to or remove them from a security group.
Adding Instances to a Security Group
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, click Manage Instance in the Operation column.
- On the Servers tab, click Add and add one or more servers to the current security group.
- On the Extension NICs tab, click Add and add one or more extension NICs to the current security group.
- Click OK.
-Adding Instances to a Security Group
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, click Manage Instance in the Operation column.
- On the Servers tab, click Add and add one or more servers to the current security group.
- On the Extension NICs tab, click Add and add one or more extension NICs to the current security group.
- Click OK.
Removing Instances from a Security Group
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, click Manage Instance in the Operation column.
- On the Servers tab, locate the target server and click Remove in the Operation column to remove the server from current security group.
- On the Extension NICs tab, locate the target extension NIC and click Remove in the Operation column to remove the NIC from the current security group.
- Click Yes.
Removing multiple instances from a security group
-Select multiple servers and click Remove above the server list to remove the selected servers from the current security group all at once.
-Select multiple extension NICs and click Remove above the extension NIC list to remove the selected extension NICs from the current security group all at once.
++Removing Instances from a Security Group
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, click Manage Instance in the Operation column.
- On the Servers tab, locate the target server and click Remove in the Operation column to remove the server from current security group.
- On the Extension NICs tab, locate the target extension NIC and click Remove in the Operation column to remove the NIC from the current security group.
- Click Yes.
Removing multiple instances from a security group
+- Select multiple servers and click Remove above the server list to remove the selected servers from the current security group all at once.
- Select multiple extension NICs and click Remove above the extension NIC list to remove the selected extension NICs from the current security group all at once.
Follow-Up Operations
You can delete the security groups that you no longer need. Deleting a security group will also delete all security group rules in the security group. For details, see Deleting a Security Group.
diff --git a/docs/vpc/umn/acl_0001.html b/docs/vpc/umn/acl_0001.html index b036a112..7e2a8c39 100644 --- a/docs/vpc/umn/acl_0001.html +++ b/docs/vpc/umn/acl_0001.html @@ -1,59 +1,59 @@ -Firewall Overview
-A firewall is an optional layer of security for your subnets. After you associate one or more subnets with a firewall, you can control traffic in and out of the subnets.
-Figure 1 shows how a firewall works.
- -Similar to security groups, firewalls control access to subnets and add an additional layer of defense to your subnets. Security groups only have the "allow" rules, but firewalls have both "allow" and "deny" rules. You can use firewalls together with security groups to implement comprehensive and fine-grained access control.
-Differences Between Security Groups and Firewalls summarizes the basic differences between security groups and firewalls.
-Firewall Basics
- Your VPC does not come with a firewall, but you can create a firewall and associate it with a VPC subnet if required. By default, each firewall denies all inbound traffic to and outbound traffic from the associated subnet until you add rules.
- You can associate a firewall with multiple subnets. However, a subnet can only be associated with one firewall at a time.
- Each newly created firewall is in the Inactive state until you associate subnets with it.
Firewall Overview
+A firewall is an optional layer of security for your subnets. After you associate one or more subnets with a firewall, you can control traffic in and out of the subnets.
+Figure 1 shows how a firewall works.
+ +Similar to security groups, firewalls control access to subnets and add an additional layer of defense to your subnets. Security groups only have the "allow" rules, but firewalls have both "allow" and "deny" rules. You can use firewalls together with security groups to implement comprehensive and fine-grained access control.
+Differences Between Security Groups and Firewalls summarizes the basic differences between security groups and firewalls.
+-Firewall Basics
- Your VPC does not come with a firewall, but you can create a firewall and associate it with a VPC subnet if required. By default, each firewall denies all inbound traffic to and outbound traffic from the associated subnet until you add rules.
- You can associate a firewall with multiple subnets. However, a subnet can only be associated with one firewall at a time.
- Each newly created firewall is in the Inactive state until you associate subnets with it.
Default Firewall Rules
By default, each firewall has preset rules that allow the following packets:
-- Packets whose source and destination are in the same subnet
- Broadcast packets with the destination 255.255.255.255/32, which is used to configure host startup information.
- Multicast packets with the destination 224.0.0.0/24, which is used by routing protocols.
- Metadata packets with the destination 169.254.169.254/32 and TCP port number 80, which is used to obtain metadata.
- Packets from CIDR blocks that are reserved for public services (for example, packets with the destination 100.125.0.0/16)
- A firewall denies all traffic in and out of a subnet excepting the preceding ones. Table 1 shows the default firewall rules. You cannot modify or delete the default rules.
-
Table 1 Default firewall rules Direction
+Default Firewall Rules
By default, each firewall has preset rules that allow the following packets:
+- Packets whose source and destination are in the same subnet.
- Broadcast packets with the destination 255.255.255.255/32, which is used to configure host startup information.
- Multicast packets with the destination 224.0.0.0/24, which is used by routing protocols.
- Metadata packets with the destination 169.254.169.254/32 and TCP port number 80, which is used to obtain metadata.
- Packets from CIDR blocks that are reserved for public services (for example, packets with the destination 100.125.0.0/16)
- A firewall denies all traffic in and out of a subnet excepting the preceding packets. Table 1 shows the default rules. You cannot modify or delete the default rules.
+
Table 1 Default firewall rules Direction
Priority
+Priority
Action
+Action
Protocol
+Protocol
Source
+Source
Destination
+Destination
Description
+Description
Inbound
+Inbound
*
+*
Deny
+Deny
All
+All
0.0.0.0/0
+0.0.0.0/0
0.0.0.0/0
+0.0.0.0/0
Denies all inbound traffic.
+Denies all inbound traffic.
Outbound
+Outbound
*
+*
Deny
+Deny
All
+All
0.0.0.0/0
+0.0.0.0/0
0.0.0.0/0
+0.0.0.0/0
Denies all outbound traffic.
+Denies all outbound traffic.
Rule Priorities
- Each firewall rule has a priority value where a smaller value corresponds to a higher priority. Any time two rules conflict, the rule with the higher priority is the one that gets applied. The rule whose priority value is an asterisk (*) has the lowest priority.
- If multiple firewall rules conflict, only the rule with the highest priority takes effect. If you need a rule to take effect before or after a specific rule, you can insert that rule before or after the specific rule.
-Rule Priorities
- Each firewall rule has a priority value where a smaller value corresponds to a higher priority. Any time two rules conflict, the rule with the higher priority is the one that gets applied. The rule whose priority value is an asterisk (*) has the lowest priority.
- If multiple firewall rules conflict, only the rule with the highest priority takes effect. If you need a rule to take effect before or after a specific rule, you can insert that rule before or after the specific rule.
Application Scenarios
- If the application layer needs to provide services for users, traffic must be allowed to reach the application layer from all IP addresses. However, you also need to prevent illegal access from malicious users.
Solution: You can add firewall rules to deny access from suspect IP addresses.
- - How can I isolate ports with identified vulnerabilities? For example, how do I isolate port 445 that can be exploited by WannaCry worm?
Solution: You can add firewall rules to deny access traffic from a specific port and protocol, for example, TCP port 445.
- - No defense is required for the east-west traffic between subnets, but access control is required for north-south traffic.
Solution: You can add firewall rules to protect north-south traffic.
- - For frequently accessed applications, a security rule sequence may need to be adjusted to improve performance.
Solution: A firewall allows you to adjust the rule sequence so that frequently used rules are applied before other rules.
+-Application Scenarios
- If the application layer needs to provide services for users, traffic must be allowed to reach the application layer from all IP addresses. However, you also need to prevent illegal access from malicious users.
Solution: You can add firewall rules to deny access from suspect IP addresses.
+ - How can I isolate ports with identified vulnerabilities? For example, how do I isolate port 445 that can be exploited by WannaCry worm?
Solution: You can add firewall rules to deny access traffic from a specific port and protocol, for example, TCP port 445.
+ - No defense is required for the east-west traffic between subnets, but access control is required for north-south traffic.
Solution: You can add firewall rules to protect north-south traffic.
+ - For frequently accessed applications, a security rule sequence may need to be adjusted to improve performance.
Solution: A firewall allows you to adjust the rule sequence so that frequently used rules are applied before other rules.
Configuration Procedure
Figure 2 shows the procedure for configuring a firewall.
- -- Create a firewall by following the steps described in Creating a Firewall.
- Add firewall rules by following the steps described in Adding a Firewall Rule.
- Associate subnets with the firewall by following the steps described in Associating Subnets with a Firewall. After subnets are associated with the firewall, the subnets will be protected by the configured firewall rules.
+Configuration Procedure
Figure 2 shows the procedure for configuring a firewall.
+ +- Create a firewall by following the steps described in Creating a Firewall.
- Add firewall rules by following the steps described in Adding a Firewall Rule.
- Associate subnets with the firewall by following the steps described in Associating Subnets with a Firewall. After subnets are associated with the firewall, the subnets will be protected by the configured firewall rules.
Notes and Constraints
- By default, you can create a maximum of 200 firewalls in your cloud account.
- You can associate a firewall with multiple subnets. However, a subnet can only be associated with one firewall at a time.
- A firewall can contain no more than 20 rules in one direction, or performance will deteriorate.
- For optimal performance, import no more than 40 firewall rules at a time. Existing rules will still be available after new rules are imported. Each rule can be imported only once.
diff --git a/docs/vpc/umn/acl_0002.html b/docs/vpc/umn/acl_0002.html index 24919f0f..b4ffe3f4 100644 --- a/docs/vpc/umn/acl_0002.html +++ b/docs/vpc/umn/acl_0002.html @@ -1,198 +1,198 @@ -Firewall Configuration Examples
-This section provides examples for configuring firewalls.
- -Denying Access from a Specific Port
You might want to block TCP 445 to protect against the WannaCry ransomware attacks. You can add a firewall rule to deny all incoming traffic from TCP port 445.
+Firewall Configuration Examples
+This section provides examples for configuring firewalls.
