vpruthi/doc-exports
1
0
Fork 0
forked from docs/doc-exports
Code Pull Requests Activity

VPC UMN 0930 version

Browse Source 
Reviewed-by: Kucerak, Kristian <kristian.kucerak@t-systems.com>
Co-authored-by: Qin Ying, Fan <fanqinying@huawei.com>
Co-committed-by: Qin Ying, Fan <fanqinying@huawei.com>
This commit is contained in:
Qin Ying, Fan 2022-10-06 14:10:38 +00:00 committed by zuul
parent e5f027727c
commit 62b5636b2d
394 changed files with 15812 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2722
docs/vpc/umn/ALL_META.TXT.json Normal file
View File

File diff suppressed because it is too large Load Diff

2450
docs/vpc/umn/CLASS.TXT.json Normal file
View File

File diff suppressed because it is too large Load Diff

23
docs/vpc/umn/FlowLog_0001.html Normal file
View File

@ -0,0 +1,23 @@
<a name="FlowLog_0001"></a><a name="FlowLog_0001"></a>
<h1 class="topictitle1">VPC Flow Log </h1>
<div id="body8662426"></div>
<div>
<ul class="ullinks">
<li class="ulchildlink"><strong><a href="FlowLog_0002.html">VPC Flow Log Overview</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="FlowLog_0003.html">Creating a VPC Flow Log</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="FlowLog_0004.html">Viewing a VPC Flow Log</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="FlowLog_0006.html">Enabling or Disabling VPC Flow Log</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="FlowLog_0005.html">Deleting a VPC Flow Log</a></strong><br>
</li>
</ul>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="vpc_newui_0000.html">Operation Guide (New Console Edition)</a></div>
</div>
</div>

16
docs/vpc/umn/FlowLog_0002.html Normal file
View File

@ -0,0 +1,16 @@
<a name="FlowLog_0002"></a><a name="FlowLog_0002"></a>
<h1 class="topictitle1">VPC Flow Log Overview</h1>
<div id="body8662426"><p id="FlowLog_0002__en-us_topic_0151014680_p8060118">A VPC flow log records information about the traffic going to and from a VPC. VPC flow logs help you monitor network traffic, analyze network attacks, and determine whether security group and <span id="FlowLog_0002__en-us_topic_0151014680_text11248715171311">firewall</span><span id="FlowLog_0002__en-us_topic_0151014680_text45551720134"></span> rules require modification.</p>
<p id="FlowLog_0002__en-us_topic_0151014680_p38692616421">VPC flow logs must be used together with the Log Tank Service (LTS). Before you create a VPC flow log, you need to create a log group and a log topic in LTS. <a href="#FlowLog_0002__en-us_topic_0151014680_fig1535115691415">Figure 1</a> shows the process for configuring the VPC flow log function.</p>
<div class="fignone" id="FlowLog_0002__en-us_topic_0151014680_fig1535115691415"><a name="FlowLog_0002__en-us_topic_0151014680_fig1535115691415"></a><a name="en-us_topic_0151014680_fig1535115691415"></a><span class="figcap"><b>Figure 1 </b>Configuring the VPC flow log function</span><br><span><img class="vsd" id="FlowLog_0002__en-us_topic_0151014680_image9661037927" src="en-us_image_0162336264.png"></span></div>
<p id="FlowLog_0002__en-us_topic_0151014680_p1137789316"></p>
<div class="section" id="FlowLog_0002__en-us_topic_0151014680_section1095231112517"><h4 class="sectiontitle">Notes and Constraints</h4><ul id="FlowLog_0002__en-us_topic_0151014680_ul18195045135317"><li id="FlowLog_0002__en-us_topic_0151014680_li13405622115110">Currently, only C3, M3, and S2 ECSs support VPC flow logs.</li><li id="FlowLog_0002__en-us_topic_0151014680_li21719253511">By default, you can create a maximum of 10 VPC flow logs.</li><li id="FlowLog_0002__en-us_topic_0151014680_li1919544520532">By default, a maximum of 400,000 flow log records are supported.</li></ul>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="FlowLog_0001.html">VPC Flow Log</a></div>
</div>
</div>

