Sunday, February 4, 2024

Tencent Cloud CVM bypass Cloud Firewall (CFW) to access Internet directly

If a CVM being assigned a Public Internet IP address, it will bypass the Cloud Firewall to access Internet directly. There are several method to control:

Disable Tencent user account able to assign public IP addresses to CVM by using Tencent account's Cloud Access Management - Polices. Create a policy on CVM to deny "AdjustPublicAddress", "AllocateAddresses" and "AssociateAddress"
Use "security group" on each CVM to block external connection on port level

Fortinet Fortigate Firewall on Public Cloud

On Alicloud:

4 vCPU license is minimum requirement since the setup on alicloud is required 2vCPU per 1 network port. Since firewall is required 2 network port, you need to have 4 vCPU license.

On Tencent Cloud:

No such requirement, you can start from 2 vCPU license.

H3C firewall considersation

Copy firewall rule will go to the last firewall rule (the button of the rule set), when you have few hundred firewall rule, administration will be painful.
Traffic log need local harddisk of the firewall, syslog cannot cover. Need to aware to buy firewall with local harddisk.

Hillstone Firewall Pros and Cons

Hillstone Firewall:

Pros: 1. Routing function is very good even can used for replace a router

2. Easy to administration

3. Strong customer support

4. Cost effective and also fit for inner firewall or network segmentation or segregation

5. Fast respond to vulnerability

Cons: 1. Their next generation firewall features are not good enough when compared to Palo Alto (PA), Fortinet...such as SSL proxy, App-ID, decryption, web url category and filtering...DLP integration, user identification and reporting.