+ +-Denying Access from a Specific Port
You might want to block TCP 445 to protect against the WannaCry ransomware attacks. You can add a firewall rule to deny all incoming traffic from TCP port 445.
Firewall Configuration
-Table 1 lists the inbound rule required. -Table 1 firewall rules Direction
+Firewall Configuration
+Table 1 lists the inbound rule required. +-Table 1 firewall rules Direction
Action
+Action
Protocol
+Protocol
Source
+Source
Source Port Range
+Source Port Range
Destination
+Destination
Destination Port Range
+Destination Port Range
Description
+Description
Inbound
+Inbound
Deny
+Deny
TCP
+TCP
0.0.0.0/0
+0.0.0.0/0
1-65535
+1-65535
0.0.0.0/0
+0.0.0.0/0
445
+445
Denies inbound traffic from any IP address through TCP port 445.
+Denies inbound traffic from any IP address through TCP port 445.
Inbound
+Inbound
Allow
+Allow
All
+All
0.0.0.0/0
+0.0.0.0/0
1-65535
+1-65535
0.0.0.0/0
+0.0.0.0/0
All
+All
Allows all inbound traffic.
+Allows all inbound traffic.
-- By default, a firewall denies all inbound traffic. You need to allow all inbound traffic if necessary.
- If you want a deny rule to be matched first, insert the deny rule above the allow rule. For details, see Changing the Sequence of a Firewall Rule.
- By default, a firewall denies all inbound traffic. You need to allow all inbound traffic if necessary.
- If you want a deny rule to be matched first, insert the deny rule above the allow rule. For details, see Changing the Sequence of a Firewall Rule.
Allowing Access from Specific Ports and Protocols
In this example, an ECS in a subnet is used as the web server, and you need to allow inbound traffic from HTTP port 80 and HTTPS port 443 and allow all outbound traffic regardless of the port. You need to configure both the firewall rules and security group rules to allow the traffic.
-Firewall Configuration
-Table 2 lists the inbound rule required.
+Allowing Access from Specific Ports and Protocols
In this example, an ECS in a subnet is used as the web server, and you need to allow inbound traffic from HTTP port 80 and HTTPS port 443 and allow all outbound traffic. You need to configure both the firewall rules and security group rules to allow the traffic.
+Firewall Configuration
+Table 2 lists the inbound rule required.
-Table 2 firewall rules Direction
+-Table 2 firewall rules Direction
Action
+Action
Protocol
+Protocol
Source
+Source
Source Port Range
+Source Port Range
Destination
+Destination
Destination Port Range
+Destination Port Range
Description
+Description
Inbound
+Inbound
Allow
+Allow
TCP
+TCP
0.0.0.0/0
+0.0.0.0/0
1-65535
+1-65535
0.0.0.0/0
+0.0.0.0/0
80
+80
Allows inbound HTTP traffic from any IP address to ECSs in the subnet through port 80.
+Allows inbound HTTP traffic from any IP address to ECSs in the subnet through port 80.
Inbound
+Inbound
Allow
+Allow
TCP
+TCP
0.0.0.0/0
+0.0.0.0/0
1-65535
+1-65535
0.0.0.0/0
+0.0.0.0/0
443
+443
Allows inbound HTTPS traffic from any IP address to ECSs in the subnet through port 443.
+Allows inbound HTTPS traffic from any IP address to ECSs in the subnet through port 443.
Outbound
+Outbound
Allow
+Allow
All
+All
0.0.0.0/0
+0.0.0.0/0
All
+All
0.0.0.0/0
+0.0.0.0/0
All
+All
Allows all outbound traffic from the subnet.
+Allows all outbound traffic from the subnet.
Security group configuration
-Table 3 lists the inbound and outbound security group rules required.
+Security group configuration
+Table 3 lists the inbound and outbound security group rules required.
-Table 3 Security group rules Direction
+-Table 3 Security group rules Direction
Protocol/Application
+Protocol/Application
Port
+Port
Source/Destination
+Source/Destination
Description
+Description
Inbound
+Inbound
TCP
+TCP
80
+80
Source: 0.0.0.0/0
+Source: 0.0.0.0/0
Allows inbound HTTP traffic from any IP address to ECSs associated with the security group through port 80.
+Allows inbound HTTP traffic from any IP address to ECSs associated with the security group through port 80.
Inbound
+Inbound
TCP
+TCP
443
+443
Source: 0.0.0.0/0
+Source: 0.0.0.0/0
Allows inbound HTTPS traffic from any IP address to ECSs associated with the security group through port 443.
+Allows inbound HTTPS traffic from any IP address to ECSs associated with the security group through port 443.
Outbound
+Outbound
All
+All
All
+All
Destination: 0.0.0.0/0
+Destination: 0.0.0.0/0
Allows all outbound traffic from the security group.
+Allows all outbound traffic from the security group.
A firewall adds an additional layer of security. Even if the security group rules allow more traffic than that actually required, the firewall rules allow only access from HTTP port 80 and HTTPS port 443 and deny other inbound traffic.
+A firewall adds an additional layer of security. Even if the security group rules allow more traffic than that actually required, the firewall rules allow only access from HTTP port 80 and HTTPS port 443 and deny other inbound traffic.
diff --git a/docs/vpc/umn/eip_0003.html b/docs/vpc/umn/eip_0003.html new file mode 100644 index 00000000..0ffc2de4 --- /dev/null +++ b/docs/vpc/umn/eip_0003.html @@ -0,0 +1,15 @@ + + +Exporting EIP Information
+++Scenarios
The information of all EIPs under your account can be exported in an Excel file to a local directory. The file records the ID, status, type, bandwidth name, and bandwidth size of EIPs.
++Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click
in the upper left corner and choose Network > Elastic IP. - On the displayed page, click
in the upper right corner of the EIP list.The system will automatically export all EIPs in the current region of your account to an Excel file and download the file to a local directory.
+
++ diff --git a/docs/vpc/umn/en-us_image_0000001117669274.png b/docs/vpc/umn/en-us_image_0000001117669274.png index 76633c84..135693af 100644 Binary files a/docs/vpc/umn/en-us_image_0000001117669274.png and b/docs/vpc/umn/en-us_image_0000001117669274.png differ diff --git a/docs/vpc/umn/en-us_image_0000001117669524.png b/docs/vpc/umn/en-us_image_0000001117669524.png index 7a8a4aeb..d6b756a9 100644 Binary files a/docs/vpc/umn/en-us_image_0000001117669524.png and b/docs/vpc/umn/en-us_image_0000001117669524.png differ diff --git a/docs/vpc/umn/en-us_image_0000001163949251.png b/docs/vpc/umn/en-us_image_0000001163949251.png index c3db78d8..fea06056 100644 Binary files a/docs/vpc/umn/en-us_image_0000001163949251.png and b/docs/vpc/umn/en-us_image_0000001163949251.png differ diff --git a/docs/vpc/umn/en-us_image_0000001197426329.png b/docs/vpc/umn/en-us_image_0000001197426329.png index eacf1814..98634416 100644 Binary files a/docs/vpc/umn/en-us_image_0000001197426329.png and b/docs/vpc/umn/en-us_image_0000001197426329.png differ diff --git a/docs/vpc/umn/en-us_image_0000001206933138.png b/docs/vpc/umn/en-us_image_0000001206933138.png deleted file mode 100644 index 452d4e68..00000000 Binary files a/docs/vpc/umn/en-us_image_0000001206933138.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0000001207093220.png b/docs/vpc/umn/en-us_image_0000001207093220.png deleted file mode 100644 index a26a279b..00000000 Binary files a/docs/vpc/umn/en-us_image_0000001207093220.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0000001207253746.png b/docs/vpc/umn/en-us_image_0000001207253746.png deleted file mode 100644 index a26a279b..00000000 Binary files a/docs/vpc/umn/en-us_image_0000001207253746.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0000001207699446.png b/docs/vpc/umn/en-us_image_0000001207699446.png new file mode 100644 index 00000000..330e1426 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001207699446.png differ diff --git a/docs/vpc/umn/en-us_image_0000001207827554.png b/docs/vpc/umn/en-us_image_0000001207827554.png new file mode 100644 index 00000000..b6dac48f Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001207827554.png differ diff --git a/docs/vpc/umn/en-us_image_0000001208260576.png b/docs/vpc/umn/en-us_image_0000001208260576.png new file mode 100644 index 00000000..a4067973 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001208260576.png differ diff --git a/docs/vpc/umn/en-us_image_0000001209321492.png b/docs/vpc/umn/en-us_image_0000001209321492.png new file mode 100644 index 00000000..76b34198 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001209321492.png differ diff --git a/docs/vpc/umn/en-us_image_0000001209442636.png b/docs/vpc/umn/en-us_image_0000001209442636.png new file mode 100644 index 00000000..80dea80e Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001209442636.png differ diff --git a/docs/vpc/umn/en-us_image_0000001209777270.png b/docs/vpc/umn/en-us_image_0000001209777270.png new file mode 100644 index 00000000..e6e9c709 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001209777270.png differ diff --git a/docs/vpc/umn/en-us_image_0000001211006359.png b/docs/vpc/umn/en-us_image_0000001211006359.png index ff5a995a..66686f7e 100644 Binary files a/docs/vpc/umn/en-us_image_0000001211006359.png and b/docs/vpc/umn/en-us_image_0000001211006359.png differ diff --git a/docs/vpc/umn/en-us_image_0000001211445065.png b/docs/vpc/umn/en-us_image_0000001211445065.png index 9d7396e2..a86f5c5d 100644 Binary files a/docs/vpc/umn/en-us_image_0000001211445065.png and b/docs/vpc/umn/en-us_image_0000001211445065.png differ diff --git a/docs/vpc/umn/en-us_image_0000001338933333.png b/docs/vpc/umn/en-us_image_0000001221790501.png similarity index 100% rename from docs/vpc/umn/en-us_image_0000001338933333.png rename to docs/vpc/umn/en-us_image_0000001221790501.png diff --git a/docs/vpc/umn/en-us_image_0185346582.png b/docs/vpc/umn/en-us_image_0000001221842468.png similarity index 100% rename from docs/vpc/umn/en-us_image_0185346582.png rename to docs/vpc/umn/en-us_image_0000001221842468.png diff --git a/docs/vpc/umn/en-us_image_0000001222749226.png b/docs/vpc/umn/en-us_image_0000001222749226.png deleted file mode 100644 index 806c94cd..00000000 Binary files a/docs/vpc/umn/en-us_image_0000001222749226.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0000001222749910.png b/docs/vpc/umn/en-us_image_0000001222749910.png deleted file mode 100644 index 806c94cd..00000000 Binary files a/docs/vpc/umn/en-us_image_0000001222749910.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0000001251773147.png b/docs/vpc/umn/en-us_image_0000001251773147.png deleted file mode 100644 index ef869a01..00000000 Binary files a/docs/vpc/umn/en-us_image_0000001251773147.