87
docs/vpc/umn/FlowLog_0003.html Normal file
View File

@ -0,0 +1,87 @@
<a name="FlowLog_0003"></a><a name="FlowLog_0003"></a>
<h1 class="topictitle1">Creating a VPC Flow Log</h1>
<div id="body8662426"><div class="section" id="FlowLog_0003__en-us_topic_0151016581_section15598193716333"><h4 class="sectiontitle">Scenarios</h4><p id="FlowLog_0003__en-us_topic_0151016581_p8118659113310">A VPC flow log records information about the traffic going to and from a VPC.</p>
</div>
<div class="section" id="FlowLog_0003__en-us_topic_0151016581_section48811154114711"><h4 class="sectiontitle">Prerequisites</h4><p id="FlowLog_0003__en-us_topic_0151016581_p1788687105119">Ensure that the following operations have been performed on the LTS console:</p>
<ul id="FlowLog_0003__en-us_topic_0151016581_ul2636114175114"><li id="FlowLog_0003__en-us_topic_0151016581_li196360418515">Create a log group.</li><li id="FlowLog_0003__en-us_topic_0151016581_li0636194119514">Create a log topic.</li></ul>
<p id="FlowLog_0003__en-us_topic_0151016581_p14332047105117">For more information about the LTS service, see the <em id="FlowLog_0003__en-us_topic_0151016581_i131771016125018">Log Tank Service User Guide</em>.</p>
</div>
<div class="section" id="FlowLog_0003__en-us_topic_0151016581_section7359352124511"><h4 class="sectiontitle">Procedure</h4><ol id="FlowLog_0003__en-us_topic_0151016581_ol1599100493"><li id="FlowLog_0003__en-us_topic_0151016581_li16376160184113">Log in to the management console.</li></ol><ol start="2" id="FlowLog_0003__en-us_topic_0151016581_ol433412616258"><li id="FlowLog_0003__en-us_topic_0151016581_li1261701516256">Click <span><img id="FlowLog_0003__en-us_topic_0151016581_en-us_topic_0118498823_image338921514480" src="en-us_image_0141273034.png"></span> in the upper left corner and select the desired region and project.</li></ol><ol start="3" id="FlowLog_0003__en-us_topic_0151016581_ol86651458101716"><li id="FlowLog_0003__en-us_topic_0151016581_l2446029456ed45d08632be6e309b1c82">On the console homepage, under <strong id="FlowLog_0003__en-us_topic_0151016581_b162389496434"><span id="FlowLog_0003__en-us_topic_0151016581_text20889146473">Network</span><span id="FlowLog_0003__en-us_topic_0151016581_text145191548275"></span></strong>, click <strong id="FlowLog_0003__en-us_topic_0151016581_b20241114914433">Virtual Private Cloud</strong>.</li><li id="FlowLog_0003__en-us_topic_0151016581_li15362774171923">In the navigation pane on the left, choose <strong id="FlowLog_0003__en-us_topic_0151016581_b118476383503">VPC Flow Logs</strong>.</li><li id="FlowLog_0003__en-us_topic_0151016581_li56651158141710">In the upper right corner, click <strong id="FlowLog_0003__en-us_topic_0151016581_b84235270610118">Create VPC Flow Log</strong>. On the displayed page, configure parameters as prompted.<div class="fignone" id="FlowLog_0003__en-us_topic_0151016581_fig4520438111212"><span class="figcap"><b>Figure 1 </b>Create VPC Flow Log</span><br><span><img id="FlowLog_0003__en-us_topic_0151016581_image6520113821218" src="en-us_image_0191544038.png"></span></div>
<div class="p" id="FlowLog_0003__en-us_topic_0151016581_p159985372119">
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="FlowLog_0003__en-us_topic_0151016581_table134731712211" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Parameter descriptions</caption><thead align="left"><tr id="FlowLog_0003__en-us_topic_0151016581_row1434717171627"><th align="left" class="cellrowborder" valign="top" width="19.24%" id="mcps1.3.3.5.3.3.1.2.4.1.1"><p id="FlowLog_0003__en-us_topic_0151016581_p234731711214"><strong id="FlowLog_0003__en-us_topic_0151016581_b729481085112">Parameter</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="55.7%" id="mcps1.3.3.5.3.3.1.2.4.1.2"><p id="FlowLog_0003__en-us_topic_0151016581_p934711715210"><strong id="FlowLog_0003__en-us_topic_0151016581_b761217124516">Description</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="25.06%" id="mcps1.3.3.5.3.3.1.2.4.1.3"><p id="FlowLog_0003__en-us_topic_0151016581_p23473171214"><strong id="FlowLog_0003__en-us_topic_0151016581_b9956614115118">Example Value</strong></p>
</th>
</tr>
</thead>
<tbody><tr id="FlowLog_0003__en-us_topic_0151016581_row2034718171526"><td class="cellrowborder" valign="top" width="19.24%" headers="mcps1.3.3.5.3.3.1.2.4.1.1 "><p id="FlowLog_0003__en-us_topic_0151016581_p63477171520">Name</p>
</td>
<td class="cellrowborder" valign="top" width="55.7%" headers="mcps1.3.3.5.3.3.1.2.4.1.2 "><p id="FlowLog_0003__en-us_topic_0151016581_p0347817222">The VPC flow log name.</p>
<p id="FlowLog_0003__en-us_topic_0151016581_p3691035194820">The name can contain a maximum of 64 characters, which may consist of letters, digits, underscores (_), hyphens (-), and periods (.). The name cannot contain spaces.</p>
</td>
<td class="cellrowborder" valign="top" width="25.06%" headers="mcps1.3.3.5.3.3.1.2.4.1.3 "><p id="FlowLog_0003__en-us_topic_0151016581_p14347191710216">flowlog-495d</p>
</td>
</tr>
<tr id="FlowLog_0003__en-us_topic_0151016581_row183478171729"><td class="cellrowborder" valign="top" width="19.24%" headers="mcps1.3.3.5.3.3.1.2.4.1.1 "><p id="FlowLog_0003__en-us_topic_0151016581_p11347141710216">Resource Type</p>
</td>
<td class="cellrowborder" valign="top" width="55.7%" headers="mcps1.3.3.5.3.3.1.2.4.1.2 "><p id="FlowLog_0003__en-us_topic_0151016581_p834721711219">The type of resources whose traffic is to be logged. You can select <strong id="FlowLog_0003__en-us_topic_0151016581_b319411435314">NIC</strong>, <strong id="FlowLog_0003__en-us_topic_0151016581_b155059371236">Subnet</strong>, or <strong id="FlowLog_0003__en-us_topic_0151016581_b16505183717319">VPC</strong>.</p>
</td>
<td class="cellrowborder" valign="top" width="25.06%" headers="mcps1.3.3.5.3.3.1.2.4.1.3 "><p id="FlowLog_0003__en-us_topic_0151016581_p6347317525">NIC</p>
</td>
</tr>
<tr id="FlowLog_0003__en-us_topic_0151016581_row83477171628"><td class="cellrowborder" valign="top" width="19.24%" headers="mcps1.3.3.5.3.3.1.2.4.1.1 "><p id="FlowLog_0003__en-us_topic_0151016581_p1081611984120">Resource</p>
</td>
<td class="cellrowborder" valign="top" width="55.7%" headers="mcps1.3.3.5.3.3.1.2.4.1.2 "><p id="FlowLog_0003__en-us_topic_0151016581_p143471917921">The specific NIC whose traffic is to be logged.</p>
<div class="note" id="FlowLog_0003__en-us_topic_0151016581_note81381412191719"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="FlowLog_0003__en-us_topic_0151016581_p111391812141715">We recommend that you select an ECS that is in the running state. If an ECS in the stopped state is selected, restart the ECS after creating the VPC flow log for accurately recording the information about the traffic going to and from the ECS NIC.</p>
</div></div>
</td>
<td class="cellrowborder" valign="top" width="25.06%" headers="mcps1.3.3.5.3.3.1.2.4.1.3 "><p id="FlowLog_0003__en-us_topic_0151016581_p4347517128">N/A</p>
</td>
</tr>
<tr id="FlowLog_0003__en-us_topic_0151016581_row734713175216"><td class="cellrowborder" valign="top" width="19.24%" headers="mcps1.3.3.5.3.3.1.2.4.1.1 "><p id="FlowLog_0003__en-us_topic_0151016581_p934719178215">Filter</p>
</td>
<td class="cellrowborder" valign="top" width="55.7%" headers="mcps1.3.3.5.3.3.1.2.4.1.2 "><ul id="FlowLog_0003__en-us_topic_0151016581_ul1934716177219"><li id="FlowLog_0003__en-us_topic_0151016581_li1034717173218"><strong id="FlowLog_0003__en-us_topic_0151016581_b934111133020">All traffic</strong>: specifies that both accepted and rejected traffic of the specified resource will be logged.</li><li id="FlowLog_0003__en-us_topic_0151016581_li16347317329"><strong id="FlowLog_0003__en-us_topic_0151016581_b918513514319">Accepted traffic</strong>: specifies that only accepted traffic of the specified resource will be logged. Accepted traffic refers to the traffic permitted by the security group or <span id="FlowLog_0003__en-us_topic_0151016581_text11248715171311">firewall</span><span id="FlowLog_0003__en-us_topic_0151016581_text45551720134"></span>.</li><li id="FlowLog_0003__en-us_topic_0151016581_li15347111710218"><strong id="FlowLog_0003__en-us_topic_0151016581_b22744512232">Rejected traffic</strong>: specifies that only rejected traffic of the specified resource will be logged. Rejected traffic refers to the traffic denied by the <span id="FlowLog_0003__en-us_topic_0151016581_text770047201316">firewall</span><span id="FlowLog_0003__en-us_topic_0151016581_text167001772131"></span>.</li></ul>
</td>
<td class="cellrowborder" valign="top" width="25.06%" headers="mcps1.3.3.5.3.3.1.2.4.1.3 "><p id="FlowLog_0003__en-us_topic_0151016581_p93471617626">All</p>
</td>
</tr>
<tr id="FlowLog_0003__en-us_topic_0151016581_row143475171327"><td class="cellrowborder" valign="top" width="19.24%" headers="mcps1.3.3.5.3.3.1.2.4.1.1 "><p id="FlowLog_0003__en-us_topic_0151016581_p734771710219">Log Group</p>
</td>
<td class="cellrowborder" valign="top" width="55.7%" headers="mcps1.3.3.5.3.3.1.2.4.1.2 "><p id="FlowLog_0003__en-us_topic_0151016581_p16347111715218">The log group created in LTS.</p>
</td>
<td class="cellrowborder" valign="top" width="25.06%" headers="mcps1.3.3.5.3.3.1.2.4.1.3 "><p id="FlowLog_0003__en-us_topic_0151016581_en-us_topic_0151016581_p634714176216">lts-group-wule</p>
</td>
</tr>
<tr id="FlowLog_0003__en-us_topic_0151016581_row63479171326"><td class="cellrowborder" valign="top" width="19.24%" headers="mcps1.3.3.5.3.3.1.2.4.1.1 "><p id="FlowLog_0003__en-us_topic_0151016581_p133476171224">Log Topic</p>
</td>
<td class="cellrowborder" valign="top" width="55.7%" headers="mcps1.3.3.5.3.3.1.2.4.1.2 "><p id="FlowLog_0003__en-us_topic_0151016581_p2347101712216">The log topic created in LTS.</p>
</td>
<td class="cellrowborder" valign="top" width="25.06%" headers="mcps1.3.3.5.3.3.1.2.4.1.3 "><p id="FlowLog_0003__en-us_topic_0151016581_en-us_topic_0151016581_p43470173218">LogTopic1</p>
</td>
</tr>
<tr id="FlowLog_0003__en-us_topic_0151016581_row1834761720219"><td class="cellrowborder" valign="top" width="19.24%" headers="mcps1.3.3.5.3.3.1.2.4.1.1 "><p id="FlowLog_0003__en-us_topic_0151016581_p113471171229">Description</p>
</td>
<td class="cellrowborder" valign="top" width="55.7%" headers="mcps1.3.3.5.3.3.1.2.4.1.2 "><p id="FlowLog_0003__en-us_topic_0151016581_p43473171124">Supplementary information about the VPC flow log. This parameter is optional.</p>
<p id="FlowLog_0003__en-us_topic_0151016581_p17347181718216">The VPC flow log description can contain a maximum of 255 characters and cannot contain angle brackets (&lt; or &gt;).</p>
</td>
<td class="cellrowborder" valign="top" width="25.06%" headers="mcps1.3.3.5.3.3.1.2.4.1.3 "><p id="FlowLog_0003__en-us_topic_0151016581_p3347141715212">N/A</p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="note" id="FlowLog_0003__en-us_topic_0151016581_note05431834104717"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="FlowLog_0003__en-us_topic_0151016581_p2980829135614">Only two flow logs, each with a different filter, can be created for a single resource under the same log group and log topic. Each VPC flow log must be unique.</p>
</div></div>
</li><li id="FlowLog_0003__en-us_topic_0151016581_li8268728877">Click <strong id="FlowLog_0003__en-us_topic_0151016581_b162515274512">OK</strong>.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="FlowLog_0001.html">VPC Flow Log</a></div>
</div>
</div>