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0000001254335981.png b/docs/vpc/umn/en-us_image_0000001254335981.png new file mode 100644 index 00000000..06af5104 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001254335981.png differ diff --git a/docs/vpc/umn/en-us_image_0000001286573614.png b/docs/vpc/umn/en-us_image_0000001286573614.png deleted file mode 100644 index eb1ae9b4..00000000 Binary files a/docs/vpc/umn/en-us_image_0000001286573614.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0000001337710801.png b/docs/vpc/umn/en-us_image_0000001337710801.png new file mode 100644 index 00000000..c5bd875e Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001337710801.png differ diff --git a/docs/vpc/umn/en-us_image_0000001454059512.png b/docs/vpc/umn/en-us_image_0000001454059512.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001454059512.png differ diff --git a/docs/vpc/umn/en-us_image_0000001461263993.png b/docs/vpc/umn/en-us_image_0000001461263993.png new file mode 100644 index 00000000..6fe7324b Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001461263993.png differ diff --git a/docs/vpc/umn/en-us_image_0000001462622484.png b/docs/vpc/umn/en-us_image_0000001462622484.png new file mode 100644 index 00000000..abe732df Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001462622484.png differ diff --git a/docs/vpc/umn/en-us_image_0000001464757610.png b/docs/vpc/umn/en-us_image_0000001464757610.png new file mode 100644 index 00000000..b87d186d Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001464757610.png differ diff --git a/docs/vpc/umn/en-us_image_0000001465124712.png b/docs/vpc/umn/en-us_image_0000001465124712.png new file mode 100644 index 00000000..f7e88ddf Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001465124712.png differ diff --git a/docs/vpc/umn/en-us_image_0000001490118666.png b/docs/vpc/umn/en-us_image_0000001490118666.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001490118666.png differ diff --git a/docs/vpc/umn/en-us_image_0000001500905066.png b/docs/vpc/umn/en-us_image_0000001500905066.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001500905066.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503011070.png b/docs/vpc/umn/en-us_image_0000001503011070.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503011070.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503011074.png b/docs/vpc/umn/en-us_image_0000001503011074.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503011074.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503159042.png b/docs/vpc/umn/en-us_image_0000001503159042.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503159042.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503170970.png b/docs/vpc/umn/en-us_image_0000001503170970.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503170970.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503170974.png b/docs/vpc/umn/en-us_image_0000001503170974.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503170974.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503318922.png b/docs/vpc/umn/en-us_image_0000001503318922.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503318922.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503330854.png b/docs/vpc/umn/en-us_image_0000001503330854.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503330854.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503330858.png b/docs/vpc/umn/en-us_image_0000001503330858.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503330858.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503478818.png b/docs/vpc/umn/en-us_image_0000001503478818.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503478818.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503490746.png b/docs/vpc/umn/en-us_image_0000001503490746.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503490746.png differ diff --git a/docs/vpc/umn/en-us_image_0000001503490750.png b/docs/vpc/umn/en-us_image_0000001503490750.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001503490750.png differ diff --git a/docs/vpc/umn/en-us_image_0000001512591549.png b/docs/vpc/umn/en-us_image_0000001512591549.png new file mode 100644 index 00000000..d053a788 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001512591549.png differ diff --git a/docs/vpc/umn/en-us_image_0000001512701025.png b/docs/vpc/umn/en-us_image_0000001512701025.png new file mode 100644 index 00000000..d7660b68 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001512701025.png differ diff --git a/docs/vpc/umn/en-us_image_0000001512876289.png b/docs/vpc/umn/en-us_image_0000001512876289.png new file mode 100644 index 00000000..4fd56502 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001512876289.png differ diff --git a/docs/vpc/umn/en-us_image_0226223279.png b/docs/vpc/umn/en-us_image_0000001515644737.png similarity index 100% rename from docs/vpc/umn/en-us_image_0226223279.png rename to docs/vpc/umn/en-us_image_0000001515644737.png diff --git a/docs/vpc/umn/en-us_image_0000001520717193.png b/docs/vpc/umn/en-us_image_0000001520717193.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001520717193.png differ diff --git a/docs/vpc/umn/en-us_image_0000001521533677.png b/docs/vpc/umn/en-us_image_0000001521533677.png new file mode 100644 index 00000000..dc1fd245 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001521533677.png differ diff --git a/docs/vpc/umn/en-us_image_0000001540725521.png b/docs/vpc/umn/en-us_image_0000001540725521.png new file mode 100644 index 00000000..2f6a7cfb Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001540725521.png differ diff --git a/docs/vpc/umn/en-us_image_0000001540846821.png b/docs/vpc/umn/en-us_image_0000001540846821.png new file mode 100644 index 00000000..5912989f Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001540846821.png differ diff --git a/docs/vpc/umn/en-us_image_0000001553650753.png b/docs/vpc/umn/en-us_image_0000001553650753.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001553650753.png differ diff --git a/docs/vpc/umn/en-us_image_0000001553650757.png b/docs/vpc/umn/en-us_image_0000001553650757.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001553650757.png differ diff --git a/docs/vpc/umn/en-us_image_0000001553770733.png b/docs/vpc/umn/en-us_image_0000001553770733.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001553770733.png differ diff --git a/docs/vpc/umn/en-us_image_0000001553770737.png b/docs/vpc/umn/en-us_image_0000001553770737.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001553770737.png differ diff --git a/docs/vpc/umn/en-us_image_0000001553930581.png b/docs/vpc/umn/en-us_image_0000001553930581.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001553930581.png differ diff --git a/docs/vpc/umn/en-us_image_0000001554010645.png b/docs/vpc/umn/en-us_image_0000001554010645.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001554010645.png differ diff --git a/docs/vpc/umn/en-us_image_0000001554010649.png b/docs/vpc/umn/en-us_image_0000001554010649.png new file mode 100644 index 00000000..d8f9804a Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001554010649.png differ diff --git a/docs/vpc/umn/en-us_image_0000001570070841.png b/docs/vpc/umn/en-us_image_0000001570070841.png new file mode 100644 index 00000000..6fe740f8 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001570070841.png differ diff --git a/docs/vpc/umn/en-us_image_0000001602035305.png b/docs/vpc/umn/en-us_image_0000001602035305.png new file mode 100644 index 00000000..a235a332 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0000001602035305.png differ diff --git a/docs/vpc/umn/en-us_image_0118498947.png b/docs/vpc/umn/en-us_image_0118498947.png deleted file mode 100644 index 863c101f..00000000 Binary files a/docs/vpc/umn/en-us_image_0118498947.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0152238989.png b/docs/vpc/umn/en-us_image_0152238989.png deleted file mode 100644 index 1efaac32..00000000 Binary files a/docs/vpc/umn/en-us_image_0152238989.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0157880395.png b/docs/vpc/umn/en-us_image_0157880395.png new file mode 100644 index 00000000..32461aa1 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0157880395.png differ diff --git a/docs/vpc/umn/en-us_image_0162335561.png b/docs/vpc/umn/en-us_image_0162335561.png deleted file mode 100644 index fb279128..00000000 Binary files a/docs/vpc/umn/en-us_image_0162335561.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0162335565.png b/docs/vpc/umn/en-us_image_0162335565.png deleted file mode 100644 index fc5a60bc..00000000 Binary files a/docs/vpc/umn/en-us_image_0162335565.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0162391187.png b/docs/vpc/umn/en-us_image_0162391187.png deleted file mode 100644 index 7a75567f..00000000 Binary files a/docs/vpc/umn/en-us_image_0162391187.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0167573711.png b/docs/vpc/umn/en-us_image_0167573711.png deleted file mode 100644 index 113f966c..00000000 Binary files a/docs/vpc/umn/en-us_image_0167573711.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0171311823.png b/docs/vpc/umn/en-us_image_0171311823.png new file mode 100644 index 00000000..aa2b2875 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0171311823.png differ diff --git a/docs/vpc/umn/en-us_image_0173155793.png b/docs/vpc/umn/en-us_image_0173155793.png deleted file mode 100644 index 20a33eca..00000000 Binary files a/docs/vpc/umn/en-us_image_0173155793.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0173155804.png b/docs/vpc/umn/en-us_image_0173155804.png deleted file mode 100644 index 64883ba9..00000000 Binary files a/docs/vpc/umn/en-us_image_0173155804.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0173155870.png b/docs/vpc/umn/en-us_image_0173155870.png deleted file mode 100644 index 52100817..00000000 Binary files a/docs/vpc/umn/en-us_image_0173155870.