144
docs/vpc/umn/FlowLog_0004.html Normal file
View File

File diff suppressed because it is too large Load Diff

17
docs/vpc/umn/FlowLog_0005.html Normal file
View File

@ -0,0 +1,17 @@
<a name="FlowLog_0005"></a><a name="FlowLog_0005"></a>
<h1 class="topictitle1">Deleting a VPC Flow Log</h1>
<div id="body8662426"><div class="section" id="FlowLog_0005__en-us_topic_0151016583_section15598193716333"><h4 class="sectiontitle">Scenarios</h4><p id="FlowLog_0005__en-us_topic_0151016583_p8118659113310">Delete a VPC flow log that is not required. Deleting a VPC flow log will not delete the existing flow log records in LTS.</p>
<div class="note" id="FlowLog_0005__en-us_topic_0151016583_note3879192310615"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="FlowLog_0005__en-us_topic_0151016583_p10879923360">If a NIC that uses a VPC flow log is deleted, the flow log will be automatically deleted. However, the flow log records are not deleted.</p>
</div></div>
</div>
<div class="section" id="FlowLog_0005__en-us_topic_0151016583_section7359352124511"><h4 class="sectiontitle">Procedure</h4><ol id="FlowLog_0005__en-us_topic_0151016583_ol1599100493"><li id="FlowLog_0005__en-us_topic_0151016583_li16376160184113">Log in to the management console.</li></ol><ol start="2" id="FlowLog_0005__en-us_topic_0151016583_ol433412616258"><li id="FlowLog_0005__en-us_topic_0151016583_li1261701516256">Click <span><img id="FlowLog_0005__en-us_topic_0151016583_en-us_topic_0118498823_image338921514480" src="en-us_image_0141273034.png"></span> in the upper left corner and select the desired region and project.</li></ol><ol start="3" id="FlowLog_0005__en-us_topic_0151016583_ol86651458101716"><li id="FlowLog_0005__en-us_topic_0151016583_l2446029456ed45d08632be6e309b1c82">On the console homepage, under <strong id="FlowLog_0005__en-us_topic_0151016583_b81367139521"><span id="FlowLog_0005__en-us_topic_0151016583_text122834720811">Network</span><span id="FlowLog_0005__en-us_topic_0151016583_text17329492087"></span></strong>, click <strong id="FlowLog_0005__en-us_topic_0151016583_b17137181335220">Virtual Private Cloud</strong>.</li><li id="FlowLog_0005__en-us_topic_0151016583_li15362774171923">In the navigation pane on the left, choose <strong id="FlowLog_0005__en-us_topic_0151016583_b71643149529">VPC Flow Logs</strong>.</li><li id="FlowLog_0005__en-us_topic_0151016583_li7951185711459">Locate the row that contains the VPC flow log to be deleted and click <strong id="FlowLog_0005__en-us_topic_0151016583_b7845125318142">Delete</strong> in the <strong id="FlowLog_0005__en-us_topic_0151016583_b2084695319142">Operation</strong> column.<div class="fignone" id="FlowLog_0005__en-us_topic_0151016583_fig11695911145"><span class="figcap"><b>Figure 1 </b>Deleting a VPC flow log</span><br><span><img id="FlowLog_0005__en-us_topic_0151016583_image3696513415" src="en-us_image_0191594527.png"></span></div>
</li><li id="FlowLog_0005__en-us_topic_0151016583_li56651158141710">Click <strong id="FlowLog_0005__en-us_topic_0151016583_b221712241717">Yes</strong> in the displayed dialog box.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="FlowLog_0001.html">VPC Flow Log</a></div>
</div>
</div>

14
docs/vpc/umn/FlowLog_0006.html Normal file
View File

@ -0,0 +1,14 @@
<a name="FlowLog_0006"></a><a name="FlowLog_0006"></a>
<h1 class="topictitle1">Enabling or Disabling VPC Flow Log</h1>
<div id="body8662426"><div class="section" id="FlowLog_0006__en-us_topic_0161677165_section15598193716333"><h4 class="sectiontitle">Scenarios</h4><p id="FlowLog_0006__en-us_topic_0161677165_p8118659113310">After a VPC flow log is created, the VPC flow log is automatically enabled. If you do not need to record traffic data, you can disable the corresponding VPC flow log. The disabled VPC flow log can be enabled again.</p>
</div>
<div class="section" id="FlowLog_0006__en-us_topic_0161677165_section7359352124511"><h4 class="sectiontitle">Procedure</h4><ol id="FlowLog_0006__en-us_topic_0161677165_ol1599100493"><li id="FlowLog_0006__en-us_topic_0161677165_li16376160184113">Log in to the management console.</li></ol><ol start="2" id="FlowLog_0006__en-us_topic_0161677165_ol433412616258"><li id="FlowLog_0006__en-us_topic_0161677165_li1261701516256">Click <span><img id="FlowLog_0006__en-us_topic_0161677165_en-us_topic_0118498823_image338921514480" src="en-us_image_0141273034.png"></span> in the upper left corner and select the desired region and project.</li></ol><ol start="3" id="FlowLog_0006__en-us_topic_0161677165_ol86651458101716"><li id="FlowLog_0006__en-us_topic_0161677165_l2446029456ed45d08632be6e309b1c82">On the console homepage, under <strong id="FlowLog_0006__en-us_topic_0161677165_b370994753517"><span id="FlowLog_0006__en-us_topic_0161677165_text696602718820">Network</span><span id="FlowLog_0006__en-us_topic_0161677165_text104512296816"></span></strong>, click <strong id="FlowLog_0006__en-us_topic_0161677165_b17709194719358">Virtual Private Cloud</strong>.</li><li id="FlowLog_0006__en-us_topic_0161677165_li15362774171923">In the navigation pane on the left, choose <strong id="FlowLog_0006__en-us_topic_0161677165_b14531953153514">VPC Flow Logs</strong>.</li><li id="FlowLog_0006__en-us_topic_0161677165_li7951185711459">Locate the VPC flow log to be enabled or disabled, and click <strong id="FlowLog_0006__en-us_topic_0161677165_b842352706154455">Enable</strong> or <strong id="FlowLog_0006__en-us_topic_0161677165_b842352706154619">Disable</strong> in the <strong id="FlowLog_0006__en-us_topic_0161677165_b84235270615455">Operation</strong> column.</li><li id="FlowLog_0006__en-us_topic_0161677165_li488372733118">Click <strong id="FlowLog_0006__en-us_topic_0161677165_b84235270615469">Yes</strong>.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="FlowLog_0001.html">VPC Flow Log</a></div>
</div>
</div>

3
docs/vpc/umn/PARAMETERS.txt Normal file
View File

@ -0,0 +1,3 @@
version=""
language="en-us"
type=""

52
docs/vpc/umn/SecurityGroup_0003.html Normal file
View File

@ -0,0 +1,52 @@
<a name="SecurityGroup_0003"></a><a name="SecurityGroup_0003"></a>
<h1 class="topictitle1">Default Security Groups and Security Group Rules</h1>
<div id="body8662426"><p id="SecurityGroup_0003__en-us_topic_0118534003_p9223113110710">Your account automatically comes with a default security group. The default security group allows all outbound traffic, denies all inbound traffic, and allows all traffic between cloud resources in the group. Your cloud resources in this security group can communicate with each other already without adding additional rules.</p>
<p id="SecurityGroup_0003__en-us_topic_0118534003_p1480513558383"><a href="#SecurityGroup_0003__en-us_topic_0118534003_fig997718156161">Figure 1</a> shows the default security group rules. The following uses access between ECSs as an example.</p>
<div class="fignone" id="SecurityGroup_0003__en-us_topic_0118534003_fig997718156161"><a name="SecurityGroup_0003__en-us_topic_0118534003_fig997718156161"></a><a name="en-us_topic_0118534003_fig997718156161"></a><span class="figcap"><b>Figure 1 </b>Default security group</span><br><span><img class="eddx" id="SecurityGroup_0003__en-us_topic_0118534003_image22171236172514" src="en-us_image_0000001230120807.png"></span></div>
<p id="SecurityGroup_0003__en-us_topic_0118534003_p14738751115618"><a href="#SecurityGroup_0003__en-us_topic_0118534003_table493045171919">Table 1</a> describes the default rules for the default security group.</p>
<div class="tablenoborder"><a name="SecurityGroup_0003__en-us_topic_0118534003_table493045171919"></a><a name="en-us_topic_0118534003_table493045171919"></a><table cellpadding="4" cellspacing="0" summary="" id="SecurityGroup_0003__en-us_topic_0118534003_table493045171919" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Default security group rules</caption><thead align="left"><tr id="SecurityGroup_0003__en-us_topic_0118534003_row12930145141920"><th align="left" class="cellrowborder" valign="top" width="11.83%" id="mcps1.3.5.2.6.1.1"><p id="SecurityGroup_0003__en-us_topic_0118534003_p3930145118194">Direction</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="11.97%" id="mcps1.3.5.2.6.1.2"><p id="SecurityGroup_0003__en-us_topic_0118534003_p129301851131913">Protocol</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="15%" id="mcps1.3.5.2.6.1.3"><p id="SecurityGroup_0003__en-us_topic_0118534003_p093075141919">Port/Range</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="25.22%" id="mcps1.3.5.2.6.1.4"><p id="SecurityGroup_0003__en-us_topic_0118534003_p149306511191">Source/Destination</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="35.980000000000004%" id="mcps1.3.5.2.6.1.5"><p id="SecurityGroup_0003__en-us_topic_0118534003_p99301851161916">Description</p>
</th>
</tr>
</thead>
<tbody><tr id="SecurityGroup_0003__en-us_topic_0118534003_row17931125111193"><td class="cellrowborder" valign="top" width="11.83%" headers="mcps1.3.5.2.6.1.1 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p1593111518191">Outbound</p>
</td>
<td class="cellrowborder" valign="top" width="11.97%" headers="mcps1.3.5.2.6.1.2 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p19931105117191">All</p>
</td>
<td class="cellrowborder" valign="top" width="15%" headers="mcps1.3.5.2.6.1.3 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p15931651181920">All</p>
</td>
<td class="cellrowborder" valign="top" width="25.22%" headers="mcps1.3.5.2.6.1.4 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p179318515196">Destination: 0.0.0.0/0</p>
</td>
<td class="cellrowborder" valign="top" width="35.980000000000004%" headers="mcps1.3.5.2.6.1.5 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p49315518196">Allows all outbound traffic.</p>
</td>
</tr>
<tr id="SecurityGroup_0003__en-us_topic_0118534003_row109311451131911"><td class="cellrowborder" valign="top" width="11.83%" headers="mcps1.3.5.2.6.1.1 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p1293111513193">Inbound</p>
</td>
<td class="cellrowborder" valign="top" width="11.97%" headers="mcps1.3.5.2.6.1.2 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p1493105115194">All</p>
</td>
<td class="cellrowborder" valign="top" width="15%" headers="mcps1.3.5.2.6.1.3 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p1593155181920">All</p>
</td>
<td class="cellrowborder" valign="top" width="25.22%" headers="mcps1.3.5.2.6.1.4 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p593115141917">Source: the current security group (for example, sg-<em id="SecurityGroup_0003__en-us_topic_0118534003_i2138146127154428">xxxxx</em>)</p>
</td>
<td class="cellrowborder" valign="top" width="35.980000000000004%" headers="mcps1.3.5.2.6.1.5 "><p id="SecurityGroup_0003__en-us_topic_0118534003_p2931151121912">Allows communications among ECSs within the security group and denies all inbound traffic (incoming data packets).</p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="vpc_SecurityGroup_0001.html">Security Group</a></div>
</div>
</div>

19
docs/vpc/umn/SecurityGroup_0004.html Normal file
View File

@ -0,0 +1,19 @@
<a name="SecurityGroup_0004"></a><a name="SecurityGroup_0004"></a>
<h1 class="topictitle1">Fast-Adding Security Group Rules</h1>
<div id="body8662426"><div class="section" id="SecurityGroup_0004__en-us_topic_0118534006_section75471104513"><h4 class="sectiontitle">Scenarios</h4><p id="SecurityGroup_0004__en-us_topic_0118534006_p1325418320455">You can add multiple security group rules with different protocols and ports at the same time.</p>
</div>
<div class="section" id="SecurityGroup_0004__en-us_topic_0118534006_section5619104211210"><h4 class="sectiontitle">Procedure</h4><ol id="SecurityGroup_0004__en-us_topic_0118534006_ol1599100493"><li id="SecurityGroup_0004__en-us_topic_0118534006_li1831041311306">Log in to the management console.</li></ol><ol start="2" id="SecurityGroup_0004__en-us_topic_0118534006_ol1527262085715"><li id="SecurityGroup_0004__en-us_topic_0118534006_li11279102515716">Click <span><img id="SecurityGroup_0004__en-us_topic_0118534006_en-us_topic_0118498823_image338921514480" src="en-us_image_0141273034.png"></span> in the upper left corner and select the desired region and project.</li><li id="SecurityGroup_0004__en-us_topic_0118534006_li1728112545719">On the console homepage, under <strong id="SecurityGroup_0004__en-us_topic_0118534006_b1150973555719"><span id="SecurityGroup_0004__en-us_topic_0118534006_text1184564753614">Network</span><span id="SecurityGroup_0004__en-us_topic_0118534006_text52831849123616"></span></strong>, click <strong id="SecurityGroup_0004__en-us_topic_0118534006_b25096351577">Virtual Private Cloud</strong>.</li><li id="SecurityGroup_0004__en-us_topic_0118534006_li15281162517570">In the navigation pane on the left, choose <strong id="SecurityGroup_0004__en-us_topic_0118534006_b986764371515">Access Control</strong> &gt; <strong id="SecurityGroup_0004__en-us_topic_0118534006_b887192471514">Security Groups</strong>.</li><li id="SecurityGroup_0004__en-us_topic_0118534006_li286122917579">On the <strong id="SecurityGroup_0004__en-us_topic_0118534006_b842352706154919">Security Groups</strong> page, locate the target security group and click <strong id="SecurityGroup_0004__en-us_topic_0118534006_b842352706155435">Manage Rule</strong> in the <strong id="SecurityGroup_0004__en-us_topic_0118534006_b842352706155450">Operation</strong> column to switch to the page for managing inbound and outbound rules.</li><li id="SecurityGroup_0004__en-us_topic_0118534006_li1063572655813">On the <strong id="SecurityGroup_0004__en-us_topic_0118534006_b6612131412363">Inbound Rules</strong> tab, click <strong id="SecurityGroup_0004__en-us_topic_0118534006_b84235270615825">Fast-Add Rule</strong>. In the displayed dialog box, select the protocols and ports you wish to add all at once.<div class="fignone" id="SecurityGroup_0004__en-us_topic_0118534006_fig1127533152411"><span class="figcap"><b>Figure 1 </b>Fast-Add Inbound Rule</span><br><span><img id="SecurityGroup_0004__en-us_topic_0118534006_image427617310248" src="en-us_image_0211552164.png"></span></div>
<p id="SecurityGroup_0004__en-us_topic_0118534006_p179862281635"></p>
</li><li id="SecurityGroup_0004__en-us_topic_0118534006_li5604143282711">On the <strong id="SecurityGroup_0004__en-us_topic_0118534006_b121728429363">Outbound Rules</strong> tab, click <strong id="SecurityGroup_0004__en-us_topic_0118534006_b842352706171918">Fast-Add Rule</strong>. In the displayed dialog box, select required protocols and ports to add multiple rules at a time.<p id="SecurityGroup_0004__en-us_topic_0118534006_p127887158136"></p>
<div class="fignone" id="SecurityGroup_0004__en-us_topic_0118534006_fig164897019299"><span class="figcap"><b>Figure 2 </b>Fast-Add Outbound Rule</span><br><span><img id="SecurityGroup_0004__en-us_topic_0118534006_image1548970142912" src="en-us_image_0211560998.png"></span></div>
<p id="SecurityGroup_0004__en-us_topic_0118534006_p7646197161514"></p>
</li><li id="SecurityGroup_0004__en-us_topic_0118534006_li1736214532153">Click <strong>OK</strong>.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="vpc_SecurityGroup_0001.html">Security Group</a></div>
</div>
</div>