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0191577030.png b/docs/vpc/umn/en-us_image_0191577030.png index 0b7d9f0f..be53b29e 100644 Binary files a/docs/vpc/umn/en-us_image_0191577030.png and b/docs/vpc/umn/en-us_image_0191577030.png differ diff --git a/docs/vpc/umn/en-us_image_0191594527.png b/docs/vpc/umn/en-us_image_0191594527.png index 5ed929ec..b1af5d2d 100644 Binary files a/docs/vpc/umn/en-us_image_0191594527.png and b/docs/vpc/umn/en-us_image_0191594527.png differ diff --git a/docs/vpc/umn/en-us_image_0194358487.png b/docs/vpc/umn/en-us_image_0194358487.png deleted file mode 100644 index 381bf7e0..00000000 Binary files a/docs/vpc/umn/en-us_image_0194358487.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0194358495.png b/docs/vpc/umn/en-us_image_0194358495.png deleted file mode 100644 index 0fbd7a23..00000000 Binary files a/docs/vpc/umn/en-us_image_0194358495.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0194358504.png b/docs/vpc/umn/en-us_image_0194358504.png deleted file mode 100644 index db13c4f3..00000000 Binary files a/docs/vpc/umn/en-us_image_0194358504.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0209273220.png b/docs/vpc/umn/en-us_image_0209273220.png deleted file mode 100644 index 5442e659..00000000 Binary files a/docs/vpc/umn/en-us_image_0209273220.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0209577986.png b/docs/vpc/umn/en-us_image_0209577986.png new file mode 100644 index 00000000..1a3ab09b Binary files /dev/null and b/docs/vpc/umn/en-us_image_0209577986.png differ diff --git a/docs/vpc/umn/en-us_image_0211552164.png b/docs/vpc/umn/en-us_image_0211552164.png index 64d89e27..14fd3fc0 100644 Binary files a/docs/vpc/umn/en-us_image_0211552164.png and b/docs/vpc/umn/en-us_image_0211552164.png differ diff --git a/docs/vpc/umn/en-us_image_0211560998.png b/docs/vpc/umn/en-us_image_0211560998.png index 59323158..413c588c 100644 Binary files a/docs/vpc/umn/en-us_image_0211560998.png and b/docs/vpc/umn/en-us_image_0211560998.png differ diff --git a/docs/vpc/umn/en-us_image_0214585306.png b/docs/vpc/umn/en-us_image_0214585306.png new file mode 100644 index 00000000..e0684dea Binary files /dev/null and b/docs/vpc/umn/en-us_image_0214585306.png differ diff --git a/docs/vpc/umn/en-us_image_0214585307.png b/docs/vpc/umn/en-us_image_0214585307.png new file mode 100644 index 00000000..f5a39cdd Binary files /dev/null and b/docs/vpc/umn/en-us_image_0214585307.png differ diff --git a/docs/vpc/umn/en-us_image_0118498992.png b/docs/vpc/umn/en-us_image_0214585308.png similarity index 100% rename from docs/vpc/umn/en-us_image_0118498992.png rename to docs/vpc/umn/en-us_image_0214585308.png diff --git a/docs/vpc/umn/en-us_image_0118499109.png b/docs/vpc/umn/en-us_image_0214585309.png similarity index 100% rename from docs/vpc/umn/en-us_image_0118499109.png rename to docs/vpc/umn/en-us_image_0214585309.png diff --git a/docs/vpc/umn/en-us_image_0163203842.png b/docs/vpc/umn/en-us_image_0214585341.png similarity index 100% rename from docs/vpc/umn/en-us_image_0163203842.png rename to docs/vpc/umn/en-us_image_0214585341.png diff --git a/docs/vpc/umn/en-us_image_0226222517.png b/docs/vpc/umn/en-us_image_0226222517.png deleted file mode 100644 index 3322328b..00000000 Binary files a/docs/vpc/umn/en-us_image_0226222517.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226788663.png b/docs/vpc/umn/en-us_image_0226788663.png deleted file mode 100644 index a26a279b..00000000 Binary files a/docs/vpc/umn/en-us_image_0226788663.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226820247.png b/docs/vpc/umn/en-us_image_0226820247.png deleted file mode 100644 index 1909444d..00000000 Binary files a/docs/vpc/umn/en-us_image_0226820247.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226820250.png b/docs/vpc/umn/en-us_image_0226820250.png deleted file mode 100644 index 1909444d..00000000 Binary files a/docs/vpc/umn/en-us_image_0226820250.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226820252.png b/docs/vpc/umn/en-us_image_0226820252.png deleted file mode 100644 index 1909444d..00000000 Binary files a/docs/vpc/umn/en-us_image_0226820252.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226820452.png b/docs/vpc/umn/en-us_image_0226820452.png deleted file mode 100644 index 7a75567f..00000000 Binary files a/docs/vpc/umn/en-us_image_0226820452.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226820455.png b/docs/vpc/umn/en-us_image_0226820455.png deleted file mode 100644 index 504d7614..00000000 Binary files a/docs/vpc/umn/en-us_image_0226820455.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226820459.png b/docs/vpc/umn/en-us_image_0226820459.png deleted file mode 100644 index 504d7614..00000000 Binary files a/docs/vpc/umn/en-us_image_0226820459.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226820796.png b/docs/vpc/umn/en-us_image_0226820796.png deleted file mode 100644 index 1909444d..00000000 Binary files a/docs/vpc/umn/en-us_image_0226820796.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226829583.png b/docs/vpc/umn/en-us_image_0226829583.png deleted file mode 100644 index 1909444d..00000000 Binary files a/docs/vpc/umn/en-us_image_0226829583.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226829586.png b/docs/vpc/umn/en-us_image_0226829586.png deleted file mode 100644 index 34aac26a..00000000 Binary files a/docs/vpc/umn/en-us_image_0226829586.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226829587.png b/docs/vpc/umn/en-us_image_0226829587.png deleted file mode 100644 index 1909444d..00000000 Binary files a/docs/vpc/umn/en-us_image_0226829587.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226829589.png b/docs/vpc/umn/en-us_image_0226829589.png deleted file mode 100644 index 1909444d..00000000 Binary files a/docs/vpc/umn/en-us_image_0226829589.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226829591.png b/docs/vpc/umn/en-us_image_0226829591.png deleted file mode 100644 index 1909444d..00000000 Binary files a/docs/vpc/umn/en-us_image_0226829591.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0226829595.png b/docs/vpc/umn/en-us_image_0226829595.png deleted file mode 100644 index 6120e8e9..00000000 Binary files a/docs/vpc/umn/en-us_image_0226829595.png and /dev/null differ diff --git a/docs/vpc/umn/en-us_image_0233469196.png b/docs/vpc/umn/en-us_image_0233469196.png new file mode 100644 index 00000000..a844ced3 Binary files /dev/null and b/docs/vpc/umn/en-us_image_0233469196.png differ diff --git a/docs/vpc/umn/en-us_image_0274115599.png b/docs/vpc/umn/en-us_image_0274115599.png new file mode 100644 index 00000000..2d2d02ff Binary files /dev/null and b/docs/vpc/umn/en-us_image_0274115599.png differ diff --git a/docs/vpc/umn/en-us_image_0284920908.png b/docs/vpc/umn/en-us_image_0284920908.png index 6ada97c4..d46c18d8 100644 Binary files a/docs/vpc/umn/en-us_image_0284920908.png and b/docs/vpc/umn/en-us_image_0284920908.png differ diff --git a/docs/vpc/umn/en-us_image_0284993717.png b/docs/vpc/umn/en-us_image_0284993717.png index f4b88a28..58647558 100644 Binary files a/docs/vpc/umn/en-us_image_0284993717.png and b/docs/vpc/umn/en-us_image_0284993717.png differ diff --git a/docs/vpc/umn/en-us_image_0285048674.png b/docs/vpc/umn/en-us_image_0285048674.png index 2d9597b8..63e5249b 100644 Binary files a/docs/vpc/umn/en-us_image_0285048674.png and b/docs/vpc/umn/en-us_image_0285048674.png differ diff --git a/docs/vpc/umn/en-us_topic_0013748715.html b/docs/vpc/umn/en-us_topic_0013748715.html index 8ef33b03..fd7c6042 100644 --- a/docs/vpc/umn/en-us_topic_0013748715.html +++ b/docs/vpc/umn/en-us_topic_0013748715.html @@ -1,41 +1,59 @@++Parent topic: Elastic IP+Creating a Security Group
-Scenarios
To improve ECS access security, you can create security groups, define security group rules, and add ECSs in a VPC to different security groups. We recommend that you allocate ECSs that have different Internet access policies to different security groups.
+-Scenarios
You can create security groups and add ECSs in a VPC to different security groups to improve ECS access security. We recommend that you allocate ECSs that have different Internet access requirements to different security groups.
+Each ECS must be associated with at least one security group. If you have no security group when creating an ECS, the system provides a default security group.
+You have an option to create a new security group for the ECS. This section describes how to create a security group on the management console.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, click Create Security Group.
- In the Create Security Group area, set the parameters as prompted. Table 1 lists the parameters to be configured.Figure 1 Create Security Group- +
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, click Create Security Group.
- In the Create Security Group area, set the parameters as prompted. Table 1 lists the parameters to be configured.Figure 1 Create Security Group-
Table 1 Parameter description Parameter
+-Table 1 Parameter description Parameter
Description
+Description
Example Value
+Example Value
Name
+Name
The security group name. This parameter is mandatory.
-The security group name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
-NOTE:You can change the security group name after a security group is created. It is recommended that you give each security group a different name.
+The security group name. This parameter is mandatory.
+The security group name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
+NOTE:You can change the security group name after a security group is created. It is recommended that you give each security group a different name.
sg-318b
+sg-318b
Description
+Enterprise Project
Supplementary information about the security group. This parameter is optional.
-The security group description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+When creating a security group, you can add the security group to an enabled enterprise project.
+An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default.
+For details about creating and managing enterprise projects, see the Enterprise Management User Guide.
N/A
+default
+Template
+A template comes with default security group rules, helping you quickly create security groups. The following templates are provided:
+- Custom: This template allows you to create security groups with custom security group rules.
- General-purpose web server: The security group that you create using this template is for general-purpose web servers and includes default rules that allow all inbound ICMP traffic and allow inbound traffic on ports 22, 80, 443, and 3389.