20
docs/vpc/umn/SecurityGroup_0006.html Normal file
View File

@ -0,0 +1,20 @@
<a name="SecurityGroup_0006"></a><a name="SecurityGroup_0006"></a>
<h1 class="topictitle1">Changing the Security Group of an ECS</h1>
<div id="body8662426"><div class="section" id="SecurityGroup_0006__en-us_topic_0118534010_section181956227265"><h4 class="sectiontitle">Scenarios</h4><p id="SecurityGroup_0006__en-us_topic_0118534010_p95671820182813">Change the security group associated with an ECS NIC.</p>
</div>
<div class="section" id="SecurityGroup_0006__en-us_topic_0118534010_section451235718918"><h4 class="sectiontitle">Procedure</h4><ol id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_ol146871568377"><li id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_li3490190117228">Log in to the management console.</li><li id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_li1168746173718">Click <span><img id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_image1791178433153215" src="en-us_image_0093507575.png"></span> in the upper left corner and select your region and project.</li><li id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_li206871564372">Under <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b19411937174214"><span id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_text8411637184214">Computing</span></strong>, click <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b24121037184218">Elastic Cloud Server</strong>.</li><li id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_li6688267371">In the ECS list, locate the row that contains the target ECS. Click <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b3965144994119">More</strong> in the <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b179661449174112">Operation</strong> column and select <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b14966174913419">Manage Network</strong> &gt; <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b19967749134120">Change Security Group</strong>.<p id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_p968836143718">The <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b842352706162949">Change Security Group</strong> dialog box is displayed.</p>
<div class="fignone" id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_fig1673733486"><span class="figcap"><b>Figure 1 </b>Change Security Group</span><br><span><img id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_image14705135143714" src="en-us_image_0122999741.png"></span></div>
</li><li id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_li14114175682518">Select the target NIC and security groups as prompted.<p id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_p1615510191262"><a name="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_li14114175682518"></a><a name="en-us_topic_0118534010_en-us_topic_0093492517_li14114175682518"></a>You can select multiple security groups. In such a case, the rules of all the selected security groups will be aggregated to apply on the <span id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_text10680201271119">ECS</span>.</p>
<p id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_p1669712426182">To create a security group, click <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b1291994117114">Create Security Group</strong>.</p>
<div class="note" id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_note4690867375"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_p3691176143719">Using multiple security groups may deteriorate <span id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_text127881839154216">ECS</span> network performance. You are suggested to select no more than five security groups.</p>
</div></div>
</li><li id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_li1969136193711">Click <strong id="SecurityGroup_0006__en-us_topic_0118534010_en-us_topic_0093492517_b842352706165945">OK</strong>.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="vpc_SecurityGroup_0001.html">Security Group</a></div>
</div>
</div>

20
docs/vpc/umn/SecurityGroup_0017.html Normal file
View File

@ -0,0 +1,20 @@
<a name="SecurityGroup_0017"></a><a name="SecurityGroup_0017"></a>
<h1 class="topictitle1">Adding Instances to and Removing Them from a Security Group</h1>
<div id="body8662426"><div class="section" id="SecurityGroup_0017__en-us_topic_0123332992_section1284185020245"><h4 class="sectiontitle">Scenarios</h4><p id="SecurityGroup_0017__en-us_topic_0123332992_p20866105342413">After a security group is created, you can add instances to the security group to protect the instances. You can also remove them from the security group as required.</p>
<p id="SecurityGroup_0017__en-us_topic_0123332992_p37853499286">You can add multiple instances to or remove them from a security group.</p>
</div>
<div class="section" id="SecurityGroup_0017__en-us_topic_0123332992_section7737145418298"><h4 class="sectiontitle">Adding Instances to a Security Group</h4><ol id="SecurityGroup_0017__en-us_topic_0123332992_ol1599100493"><li id="SecurityGroup_0017__en-us_topic_0123332992_li9797130193219">Log in to the management console.</li></ol><ol start="2" id="SecurityGroup_0017__en-us_topic_0123332992_ol1527262085715"><li id="SecurityGroup_0017__en-us_topic_0123332992_li19707181319510">Click <span><img id="SecurityGroup_0017__en-us_topic_0123332992_en-us_topic_0118498823_image338921514480" src="en-us_image_0141273034.png"></span> in the upper left corner and select the desired region and project.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li1728112545719">On the console homepage, under <strong id="SecurityGroup_0017__en-us_topic_0123332992_b11677185671411"><span id="SecurityGroup_0017__en-us_topic_0123332992_text10636153613811">Network</span><span id="SecurityGroup_0017__en-us_topic_0123332992_text12142238103816"></span></strong>, click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b8677155613143">Virtual Private Cloud</strong>.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li15281162517570">In the navigation pane on the left, choose <strong id="SecurityGroup_0017__en-us_topic_0123332992_b26200341168">Access Control</strong> &gt; <strong id="SecurityGroup_0017__en-us_topic_0123332992_b762519341261">Security Groups</strong>.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li286122917579">On the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b2091855912138">Security Groups</strong> page, click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b5808928607">Manage Instance</strong> in the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b49191759181319">Operation</strong> column.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li7677145464713">On the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b842352706144348">Servers</strong> tab, click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b842352706144415">Add</strong> and add one or more servers to the current security group.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li20454133912504">On the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b842352706144522">Extension NICs</strong> tab, click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b842352706144533">Add</strong> and add one or more extension NICs to the current security group.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li2089912335185">Click <strong>OK</strong>.</li></ol>
</div>
<div class="section" id="SecurityGroup_0017__en-us_topic_0123332992_section147074331319"><h4 class="sectiontitle">Removing Instances from a Security Group</h4><ol id="SecurityGroup_0017__en-us_topic_0123332992_ol1897954334412"><li id="SecurityGroup_0017__en-us_topic_0123332992_li11489122614011">Log in to the management console.</li></ol><ol start="2" id="SecurityGroup_0017__en-us_topic_0123332992_ol2708193318119"><li id="SecurityGroup_0017__en-us_topic_0123332992_li1770913314115">Click <span><img id="SecurityGroup_0017__en-us_topic_0123332992_en-us_topic_0118498823_image338921514480_1" src="en-us_image_0141273034.png"></span> in the upper left corner and select the desired region and project.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li1770916339118">On the console homepage, under <strong id="SecurityGroup_0017__en-us_topic_0123332992_b17553356105413"><span id="SecurityGroup_0017__en-us_topic_0123332992_text5152252123814">Network</span><span id="SecurityGroup_0017__en-us_topic_0123332992_text9835145311389"></span></strong>, click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b1553165619540">Virtual Private Cloud</strong>.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li13710163311119">In the navigation pane on the left, choose <strong id="SecurityGroup_0017__en-us_topic_0123332992_b31988488616">Access Control</strong> &gt; <strong id="SecurityGroup_0017__en-us_topic_0123332992_b320454816619">Security Groups</strong>.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li15710173310112">On the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b12372184413013">Security Groups</strong> page, click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b123771444101">Manage Instance</strong> in the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b33785449019">Operation</strong> column.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li510095217212">On the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b842352706144648">Servers</strong> tab, locate the target server and click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b842352706145255">Remove</strong> in the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b84235270614534">Operation</strong> column to remove the server from current security group.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li1150617131044">On the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b842352706145831">Extension NICs</strong> tab, locate the target extension NIC and click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b84235270615032">Remove</strong> in the <strong id="SecurityGroup_0017__en-us_topic_0123332992_b84235270615038">Operation</strong> column to remove the NIC from the current security group.</li><li id="SecurityGroup_0017__en-us_topic_0123332992_li131424061815">Click <strong>Yes</strong>.</li></ol>
<p id="SecurityGroup_0017__en-us_topic_0123332992_p13242193814303"><strong id="SecurityGroup_0017__en-us_topic_0123332992_b8423527061514">Removing multiple instances from a security group</strong></p>
<p id="SecurityGroup_0017__en-us_topic_0123332992_p20411114216304">Select multiple servers and click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b842352706163632">Remove</strong> above the server list to remove the selected servers from the current security group all at once.</p>
<p id="SecurityGroup_0017__en-us_topic_0123332992_p11810143151111">Select multiple extension NICs and click <strong id="SecurityGroup_0017__en-us_topic_0123332992_b84235270616591">Remove</strong> above the extension NIC list to remove the selected extension NICs from the current security group all at once.</p>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="vpc_SecurityGroup_0001.html">Security Group</a></div>
</div>
</div>

82
docs/vpc/umn/acl_0001.html Normal file
View File

@ -0,0 +1,82 @@
<a name="acl_0001"></a><a name="acl_0001"></a>
<h1 class="topictitle1"><span id="en-us_topic_0144643910_text1498613317316">Firewall</span><span id="en-us_topic_0144643910_text955817375312"></span> Overview</h1>
<div id="body8662426"><p id="acl_0001__en-us_topic_0144643910_p13781551490">A <span id="acl_0001__en-us_topic_0144643910_text11248715171311">firewall</span><span id="acl_0001__en-us_topic_0144643910_text45551720134"></span> is an optional layer of security for your subnets. After you associate one or more subnets with a <span id="acl_0001__en-us_topic_0144643910_text13717202713198">firewall</span><span id="acl_0001__en-us_topic_0144643910_text2717122731911"></span>, you can control traffic in and out of the subnets.</p>
<p id="acl_0001__en-us_topic_0144643910_p8060118"><a href="#acl_0001__en-us_topic_0144643910_fig9582182315479">Figure 1</a> shows how a firewall works.</p>
<div class="fignone" id="acl_0001__en-us_topic_0144643910_fig9582182315479"><a name="acl_0001__en-us_topic_0144643910_fig9582182315479"></a><a name="en-us_topic_0144643910_fig9582182315479"></a><span class="figcap"><b>Figure 1 </b>Security groups and firewalls</span><br><span><img id="acl_0001__en-us_topic_0144643910_en-us_topic_0118534001_image1897541382617" src="en-us_image_0148244691.png"></span></div>
<p id="acl_0001__en-us_topic_0144643910_p668217610324">Similar to security groups, <span id="acl_0001__en-us_topic_0144643910_text127138429139">firewall</span><span id="acl_0001__en-us_topic_0144643910_text6713942101313"></span>s control access to subnets and add an additional layer of defense to your subnets. Security groups only have the "allow" rules, but <span id="acl_0001__en-us_topic_0144643910_text7650842151610">firewall</span><span id="acl_0001__en-us_topic_0144643910_text1365444217168"></span>s have both "allow" and "deny" rules. You can use <span id="acl_0001__en-us_topic_0144643910_text1265824241617">firewall</span><span id="acl_0001__en-us_topic_0144643910_text1066144231613"></span>s together with security groups to implement comprehensive and fine-grained access control.</p>
<p id="acl_0001__en-us_topic_0144643910_p6398184124212"><a href="en-us_topic_0052003963.html#en-us_topic_0052003963">Differences Between Security Groups and Firewalls</a> summarizes the basic differences between security groups and <span id="acl_0001__en-us_topic_0144643910_text137415412138">firewall</span><span id="acl_0001__en-us_topic_0144643910_text4374125421314"></span>s.</p>
<div class="section" id="acl_0001__en-us_topic_0144643910_section1952742625114"><h4 class="sectiontitle"><span id="acl_0001__en-us_topic_0144643910_text16549171719105">Firewall</span><span id="acl_0001__en-us_topic_0144643910_text1866191911020"></span> Basics</h4><ul id="acl_0001__en-us_topic_0144643910_ul16670101419510"><li id="acl_0001__en-us_topic_0144643910_li1767091455112">Your VPC does not come with a <span id="acl_0001__en-us_topic_0144643910_text1681559201318">firewall</span><span id="acl_0001__en-us_topic_0144643910_text1481195921318"></span>, but you can create a <span id="acl_0001__en-us_topic_0144643910_text193132025161912">firewall</span><span id="acl_0001__en-us_topic_0144643910_text131517252195"></span> and associate it with a VPC subnet if required. By default, each <span id="acl_0001__en-us_topic_0144643910_text17139141019144">firewall</span><span id="acl_0001__en-us_topic_0144643910_text1313941001416"></span> denies all inbound traffic to and outbound traffic from the associated subnet until you add rules.</li><li id="acl_0001__en-us_topic_0144643910_li9670101412519">You can associate a <span id="acl_0001__en-us_topic_0144643910_text129685145149">firewall</span><span id="acl_0001__en-us_topic_0144643910_text16968514181411"></span> with multiple subnets. However, a subnet can only be associated with one <span id="acl_0001__en-us_topic_0144643910_text1922420915259">firewall</span><span id="acl_0001__en-us_topic_0144643910_text12259912252"></span> at a time.</li><li id="acl_0001__en-us_topic_0144643910_li1670714145119">Each newly created <span id="acl_0001__en-us_topic_0144643910_text138342217143">firewall</span><span id="acl_0001__en-us_topic_0144643910_text1183132212149"></span> is in the <strong id="acl_0001__en-us_topic_0144643910_b0772925121511">Inactive</strong> state until you associate subnets with it.</li></ul>
</div>
<div class="section" id="acl_0001__en-us_topic_0144643910_section99541345213"><a name="acl_0001__en-us_topic_0144643910_section99541345213"></a><a name="en-us_topic_0144643910_section99541345213"></a><h4 class="sectiontitle">Default <span id="acl_0001__en-us_topic_0144643910_text17811727151018">Firewall</span><span id="acl_0001__en-us_topic_0144643910_text176331829131014"></span> Rules</h4><p id="acl_0001__en-us_topic_0144643910_p1767071405116">By default, each <span id="acl_0001__en-us_topic_0144643910_text28540545146">firewall</span><span id="acl_0001__en-us_topic_0144643910_text12854205411419"></span> has preset rules that allow the following packets:</p>
<ul id="acl_0001__en-us_topic_0144643910_ul116891923175218"><li id="acl_0001__en-us_topic_0144643910_li4671121410513">Packets whose source and destination are in the same subnet</li><li id="acl_0001__en-us_topic_0144643910_li20671101455117">Broadcast packets with the destination 255.255.255.255/32, which is used to configure host startup information.</li><li id="acl_0001__en-us_topic_0144643910_li867110142516">Multicast packets with the destination 224.0.0.0/24, which is used by routing protocols.</li><li id="acl_0001__en-us_topic_0144643910_li1067121414513">Metadata packets with the destination 169.254.169.254/32 and TCP port number 80, which is used to obtain metadata.</li><li id="acl_0001__en-us_topic_0144643910_li166902023175218">Packets from CIDR blocks that are reserved for public services (for example, packets with the destination 100.125.0.0/16)</li><li id="acl_0001__en-us_topic_0144643910_li11670914165110">A <span id="acl_0001__en-us_topic_0144643910_text13558171917362">firewall</span><span id="acl_0001__en-us_topic_0144643910_text1755991943617"></span> denies all traffic in and out of a subnet excepting the preceding ones. <a href="#acl_0001__en-us_topic_0144643910_table1034601475112">Table 1</a> shows the default <span id="acl_0001__en-us_topic_0144643910_text21228235364">firewall</span><span id="acl_0001__en-us_topic_0144643910_text17122142314367"></span> rules. You cannot modify or delete the default rules.
<div class="tablenoborder"><a name="acl_0001__en-us_topic_0144643910_table1034601475112"></a><a name="en-us_topic_0144643910_table1034601475112"></a><table cellpadding="4" cellspacing="0" summary="" id="acl_0001__en-us_topic_0144643910_table1034601475112" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Default <span id="acl_0001__en-us_topic_0144643910_text16669711181515">firewall</span><span id="acl_0001__en-us_topic_0144643910_text126697115158"></span> rules</caption><thead align="left"><tr id="acl_0001__en-us_topic_0144643910_row1267171445118"><th align="left" class="cellrowborder" valign="top" width="15.53398058252427%" id="mcps1.3.7.3.6.6.2.8.1.1"><p id="acl_0001__en-us_topic_0144643910_p4671214185116">Direction</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="11.650485436893202%" id="mcps1.3.7.3.6.6.2.8.1.2"><p id="acl_0001__en-us_topic_0144643910_p46711614195111">Priority</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="10.679611650485436%" id="mcps1.3.7.3.6.6.2.8.1.3"><p id="acl_0001__en-us_topic_0144643910_p186711114105115">Action</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="13.59223300970874%" id="mcps1.3.7.3.6.6.2.8.1.4"><p id="acl_0001__en-us_topic_0144643910_p86711114195114">Protocol</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="11.650485436893202%" id="mcps1.3.7.3.6.6.2.8.1.5"><p id="acl_0001__en-us_topic_0144643910_p12671101405114">Source</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="18.446601941747574%" id="mcps1.3.7.3.6.6.2.8.1.6"><p id="acl_0001__en-us_topic_0144643910_p2671814165117">Destination</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="18.446601941747574%" id="mcps1.3.7.3.6.6.2.8.1.7"><p id="acl_0001__en-us_topic_0144643910_p136711114195118">Description</p>
</th>
</tr>
</thead>
<tbody><tr id="acl_0001__en-us_topic_0144643910_row167117147516"><td class="cellrowborder" valign="top" width="15.53398058252427%" headers="mcps1.3.7.3.6.6.2.8.1.1 "><p id="acl_0001__en-us_topic_0144643910_p14671214175113">Inbound</p>
</td>
<td class="cellrowborder" valign="top" width="11.650485436893202%" headers="mcps1.3.7.3.6.6.2.8.1.2 "><p id="acl_0001__en-us_topic_0144643910_p467181413516">*</p>