- All ports open: The security group that you create using this template includes default rules that allow inbound traffic on any port. Note that allowing inbound traffic on any port poses security risks.
General-purpose web server
+Description
+Supplementary information about the security group. This parameter is optional.
+The security group description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+N/A
- Click OK.
+- Click OK.
diff --git a/docs/vpc/umn/en-us_topic_0013748726.html b/docs/vpc/umn/en-us_topic_0013748726.html index b52950bf..99392182 100644 --- a/docs/vpc/umn/en-us_topic_0013748726.html +++ b/docs/vpc/umn/en-us_topic_0013748726.html @@ -1,130 +1,123 @@Creating a Subnet for the VPC
-Scenarios
A VPC comes with a default subnet. If the default subnet cannot meet your requirements, you can create one.
-The subnet is configured with DHCP by default. When an ECS in this subnet starts, the ECS automatically obtains an IP address using DHCP.
+-Scenarios
A VPC comes with a default subnet. If the default subnet cannot meet your requirements, you can create one.
+A subnet is configured with DHCP by default. When an ECS in this subnet starts, the ECS automatically obtains an IP address using DHCP.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, click Subnets.
- Click Create Subnet.
The Create Subnet page is displayed.
- - Set the parameters as prompted.Figure 1 Create Subnet- +
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose Virtual Private Cloud > Subnets.
- Click Create Subnet.
The Create Subnet page is displayed.
+ - Set the parameters as prompted.Figure 1 Create Subnet+ -
Table 1 Parameter descriptions Parameter
+-Table 1 Parameter descriptions Parameter
Description
+Description
Example Value
+Example Value
VPC
+VPC
The VPC for which you want to create a subnet.
+The VPC for which you want to create a subnet.
-
+-
Name
+Name
The subnet name.
-The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
+The subnet name.
+The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
Subnet
+Subnet
CIDR Block
+CIDR Block
The CIDR block for the subnet. This value must be within the VPC CIDR block.
+The CIDR block for the subnet. This value must be within the VPC CIDR block.
192.168.0.0/24
+192.168.0.0/24
Associated Route Table
+Associated Route Table
The default route table to which the subnet will be associated. You can change the route table to a custom route table on the Subnets page.
+The default route table to which the subnet will be associated. You can change the route table to a custom route table on the Subnets page.
Default
+Default
Advanced Settings
+Gateway
+Two options are available, Default and Custom. You can set Advanced Settings to Custom to configure advanced subnet parameters.
+The gateway address of the subnet.
-
+192.168.0.1
Gateway
- +DNS Server Address
The gateway address of the subnet.
+By default, two DNS server addresses are configured. You can change them if necessary. A maximum of five DNS server addresses can be configured. Multiple IP addresses must be separated using commas (,).
192.168.0.1
+100.125.x.x
DNS Server Address
+NTP Server Address
By default, two DNS server addresses are configured. You can change them if necessary. A maximum of five DNS server addresses can be configured. Multiple IP addresses must be separated using commas (,).
+The IP address of the NTP server. This parameter is optional.
+You can configure the NTP server IP addresses to be added to the subnet as required. The IP addresses are added in addition to the default NTP server addresses. If this parameter is left empty, no IP address of the NTP server is added.
+A maximum of four IP addresses can be configured. Multiple IP addresses must be separated using commas (,).
100.125.x.x
+192.168.2.1
NTP Server Address
+Tag
The IP address of the NTP server. This parameter is optional.
-You can configure the NTP server IP addresses to be added to the subnet as required. The IP addresses are added in addition to the default NTP server addresses. If this parameter is left empty, no IP address of the NTP server is added.
-A maximum of four IP addresses can be configured. Multiple IP addresses must be separated using commas (,).
+The subnet tag, which consists of a key and value pair. You can add a maximum of 20 tags to each subnet.
+The tag key and value must meet the requirements listed in Table 2.
192.168.2.1
-Tag
-The subnet tag, which consists of a key and value pair. You can add a maximum of 20 tags to each subnet.
-The tag key and value must meet the requirements listed in Table 2.
-- Key: subnet_key1
- Value: subnet-01
- Key: subnet_key1
- Value: subnet-01
Table 2 Subnet tag key and value requirements Parameter
+-Table 2 Subnet tag key and value requirements Parameter
Requirements
+Requirements
Example Value
+Example Value
Key
+Key
- Cannot be left blank.
- Must be unique for each subnet.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
- Cannot be left blank.
- Must be unique for each subnet.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
subnet_key1
+subnet_key1
Value
+Value
- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
subnet-01
+subnet-01
- Click OK.
+- Click OK.
-Precautions
When a subnet is created, there are five reserved IP addresses, which cannot be used. For example, in a subnet with CIDR block 192.168.0.0/24, the following IP addresses are reserved:
-- 192.168.0.0: Network ID. This address is the beginning of the private IP address range and will not be assigned to any instance.
- 192.168.0.1: Gateway address.
- 192.168.0.253: Reserved for the system interface. This IP address is used by the VPC for external communication.
- 192.168.0.254: DHCP service address.
- 192.168.0.255: Network broadcast address.
If you configured the default settings under Advanced Settings during subnet creation, the reserved IP addresses may be different from the default ones, but there will still be five of them. The specific addresses depend on your subnet settings.
+Precautions
When a subnet is created, there are five reserved IP addresses, which cannot be used. For example, in a subnet with CIDR block 192.168.0.0/24, the following IP addresses are reserved:
+- 192.168.0.0: Network ID. This address is the beginning of the private IP address range and will not be assigned to any instance.
- 192.168.0.1: Gateway address.
- 192.168.0.253: Reserved for the system interface. This IP address is used by the VPC for external communication.
- 192.168.0.254: DHCP service address.
- 192.168.0.255: Network broadcast address.
If you configured the default settings under Advanced Settings during subnet creation, the reserved IP addresses may be different from the default ones, but there will still be five of them. The specific addresses depend on your subnet settings.
diff --git a/docs/vpc/umn/en-us_topic_0013748729.html b/docs/vpc/umn/en-us_topic_0013748729.html index 83437321..dbcaf4cd 100644 --- a/docs/vpc/umn/en-us_topic_0013748729.html +++ b/docs/vpc/umn/en-us_topic_0013748729.html @@ -1,21 +1,12 @@-Parent topic: VPC and Subnet+Parent topic: SubnetWhat Is Virtual Private Cloud?
-Overview
The Virtual Private Cloud (VPC) service enables you to provision logically isolated, configurable, and manageable virtual networks for Elastic Cloud Servers (ECSs), improving cloud resource security and simplifying network deployment.
-Within your own VPC, you can create security groups and VPNs, configure IP address ranges, specify bandwidth sizes, manage the networks in the VPC, and make changes to these networks as needed, quickly and securely. You can also define rules for communication between ECSs in the same security group or in different security groups.
+- -Overview
The Virtual Private Cloud (VPC) service enables you to provision logically isolated virtual networks for Elastic Cloud Servers (ECSs), improving cloud resource security and simplifying network deployment. You can configure and manage the virtual networks as required.
+Within your own VPC, you can create security groups and VPNs, configure IP address ranges, specify bandwidth sizes, manage the networks in the VPC, and make changes to these networks as needed, quickly and securely. You can also define rules to control communications between ECSs in the same security group or in different security groups.
Figure 1 VPC components-
-Advantages
- Flexible configuration
You can create VPCs, add subnets, specify IP address ranges, and configure route tables. You can configure the same VPC for ECSs that are in different availability zones (AZs).
- - Secure and reliable
Each VPC is completely logically isolated from other VPCs using the tunneling technology. By default, different VPCs cannot communicate with each other. You can use firewalls to protect subnets and use security groups to protect instances, such as cloud servers, containers, and databases. The firewalls and security groups add additional layers of security to your VPCs, making your network secure.
- - Interconnectivity
By default, instances in a VPC cannot access the Internet. You can leverage Elastic IP (EIP), Elastic Load Balancing (ELB), NAT Gateways, Virtual Private Network (VPN), and Direct Connect to enable access to or from the Internet.
-By default, instances in two VPCs cannot communicate with each other. You can create a VPC peering connection to enable the instances in the two VPCs in the same region to communicate with each other using private IP addresses.
-Multiple connectivity options are provided to meet diverse service requirements for the cloud, enabling you to deploy enterprise applications with ease and lower enterprise IT operation and maintenance (O&M) costs.
- - High-speed access
Dynamic Border Gateway Protocol (BGP) is used to provide access to various carrier networks. For example, up to 21 dynamic BGP connections are established to multiple carriers. The dynamic BGP connections enable real-time failover based on preset routing protocols, ensuring high network stability, low network latency, and smooth access to services on the cloud.
-
Accessing the VPC Service
You can access the VPC service through the management console or using HTTPS-based APIs.- Management console
You can use the console to directly perform operations on VPC resources. To access the VPC service, log in to the management console and select Virtual Private Cloud from the console homepage.
- - API
If you need to integrate the VPC service provided by the cloud system into a third-party system for secondary development, you can use APIs to access the VPC service. For details, see the Virtual Private Cloud API Reference.
+Figure 1 VPC components+diff --git a/docs/vpc/umn/en-us_topic_0013748738.html b/docs/vpc/umn/en-us_topic_0013748738.html index dfc46288..4dc774d8 100644 --- a/docs/vpc/umn/en-us_topic_0013748738.html +++ b/docs/vpc/umn/en-us_topic_0013748738.html @@ -1,110 +1,135 @@Accessing the VPC Service
You can access the VPC service through the management console or using HTTPS-based APIs.- Management console
You can use the console to directly perform operations on VPC resources. To access the VPC service, log in to the management console and select Virtual Private Cloud from the console homepage.
+ - API
If you need to integrate a VPC into a third-party system for secondary development, you can use APIs to access the VPC service. For details, see the Virtual Private Cloud API Reference.