</td>
<td class="cellrowborder" valign="top" width="10.679611650485436%" headers="mcps1.3.7.3.6.6.2.8.1.3 "><p id="acl_0001__en-us_topic_0144643910_p767141475110">Deny</p>
</td>
<td class="cellrowborder" valign="top" width="13.59223300970874%" headers="mcps1.3.7.3.6.6.2.8.1.4 "><p id="acl_0001__en-us_topic_0144643910_p12671161413512">All</p>
</td>
<td class="cellrowborder" valign="top" width="11.650485436893202%" headers="mcps1.3.7.3.6.6.2.8.1.5 "><p id="acl_0001__en-us_topic_0144643910_p1967117148511">0.0.0.0/0</p>
</td>
<td class="cellrowborder" valign="top" width="18.446601941747574%" headers="mcps1.3.7.3.6.6.2.8.1.6 "><p id="acl_0001__en-us_topic_0144643910_p10671101425118">0.0.0.0/0</p>
</td>
<td class="cellrowborder" valign="top" width="18.446601941747574%" headers="mcps1.3.7.3.6.6.2.8.1.7 "><p id="acl_0001__en-us_topic_0144643910_p967101418517">Denies all inbound traffic.</p>
</td>
</tr>
<tr id="acl_0001__en-us_topic_0144643910_row11671414155113"><td class="cellrowborder" valign="top" width="15.53398058252427%" headers="mcps1.3.7.3.6.6.2.8.1.1 "><p id="acl_0001__en-us_topic_0144643910_p1567121445119">Outbound</p>
</td>
<td class="cellrowborder" valign="top" width="11.650485436893202%" headers="mcps1.3.7.3.6.6.2.8.1.2 "><p id="acl_0001__en-us_topic_0144643910_p2671161475110">*</p>
</td>
<td class="cellrowborder" valign="top" width="10.679611650485436%" headers="mcps1.3.7.3.6.6.2.8.1.3 "><p id="acl_0001__en-us_topic_0144643910_p18671181425114">Deny</p>
</td>
<td class="cellrowborder" valign="top" width="13.59223300970874%" headers="mcps1.3.7.3.6.6.2.8.1.4 "><p id="acl_0001__en-us_topic_0144643910_p667111455114">All</p>
</td>
<td class="cellrowborder" valign="top" width="11.650485436893202%" headers="mcps1.3.7.3.6.6.2.8.1.5 "><p id="acl_0001__en-us_topic_0144643910_p3671114195119">0.0.0.0/0</p>
</td>
<td class="cellrowborder" valign="top" width="18.446601941747574%" headers="mcps1.3.7.3.6.6.2.8.1.6 "><p id="acl_0001__en-us_topic_0144643910_p06711814205118">0.0.0.0/0</p>
</td>
<td class="cellrowborder" valign="top" width="18.446601941747574%" headers="mcps1.3.7.3.6.6.2.8.1.7 "><p id="acl_0001__en-us_topic_0144643910_p17671814105114">Denies all outbound traffic.</p>
</td>
</tr>
</tbody>
</table>
</div>
</li></ul>
</div>
<div class="section" id="acl_0001__en-us_topic_0144643910_section74125695419"><h4 class="sectiontitle">Rule Priorities</h4><ul id="acl_0001__en-us_topic_0144643910_ul2671914175111"><li id="acl_0001__en-us_topic_0144643910_li290111810455">Each <span id="acl_0001__en-us_topic_0144643910_text18509112231513">firewall</span><span id="acl_0001__en-us_topic_0144643910_text1950962261517"></span> rule has a priority value where a smaller value corresponds to a higher priority. Any time two rules conflict, the rule with the higher priority is the one that gets applied. The rule whose priority value is an asterisk (*) has the lowest priority.</li><li id="acl_0001__en-us_topic_0144643910_li167117146513">If multiple <span id="acl_0001__en-us_topic_0144643910_text2596102581517">firewall</span><span id="acl_0001__en-us_topic_0144643910_text15596102571513"></span> rules conflict, only the rule with the highest priority takes effect. If you need a rule to take effect before or after a specific rule, you can insert that rule before or after the specific rule.</li></ul>
</div>
<div class="section" id="acl_0001__en-us_topic_0144643910_section1864416226298"><h4 class="sectiontitle">Application Scenarios</h4><ul id="acl_0001__en-us_topic_0144643910_ul107461633193215"><li id="acl_0001__en-us_topic_0144643910_li174611336324">If the application layer needs to provide services for users, traffic must be allowed to reach the application layer from all IP addresses. However, you also need to prevent illegal access from malicious users.<p id="acl_0001__en-us_topic_0144643910_p75381836122820"><a name="acl_0001__en-us_topic_0144643910_li174611336324"></a><a name="en-us_topic_0144643910_li174611336324"></a>Solution: You can add <span id="acl_0001__en-us_topic_0144643910_text67171932111520">firewall</span><span id="acl_0001__en-us_topic_0144643910_text571818328153"></span> rules to deny access from suspect IP addresses.</p>
</li><li id="acl_0001__en-us_topic_0144643910_li18386203923318">How can I isolate ports with identified vulnerabilities? For example, how do I isolate port 445 that can be exploited by WannaCry worm?<p id="acl_0001__en-us_topic_0144643910_p1653983682815"><a name="acl_0001__en-us_topic_0144643910_li18386203923318"></a><a name="en-us_topic_0144643910_li18386203923318"></a>Solution: You can add <span id="acl_0001__en-us_topic_0144643910_text18921336191512">firewall</span><span id="acl_0001__en-us_topic_0144643910_text1292173681512"></span> rules to deny access traffic from a specific port and protocol, for example, TCP port 445.</p>
</li><li id="acl_0001__en-us_topic_0144643910_li10923457123511">No defense is required for the east-west traffic between subnets, but access control is required for north-south traffic.<p id="acl_0001__en-us_topic_0144643910_p17539173617284"><a name="acl_0001__en-us_topic_0144643910_li10923457123511"></a><a name="en-us_topic_0144643910_li10923457123511"></a>Solution: You can add <span id="acl_0001__en-us_topic_0144643910_text12105466158">firewall</span><span id="acl_0001__en-us_topic_0144643910_text10101946151511"></span> rules to protect north-south traffic.</p>
</li><li id="acl_0001__en-us_topic_0144643910_li14614936123711">For frequently accessed applications, a security rule sequence may need to be adjusted to improve performance.<p id="acl_0001__en-us_topic_0144643910_p15539183632810"><a name="acl_0001__en-us_topic_0144643910_li14614936123711"></a><a name="en-us_topic_0144643910_li14614936123711"></a>Solution: A <span id="acl_0001__en-us_topic_0144643910_text733510502153">firewall</span><span id="acl_0001__en-us_topic_0144643910_text20335115019159"></span> allows you to adjust the rule sequence so that frequently used rules are applied before other rules.</p>
</li></ul>
</div>
<div class="section" id="acl_0001__en-us_topic_0144643910_section14396131910515"><h4 class="sectiontitle">Configuration Procedure</h4><p id="acl_0001__en-us_topic_0144643910_p10538937853"><a href="#acl_0001__en-us_topic_0144643910_fig1643183218163">Figure 2</a> shows the procedure for configuring a <span id="acl_0001__en-us_topic_0144643910_text599516189168">firewall</span><span id="acl_0001__en-us_topic_0144643910_text599512187168"></span>.</p>
<div class="fignone" id="acl_0001__en-us_topic_0144643910_fig1643183218163"><a name="acl_0001__en-us_topic_0144643910_fig1643183218163"></a><a name="en-us_topic_0144643910_fig1643183218163"></a><span class="figcap"><b>Figure 2 </b><span id="acl_0001__en-us_topic_0144643910_text668616281164">firewall</span><span id="acl_0001__en-us_topic_0144643910_text06861728121612"></span> configuration procedure</span><br><span><img class="vsd" id="acl_0001__en-us_topic_0144643910_image49772046165815" src="en-us_image_0162335382.png"></span></div>
<ol id="acl_0001__en-us_topic_0144643910_ol64961250174814"><li id="acl_0001__en-us_topic_0144643910_li1849614505486">Create a <span id="acl_0001__en-us_topic_0144643910_text71827337167">firewall</span><span id="acl_0001__en-us_topic_0144643910_text7183173318168"></span> by following the steps described in <a href="en-us_topic_0051746698.html#en-us_topic_0051746698">Creating a Firewall</a>.</li><li id="acl_0001__en-us_topic_0144643910_li1518417537486">Add <span id="acl_0001__en-us_topic_0144643910_text593833511166">firewall</span><span id="acl_0001__en-us_topic_0144643910_text9938635141617"></span> rules by following the steps described in <a href="en-us_topic_0051746702.html#en-us_topic_0051746702">Adding a Firewall Rule</a>.</li><li id="acl_0001__en-us_topic_0144643910_li2758155517484">Associate subnets with the <span id="acl_0001__en-us_topic_0144643910_text4742139191618">firewall</span><span id="acl_0001__en-us_topic_0144643910_text4742173951610"></span> by following the steps described in <a href="en-us_topic_0051746700.html#en-us_topic_0051746700">Associating Subnets with a Firewall</a>. After subnets are associated with the <span id="acl_0001__en-us_topic_0144643910_text64553435162">firewall</span><span id="acl_0001__en-us_topic_0144643910_text045594311612"></span>, the subnets will be protected by the configured <span id="acl_0001__en-us_topic_0144643910_text13398324163514">firewall</span><span id="acl_0001__en-us_topic_0144643910_text20400182493515"></span> rules.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="vpc_acl_0000.html">Firewall</a></div>
</div>
</div>