Assigning an EIP and Binding It to an ECS
-Scenarios
You can assign an EIP and bind it to an ECS so that the ECS can access the Internet.
- EIPs for dedicated load balancers:- In the eu-de region, if you choose to assign an EIP when you create a dedicated load balancer on the management console or using APIs, EIPs for dedicated load balancers (5_gray) will be assigned.
- Do not bind EIPs of this type to non-dedicated load balancers.
- Do not add EIPs of the dedicated load balancer type and other types to the same shared bandwidth. Otherwise, the bandwidth limit policy will not take effect.
-Scenarios
You can assign an EIP and bind it to an ECS so that the ECS can access the Internet.
+ Note the following when you use EIPs of the Dedicated Load Balancer (5_gray) type:- In eu-de, EIPs of the Dedicated Load Balancer (5_gray) type cannot be assigned anymore. You can assign EIPs of the BGP (5_bgp) type.
- Existing EIPs of the Dedicated Load Balancer (5_gray) type can be bound to dedicated or shared load balancers.
- The EIP console cannot be used to bind EIPs to or unbind them from dedicated load balancers.
- You can use APIs to bind EIPs to or unbind them from dedicated load balancers. For details, see Binding an EIP and Unbinding an EIP.
- EIPs of this type can be bound to or unbound from shared load balancers using the EIP console or APIs.
- You are advised to bind BGP EIPs to or unbind them from dedicated load balancers.
- Do not add EIPs of the dedicated load balancer type (5_gray) and other types to the same shared bandwidth. Otherwise, the bandwidth limit policy will not take effect.
Assigning an EIP
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Elastic IP.
- On the displayed page, click Assign EIP.
- Set the parameters as prompted.Figure 1 Assign EIP+
Assigning an EIP
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Elastic IP.
- On the displayed page, click Assign EIP.
- Set the parameters as prompted.Figure 1 Assign EIP-
Table 1 Parameter descriptions Parameter
+-Table 1 Parameter descriptions Parameter
Description
+Description
Example Value
+Example Value
Region
+Region
Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For lower network latency and faster access to your resources, select the region nearest you.
+Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For lower network latency and faster access to your resources, select the region nearest you. The region selected for the EIP is its geographical location.
eu-de
+eu-de
EIP Type
+EIP Type
- Dynamic BGP: Dynamic BGP provides automatic failover and chooses the optimal path when a network connection fails.
- Mail BGP: EIPs with port 25, 465, or 587 enabled are used.
The selected EIP type cannot be changed after the EIP is assigned.
+- Dynamic BGP: Dynamic BGP provides automatic failover and chooses the optimal path when a network connection fails.
- Mail BGP: EIPs with port 25, 465, or 587 enabled are used for email services.
The selected EIP type cannot be changed after the EIP is assigned.
Dynamic BGP
+Dynamic BGP
Bandwidth
+Billed By
The bandwidth size in Mbit/s.
+Two options are available:
+- Dedicated: The bandwidth can be used by only one EIP.
- Shared: The bandwidth can be shared by multiple EIPs.
100
+Dedicated
Bandwidth Name
+Bandwidth
The name of the bandwidth.
+The bandwidth size in Mbit/s.
bandwidth
+100
Tag
+EIP Name
The EIP tags. Each tag contains a key and value pair.
-The tag key and value must meet the requirements listed in Table 2.
+The EIP name.
- Key: Ipv4_key1
- Value: 192.168.12.10
eip-test
Quantity
+Enterprise Project
The number of EIPs you want to purchase.
+The enterprise project that the EIP belongs to.
+An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default.
+For details about creating and managing enterprise projects, see the Enterprise Management User Guide.
1
+default
+Bandwidth Name
+The name of the bandwidth.
+bandwidth
+Tag
+The EIP tags. Each tag contains a key and value pair.
+The tag key and value must meet the requirements listed in Table 2.
+- Key: Ipv4_key1
- Value: 3005eip
Quantity
+The number of EIPs you want to assign.
+1
Table 2 EIP tag requirements Parameter
+-Table 2 EIP tag requirements Parameter
Requirement
+Requirement
Example Value
+Example Value
Key
+Key
- Cannot be left blank.
- Must be unique for each EIP.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
- Cannot be left blank.
- Must be unique for each EIP.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
Ipv4_key1
+Ipv4_key1
Value
+Value
- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
192.168.12.10
+3005eip
- Click Create Now.
- Click Submit.
+- Click Create Now.
- Click Submit.
-Binding an EIP
- On the EIPs page, locate the row that contains the target EIP, and click Bind.
- Select the instance to which you want to bind the EIP.Figure 2 Bind EIP-
- Click OK.
An IPv6 client on the Internet can access the ECS that has an EIP bound in a VPC. For details about the implementation and constraints, see How Does an IPv6 Client on the Internet Access the ECS That Has an EIP Bound in a VPC?
+-Binding an EIP
- On the EIPs page, locate the row that contains the target EIP, and click Bind.
- Select the instance that you want to bind the EIP to.Figure 2 Bind EIP+
- Click OK.
An IPv6 client on the Internet can access the ECS that has an EIP bound in a VPC. For details, see How Does an IPv6 Client on the Internet Access the ECS That Has an EIP Bound in a VPC?
Follow-Up Procedure
After an ECS with an EIP bound is created, the system generates a domain name in the format of ecs-xx-xx-xx-xx.compute.xxx.com for the EIP by default. xx-xx-xx-xx indicates the EIP, and xxx indicates the domain name of the cloud service provider. You can use the domain name to access the ECS.
-You can use any of the following commands to obtain the domain name of an EIP:- ping -a EIP
- nslookup [-qt=ptr] EIP
- dig -x EIP
Follow-Up Procedure
After an ECS with an EIP bound is created, the system generates a domain name in the format of ecs-xx-xx-xx-xx.compute.xxx.com for the EIP by default. xx-xx-xx-xx indicates the EIP, and xxx indicates the domain name of the cloud service provider. You can use the domain name to access the ECS.
+You can use any of the following commands to obtain the domain name of an EIP:- ping -a EIP
- nslookup [-qt=ptr] EIP
- dig -x EIP
diff --git a/docs/vpc/umn/en-us_topic_0013748743.html b/docs/vpc/umn/en-us_topic_0013748743.html index 5b7eb89c..c31e7e26 100644 --- a/docs/vpc/umn/en-us_topic_0013748743.html +++ b/docs/vpc/umn/en-us_topic_0013748743.html @@ -1,17 +1,17 @@-Parent topic: EIP+Parent topic: Elastic IPModifying an EIP Bandwidth
-Scenarios
Modify the EIP bandwidth name or size.
- This section describes how to modify the dedicated bandwidth or shared bandwidth of an EIP. For details about how to modify a shared bandwidth, see Modifying a Shared Bandwidth.
+-Scenarios
Modify the EIP bandwidth name or size.
+ This section describes how to modify the dedicated bandwidth or shared bandwidth of an EIP. For details about how to modify a shared bandwidth, see Modifying a Shared Bandwidth.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Elastic IP.
- Locate the row that contains the target EIP in the EIP list, click More in the Operation column, and select Modify Bandwidth.
- Modify the bandwidth parameters as prompted. -
- Click Next.
- Click Submit.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Elastic IP.
- Locate the row that contains the target EIP in the EIP list, click More in the Operation column, and select Modify Bandwidth.
- Modify the bandwidth parameters as prompted. +
- Click Next.
- Click Submit.
diff --git a/docs/vpc/umn/en-us_topic_0013935842.html b/docs/vpc/umn/en-us_topic_0013935842.html index 2395296f..bccec02f 100644 --- a/docs/vpc/umn/en-us_topic_0013935842.html +++ b/docs/vpc/umn/en-us_topic_0013935842.html @@ -1,195 +1,226 @@-Parent topic: EIP+Parent topic: Elastic IPCreating a VPC
-Scenarios
A VPC provides an isolated virtual network for ECSs. You can configure and manage the network as required.
-You can create a VPC by following the procedure provided in this section. Then, create subnets, security groups, and assign EIPs by following the procedure provided in subsequent sections based on your actual network requirements.
+-Scenarios
A VPC provides an isolated virtual network for ECSs. You can configure and manage the network as required.
+You can create a VPC by following the procedure provided in this section. Then, create subnets, security groups, and assign EIPs by following the procedure provided in subsequent sections based on your actual network requirements.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- Click Create VPC.
- On the Create VPC page, set parameters as prompted.
A default subnet will be created together with a VPC and you can also click Add Subnet to create more subnets for the VPC.
+Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click
in the upper left corner and choose Network > Virtual Private Cloud. - Click Create VPC.
- On the Create VPC page, set parameters as prompted.
A default subnet will be created together with a VPC and you can also click Add Subnet to create more subnets for the VPC.
-Table 1 VPC parameter descriptions Category
+-Table 1 VPC parameter descriptions Category
Parameter
+Parameter
Description
+Description
Example Value
+Example Value
Basic Information
+Basic Information
Region
+Region
Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For lower network latency and faster access to your resources, select the region nearest you.
+Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For lower network latency and faster access to your resources, select the region nearest you.
eu-de
+eu-de
Basic Information
+Basic Information
Name
+Name
The VPC name.
-The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
+The VPC name.
+The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
VPC-001
+VPC-001
Basic Information
+Basic Information
CIDR Block
+CIDR Block
The CIDR block of the VPC. The CIDR block of a subnet can be the same as the CIDR block for the VPC (for a single subnet in the VPC) or a subset of the CIDR block for the VPC (for multiple subnets in the VPC).
-The following CIDR blocks are supported:
-10.0.0.0/8-24
-172.16.0.0/12-24
-192.168.0.0/16-24
+The CIDR block of the VPC. The CIDR block of a subnet can be the same as the CIDR block for the VPC (for a single subnet in the VPC) or a subset of the CIDR block for the VPC (for multiple subnets in the VPC).