203
docs/vpc/umn/acl_0002.html Normal file
View File

File diff suppressed because it is too large Load Diff

BIN
docs/vpc/umn/en-us_image_0000001117669274.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 58 KiB

BIN
docs/vpc/umn/en-us_image_0000001117669524.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 46 KiB

BIN
docs/vpc/umn/en-us_image_0000001151300782.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 7.7 KiB

BIN
docs/vpc/umn/en-us_image_0000001163949251.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 65 KiB

BIN
docs/vpc/umn/en-us_image_0000001166028070.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 40 KiB

BIN
docs/vpc/umn/en-us_image_0000001179761510.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 22 KiB

BIN
docs/vpc/umn/en-us_image_0000001197228903.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 28 KiB

BIN
docs/vpc/umn/en-us_image_0000001197426329.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 7.9 KiB

BIN
docs/vpc/umn/en-us_image_0000001206933138.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 5.9 KiB

BIN
docs/vpc/umn/en-us_image_0000001207093220.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 634 B

BIN
docs/vpc/umn/en-us_image_0000001207253746.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 634 B

BIN
docs/vpc/umn/en-us_image_0000001211006359.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 60 KiB

BIN
docs/vpc/umn/en-us_image_0000001211445065.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 48 KiB

BIN
docs/vpc/umn/en-us_image_0000001222749226.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 391 B

BIN
docs/vpc/umn/en-us_image_0000001222749910.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 391 B

BIN
docs/vpc/umn/en-us_image_0000001225081545.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 17 KiB

BIN
docs/vpc/umn/en-us_image_0000001229959315.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 34 KiB

BIN
docs/vpc/umn/en-us_image_0000001230120807.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 27 KiB

BIN
docs/vpc/umn/en-us_image_0000001237013856.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 13 KiB

BIN
docs/vpc/umn/en-us_image_0000001237328110.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 23 KiB

BIN
docs/vpc/umn/en-us_image_0000001251773147.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 4.6 KiB

BIN
docs/vpc/umn/en-us_image_0000001267230305.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 391 B

BIN
docs/vpc/umn/en-us_image_0000001267350317.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 391 B

BIN
docs/vpc/umn/en-us_image_0000001281210233.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 3.3 KiB

BIN
docs/vpc/umn/en-us_image_0000001286573614.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 7.7 KiB

BIN
docs/vpc/umn/en-us_image_0000001338933333.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1004 B

BIN
docs/vpc/umn/en-us_image_0093507575.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1004 B

BIN
docs/vpc/umn/en-us_image_0118498947.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 29 KiB

BIN
docs/vpc/umn/en-us_image_0118498992.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 5.9 KiB

BIN
docs/vpc/umn/en-us_image_0118499109.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 11 KiB

BIN
docs/vpc/umn/en-us_image_0118499140.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 13 KiB

BIN
docs/vpc/umn/en-us_image_0118499144.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 39 KiB

BIN
docs/vpc/umn/en-us_image_0122999741.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 18 KiB

BIN
docs/vpc/umn/en-us_image_0129304042.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 12 KiB

BIN
docs/vpc/umn/en-us_image_0129473334.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 10 KiB

Some files were not shown because too many files have changed in this diff Show More