+The following CIDR blocks are supported:
+10.0.0.0/8-24
+172.16.0.0/12-24
+192.168.0.0/16-24
192.168.0.0/16
+192.168.0.0/16
Default Subnet
+Basic Information
Name
+Enterprise Project
The subnet name.
-The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
+The enterprise project to which the VPC belongs.
+An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default.
+For details about creating and managing enterprise projects, see the Enterprise Management User Guide.
Subnet
+default
Default Subnet
+Basic Information/Advanced Settings
CIDR Block
+Tag
The CIDR block for the subnet. This value must be within the VPC CIDR block.
+The VPC tag, which consists of a key and value pair. You can add a maximum of 20 tags to each VPC.
+The tag key and value must meet the requirements listed in Table 2.
192.168.0.0/24
+- Key: vpc_key1
- Value: vpc-01
Default Subnet
+Basic Information/Advanced Settings
Associated Route Table
+Description
The default route table to which the subnet will be associated. You can change the route table to a custom route table on the Subnets page.
+Supplementary information about the VPC. This parameter is optional.
+The VPC description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
Default
+N/A
Default Subnet/Advanced Settings
+Default Subnet
Gateway
+Name
The gateway address of the subnet.
+The subnet name.
+The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
192.168.0.1
+Subnet
Default Subnet/Advanced Settings
+Default Subnet
DNS Server Address
+CIDR Block
By default, two DNS server addresses are configured. You can change them as required. A maximum of five DNS server addresses can be configured. Multiple IP addresses must be separated using commas (,).
+The CIDR block for the subnet. This value must be within the VPC CIDR block.
100.125.x.x
+192.168.0.0/24
Default Subnet/Advanced Settings
+Default Subnet
NTP Server Address
+Associated Route Table
The IP address of the NTP server. This parameter is optional.
-You can configure the NTP server IP addresses to be added to the subnet as required. The IP addresses are added in addition to the default NTP server addresses. If this parameter is left empty, no IP address of the NTP server is added.
-A maximum of four IP addresses can be configured. Multiple IP addresses must be separated using commas (,).
+The default route table to which the subnet will be associated. You can change the route table to a custom route table on the Subnets page.
192.168.2.1
+Default
Default Subnet/Advanced Settings
+Default Subnet/Advanced Settings
Tag
+Gateway
The subnet tag, which consists of a key and value pair. You can add a maximum of 20 tags to each subnet.
-The tag key and value must meet the requirements listed in Table 3.
+The gateway address of the subnet.
- Key: subnet_key1
- Value: subnet-01
192.168.0.1
Default Subnet/Advanced Settings
+Default Subnet/Advanced Settings
Description
+DNS Server Address
Supplementary information about the subnet. This parameter is optional.
-The subnet description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+By default, two DNS server addresses are configured. You can change them as required. A maximum of five DNS server addresses can be configured. Multiple IP addresses must be separated using commas (,).
N/A
+100.125.x.x
+Default Subnet/Advanced Settings
+NTP Server Address
+The IP address of the NTP server. This parameter is optional.
+You can configure the NTP server IP addresses to be added to the subnet as required. The IP addresses are added in addition to the default NTP server addresses. If this parameter is left empty, no IP address of the NTP server is added.
+A maximum of four IP addresses can be configured. Multiple IP addresses must be separated using commas (,).
+192.168.2.1
+Default Subnet/Advanced Settings
+Tag
+The subnet tag, which consists of a key and value pair. You can add a maximum of 20 tags to each subnet.
+The tag key and value must meet the requirements listed in Table 3.
+- Key: subnet_key1
- Value: subnet-01
Default Subnet/Advanced Settings
+Description
+Supplementary information about the subnet. This parameter is optional.
+The subnet description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+N/A
Table 2 VPC tag key and value requirements Parameter
+-Table 2 VPC tag key and value requirements Parameter
Requirements
+Requirements
Example Value
+Example Value
Key
+Key
- Cannot be left blank.
- Must be unique for the same VPC and can be the same for different VPCs.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
- Cannot be left blank.
- Must be unique for the same VPC and can be the same for different VPCs.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
vpc_key1
+vpc_key1
Value
+Value
- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
vpc-01
+vpc-01
Table 3 Subnet tag key and value requirements Parameter
+-Table 3 Subnet tag key and value requirements Parameter
Requirements
+Requirements
Example Value
+Example Value
Key
+Key
- Cannot be left blank.
- Must be unique for each subnet.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
- Cannot be left blank.
- Must be unique for each subnet.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
subnet_key1
+subnet_key1
Value
+Value
- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
subnet-01
+subnet-01
- Click Create Now.
+- Click Create Now.
diff --git a/docs/vpc/umn/en-us_topic_0017816228.html b/docs/vpc/umn/en-us_topic_0017816228.html index a2538b09..5bdc5a64 100644 --- a/docs/vpc/umn/en-us_topic_0017816228.html +++ b/docs/vpc/umn/en-us_topic_0017816228.html @@ -1,7 +1,220 @@-Parent topic: VPC and Subnet+Parent topic: VPCConfiguring a VPC for ECSs That Access the Internet Using EIPs
- ++- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Virtual Private Cloud.
- Click Create VPC.
- On the Create VPC page, set parameters as prompted.
A default subnet will be created together with a VPC and you can also click Add Subnet to create more subnets for the VPC.
+ ++ +
+Table 1 VPC parameter descriptions Category
+Parameter
+Description
+Example Value
+Basic Information
+Region
+Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For lower network latency and faster access to your resources, select the region nearest you.
+eu-de
+Basic Information
+Name
+The VPC name.
+The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
+VPC-001
+Basic Information
+CIDR Block
+The CIDR block of the VPC. The CIDR block of a subnet can be the same as the CIDR block for the VPC (for a single subnet in the VPC) or a subset of the CIDR block for the VPC (for multiple subnets in the VPC).
+The following CIDR blocks are supported:
+10.0.0.0/8-24
+172.16.0.0/12-24
+192.168.0.0/16-24
+192.168.0.0/16
+Basic Information
+Enterprise Project
+The enterprise project to which the VPC belongs.
+An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default.
+For details about creating and managing enterprise projects, see the Enterprise Management User Guide.
+default
+Basic Information/Advanced Settings
+Tag
+The VPC tag, which consists of a key and value pair. You can add a maximum of 20 tags to each VPC.
+The tag key and value must meet the requirements listed in Table 2.
+- Key: vpc_key1
- Value: vpc-01
Basic Information/Advanced Settings
+Description
+Supplementary information about the VPC. This parameter is optional.
+The VPC description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+N/A
+Default Subnet
+Name
+The subnet name.
+The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.
+Subnet
+Default Subnet
+CIDR Block
+The CIDR block for the subnet. This value must be within the VPC CIDR block.
+192.168.0.0/24
+Default Subnet
+Associated Route Table
+The default route table to which the subnet will be associated. You can change the route table to a custom route table on the Subnets page.
+Default
+Default Subnet/Advanced Settings
+Gateway
+The gateway address of the subnet.
+192.168.0.1
+Default Subnet/Advanced Settings
+DNS Server Address
+By default, two DNS server addresses are configured. You can change them as required. A maximum of five DNS server addresses can be configured. Multiple IP addresses must be separated using commas (,).
+100.125.x.x
+Default Subnet/Advanced Settings
+NTP Server Address
+The IP address of the NTP server. This parameter is optional.
+You can configure the NTP server IP addresses to be added to the subnet as required. The IP addresses are added in addition to the default NTP server addresses. If this parameter is left empty, no IP address of the NTP server is added.
+A maximum of four IP addresses can be configured. Multiple IP addresses must be separated using commas (,).
+192.168.2.1
+Default Subnet/Advanced Settings
+Tag
+The subnet tag, which consists of a key and value pair. You can add a maximum of 20 tags to each subnet.
+The tag key and value must meet the requirements listed in Table 3.
+- Key: subnet_key1
- Value: subnet-01
Default Subnet/Advanced Settings
+Description
+Supplementary information about the subnet. This parameter is optional.
+The subnet description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+N/A
++ +
+Table 2 VPC tag key and value requirements Parameter
+Requirements
+Example Value
+Key
+- Cannot be left blank.
- Must be unique for the same VPC and can be the same for different VPCs.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
vpc_key1
+Value
+- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
vpc-01
++
+Table 3 Subnet tag key and value requirements Parameter
+Requirements
+Example Value
+Key
+- Cannot be left blank.
- Must be unique for each subnet.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
subnet_key1
+Value
+- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
subnet-01
+ - Click Create Now.
- Overview
diff --git a/docs/vpc/umn/en-us_topic_0030969424.html b/docs/vpc/umn/en-us_topic_0030969424.html index 67ede5e2..c0374f3e 100644 --- a/docs/vpc/umn/en-us_topic_0030969424.html +++ b/docs/vpc/umn/en-us_topic_0030969424.html @@ -1,10 +1,10 @@Subnet
-A subnet is a unique CIDR block with a range of IP addresses in a VPC. All resources in a VPC must be deployed on subnets.
-- By default, ECSs in all subnets of the same VPC can communicate with one another, but ECSs in different VPCs cannot.
You can create VPC peering connections to enable ECSs in different VPCs but in the same region to communicate with one another. For details, see VPC Peering Connection Creation Procedure.
- - After a subnet is created, its CIDR block cannot be modified.
The subnets used to deploy your resources must reside within your VPC, and the subnet masks used to define them can be between the netmask of its VPC CIDR block and /29 netmask.
-- 10.0.0.0 – 10.255.255.255
- 172.16.0.0 – 172.31.255.255
- 192.168.0.0 – 192.168.255.255
A subnet is a unique CIDR block with a range of IP addresses in a VPC. All resources in a VPC must be deployed on subnets.
+- By default, ECSs in all subnets of the same VPC can communicate with one another, but ECSs in different VPCs cannot.
You can create VPC peering connections to enable ECSs in different VPCs but in the same region to communicate with one another. For details, see VPC Peering Connection Overview.
+ - After a subnet is created, its CIDR block cannot be modified.
The subnets used to deploy your resources must reside within your VPC, and the subnet masks used to define them can be between the netmask of its VPC CIDR block and /29 netmask.
+- 10.0.0.0 – 10.255.255.255
- 172.16.0.0 – 172.31.255.255
- 192.168.0.0 – 192.168.255.255
diff --git a/docs/vpc/umn/en-us_topic_0030969460.html b/docs/vpc/umn/en-us_topic_0030969460.html index 9a4d34a4..2131450f 100644 --- a/docs/vpc/umn/en-us_topic_0030969460.html +++ b/docs/vpc/umn/en-us_topic_0030969460.html @@ -4,28 +4,10 @@diff --git a/docs/vpc/umn/en-us_topic_0030969462.html b/docs/vpc/umn/en-us_topic_0030969462.html index 324d76eb..923efeb2 100644 --- a/docs/vpc/umn/en-us_topic_0030969462.html +++ b/docs/vpc/umn/en-us_topic_0030969462.html @@ -1,26 +1,26 @@-
-
- Creating a VPC
+ - VPC
- - Modifying a VPC
-
- - Creating a Subnet for the VPC
-
- - Modifying a Subnet
-
- - Deleting a Subnet
-
- - Deleting a VPC
-
- - Managing VPC Tags
-
- - Managing Subnet Tags
-
- - Exporting VPC List
+ - Subnet
-Parent topic: Operation Guide (New Console Edition)-Modifying a VPC
-Scenarios
Change the VPC name and CIDR block.
-If the VPC CIDR block conflicts with the CIDR block of a VPN created in the VPC, you can modify its CIDR block.
+-Scenarios
Change the VPC name and CIDR block.
+If the VPC CIDR block conflicts with the CIDR block of a VPN created in the VPC, you can modify its CIDR block.
Notes and Constraints
- When modifying the VPC CIDR block:
- The VPC CIDR block to be modified must be in the supported CIDR blocks: 10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, and 192.168.0.0 – 192.168.255.255
- If the VPC has subnets, the VPC CIDR block to be modified must contain all subnet CIDR blocks.
Notes and Constraints
- When modifying the VPC CIDR block:
- The VPC CIDR block to be modified must be in the supported CIDR blocks: 10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, and 192.168.0.0 – 192.168.255.255
- If the VPC has subnets, the VPC CIDR block to be modified must contain all subnet CIDR blocks.
When modifying the VPC CIDR block:-- The VPC CIDR block to be modified must be in the supported CIDR blocks: 10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, and 192.168.0.0 – 192.168.255.255
- If the VPC has subnets, the VPC CIDR block to be modified must contain all subnet CIDR blocks.
When modifying the VPC CIDR block:- The VPC CIDR block to be modified must be in the supported CIDR blocks: 10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, and 192.168.0.0 – 192.168.255.255
- If the VPC has subnets, the VPC CIDR block to be modified must contain all subnet CIDR blocks.
Procedure
Modifying the VPC CIDR Block
-- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, click Virtual Private Cloud.
- On the Virtual Private Cloud page, locate the row that contains the VPC to be modified and click Edit CIDR Block in the Operation column.
- Set a new CIDR block.Figure 1 Modify CIDR Block-
- Click OK.
Modifying a VPC
-- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, click Virtual Private Cloud.
- Modify the basic information about a VPC using either of the following methods :
- In the VPC list, click
on the right of the VPC name to change the VPC name. - In the VPC list, click the VPC name.
On the VPC details page, click
+
next to the VPC name or description to change the VPC name or description.Procedure
Modifying the VPC CIDR Block
+- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Virtual Private Cloud.
- On the Virtual Private Cloud page, locate the row that contains the VPC to be modified and click Edit CIDR Block in the Operation column.
- Set a new CIDR block.Figure 1 Modify CIDR Block+
- Click OK.
Modifying a VPC
+- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Virtual Private Cloud.
- Modify the basic information about a VPC using either of the following methods:
- In the VPC list, click
diff --git a/docs/vpc/umn/en-us_topic_0030969470.html b/docs/vpc/umn/en-us_topic_0030969470.html index cbf58a47..86aee1b4 100644 --- a/docs/vpc/umn/en-us_topic_0030969470.html +++ b/docs/vpc/umn/en-us_topic_0030969470.html @@ -1,99 +1,115 @@-Parent topic: VPC and Subnet+Parent topic: VPCAdding a Security Group Rule
-Scenarios
A security group is a collection of access control rules for cloud resources, such as cloud servers, containers, and databases, to control inbound and outbound traffic. Cloud resources associated with the same security group have the same security requirements and are mutually trusted within a VPC.
-If the rules of the security group associated with your instance cannot meet your requirements, for example, you need to allow inbound traffic on a specified TCP port, you can add an inbound rule.
-- Inbound rules control incoming traffic to cloud resources in the security group.
- Outbound rules control outgoing traffic from cloud resources in the security group.
For details about the default security group rules, see Default Security Groups and Security Group Rules. For details about security group rule configuration examples, see Security Group Configuration Examples.
+-Scenarios
A security group is a collection of access control rules for cloud resources, such as cloud servers, containers, and databases, to control inbound and outbound traffic. Cloud resources associated with the same security group have the same security requirements and are mutually trusted within a VPC.
+If the rules of the security group associated with your instance cannot meet your requirements, for example, you need to allow inbound traffic on a specified TCP port, you can add an inbound rule.
+- Inbound rules control incoming traffic to cloud resources in the security group.
- Outbound rules control outgoing traffic from cloud resources in the security group.
For details about the default security group rules, see Default Security Groups and Security Group Rules. For details about security group rule configuration examples, see Security Group Configuration Examples.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, locate the target security group and click Manage Rule in the Operation column to switch to the page for managing inbound and outbound rules.
- On the Inbound Rules tab, click Add Rule. In the displayed dialog box, set required parameters to add an inbound rule.
You can click + to add more inbound rules.
-Figure 1 Add Inbound Rule+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner and choose Network > Virtual Private Cloud.
- In the navigation pane on the left, choose Access Control > Security Groups.
- On the Security Groups page, locate the target security group and click Manage Rule in the Operation column to switch to the page for managing inbound and outbound rules.
- On the Inbound Rules tab, click Add Rule. In the displayed dialog box, set required parameters to add an inbound rule.
You can click + to add more inbound rules.
+Figure 1 Add Inbound Rule-Table 1 Inbound rule parameter description Parameter
+-Table 1 Inbound rule parameter description Parameter
Description
+Description
Example Value
+Example Value
Protocol & Port
- +Protocol & Port
+Protocol: The network protocol. Currently, the value can be All, TCP, UDP, ICMP, GRE, or others.
+Protocol: The network protocol. Currently, the value can be All, TCP, UDP, ICMP, GRE, or others.
TCP
+TCP
Port: The port or port range over which the traffic can reach your ECS. The value ranges from 1 to 65535.
+Port: The port or port range over which the traffic can reach your ECS. The value ranges from 1 to 65535.
22, or 22-30
+22, or 22-30
Source
+Type
The source of the security group rule. The value can be a single IP address or a security group to allow access from the IP address or instances in the security group. For example:- xxx.xxx.xxx.xxx/32 (IPv4 address)
- xxx.xxx.xxx.0/24 (IPv4 address range)
- 0.0.0.0/0 (all IPv4 addresses)
- sg-abc (security group)
IPv4
+IPv4
+Source
+- IP address:
- Single IP address: 192.168.10.10/32
- All IP addresses: 0.0.0.0/0
- IP address range: 192.168.1.0/24
- Security group: sg-A
If the source is a security group, this rule will apply to all instances associated with the selected security group.
+If the source is a security group, this rule will apply to all instances associated with the selected security group.
0.0.0.0/0
+0.0.0.0/0
Description
+Description
Supplementary information about the security group rule. This parameter is optional.
-The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+Supplementary information about the security group rule. This parameter is optional.
+The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
N/A
+N/A
- On the Outbound Rules tab, click Add Rule. In the displayed dialog box, set required parameters to add an outbound rule.
You can click + to add more outbound rules.
-Figure 2 Add Outbound Rule+
- On the Outbound Rules tab, click Add Rule. In the displayed dialog box, set required parameters to add an outbound rule.
You can click + to add more outbound rules.
+Figure 2 Add Outbound Rule-Table 2 Outbound rule parameter description Parameter
+Table 2 Outbound rule parameter description Parameter
Description
+Description
Example Value
+Example Value
Protocol & Port
- +Protocol & Port
+Protocol: The network protocol. Currently, the value can be All, TCP, UDP, ICMP, GRE, or others.
+Protocol: The network protocol. Currently, the value can be All, TCP, UDP, ICMP, GRE, or others.
TCP
+TCP
Port: The port or port range over which the traffic can leave your ECS. The value ranges from 1 to 65535.
+Port: The port or port range over which the traffic can leave your ECS. The value ranges from 1 to 65535.
22, or 22-30
+22, or 22-30
Destination
+Type
The destination of the security group rule. The value can be a single IP address or a security group to allow access to the IP address or instances in the security group. For example:+- xxx.xxx.xxx.xxx/32 (IPv4 address)
- xxx.xxx.xxx.0/24 (IPv4 address range)
- 0.0.0.0/0 (all IPv4 addresses)
- sg-abc (security group)
IPv4
0.0.0.0/0
+IPv4
Description
+Destination
Supplementary information about the security group rule. This parameter is optional.
-The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
+Destination of the security group rule. The value can be an IP address or a security group to allow access to IP addresses or instances in the security group. For example:
+- IP address:
- By default, ECSs in all subnets of the same VPC can communicate with one another, but ECSs in different VPCs cannot.
- Management console
- If the application layer needs to provide services for users, traffic must be allowed to reach the application layer from all IP addresses. However, you also need to prevent illegal access from malicious users.
