[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-04-30。"],[[["\u003cp\u003eRegional network firewall policies enforce consistent firewall rules across all subnetworks within a specific region in a VPC network.\u003c/p\u003e\n"],["\u003cp\u003eThese policies are containers for firewall rules, which are not enforced until the policy is associated with a VPC network.\u003c/p\u003e\n"],["\u003cp\u003eA single regional network firewall policy can be associated with multiple VPC networks, and changes to the rules within the policy will apply to all associated networks.\u003c/p\u003e\n"],["\u003cp\u003eRegional network firewall rules are unique to the region they're created in and their evaluation order is based on priority, with lower numbers indicating higher priority, and they are always evaluated after global network policies.\u003c/p\u003e\n"],["\u003cp\u003eRegional network firewall policies do not support Layer 7 inspection, but they do support Tags in firewall rules, and include predefined rules that handle connections that don't match explicitly defined rules.\u003c/p\u003e\n"]]],[],null,["# Regional network firewall policies\n\n*Regional network firewall policies* let you create and enforce a consistent\nfirewall policy across all subnetworks within a region in your\nVPC network. You can assign regional\nnetwork firewall policies to a VPC network. These policies\ncontain rules that can explicitly deny or allow connections, or go to the next\nlevel of the hierarchy.\n\nSpecifications\n--------------\n\n- Regional network firewall policies are mostly similar to the global network firewall policies.The regional network firewall policies have one and only one target region, while the global network firewall policies apply automatically to all regions.\n- Regional network firewall policies are created at the VPC level. Creating a policy does not automatically apply the rules to the network.\n- Policies, once created, can be applied to (*associated* with) any VPC network in your project.\n- Regional network firewall policies are containers for firewall rules. When you associate a policy with the VPC network, all rules are immediately applied.\n- You can *associate* the same regional network firewall policy to multiple VPC networks in a project.\n- Regional network firewall policies do not support Layer 7 inspection.\n- Regional network firewall policies support Tags in firewall rules. For more details, see [Create and manage secure tags](/firewall/docs/use-tags-for-firewalls).\n- You can create regional network firewall policies with a firewall policy type set to `RDMA_ROCE_POLICY` so that you can use them with RoCE VPC networks. For more information, see [Cloud Next Generation Firewall for RoCE VPC networks](/firewall/docs/firewall-for-roce).\n\nRegional network firewall policy details\n----------------------------------------\n\nRegional network firewall policy rules are defined in a firewall policy resource\nthat acts as a container for firewall rules. The rules defined in a regional\nnetwork firewall policy are not enforced until the policy is associated with a\nVPC network.\n\nA single policy can be associated with multiple VPC networks. If\nyou modify a rule in a policy, that rule change applies to all\nassociated networks.\n\nIn a specific region, only one regional network firewall policy can be\nassociated with a network. Global network firewall policy rules,\nVPC firewall rules, and regional network firewall policy rules\nare [evaluated in a well-defined order](/firewall/docs/firewall-policies-overview#rule-evaluation).\n\nA firewall policy that is not associated with any networks is an *unassociated*\nregional network firewall policy.\n\nRegional network firewall policy rule details\n---------------------------------------------\n\nRegional network firewall policies contain rules that generally work the same as\n[network firewall policy rules](/firewall/docs/network-firewall-policies), but there\nare a few differences:\n\n- **Regional enforcement:** The regional network firewall policy rules\n are only applicable to the region where the regional network firewall\n policy is created.\n\n- **Priority order:** You must specify priorities while creating the\n regional network firewall policy rules. These priorities are unique and only significant within\n a regional network firewall policy.\n\n Rule evaluation order is determined by the rule priority, from the lowest\n number to the highest number. The rule\n with the lowest numeric value assigned has the highest logical priority and\n is evaluated before rules with lower logical priorities. The priority of a\n rule decreases as its number\n increases (1, 2, 3, N+1). You cannot configure two or more rules with the\n same priority.\n\n The priority for each rule must be set to a number from 0 to\n 2147483547 inclusive. The minimum numeric priority is 0.\n The priority values from 2147483548 (INT-MAX-99) to\n 2147483647 (INT-MAX) are reserved for system default firewall rules.\n- **Evaluation order:** Regional network firewall policies are always evaluated\n after global network firewall policies. By default, VPC\n firewall rules are\n evaluated before global and regional network firewall policies. You can\n also customize the rule evaluation order to enforce the global network\n firewall policies before or after the VPC firewall rules.\n\nThe regional network firewall policy rules also include source and target\nsecure tags.\n\nPredefined rules\n----------------\n\nWhen you create a regional network firewall policy, Cloud Next Generation Firewall adds\npredefined rules with the lowest priority to the policy. These rules are applied\nto any connections that don't match an explicitly defined rule in the policy,\ncausing such connections to be passed down to lower-level policies or network rules.\n\nTo learn about the various types of predefined\nrules and their characteristics, see [Predefined rules](/firewall/docs/firewall-policies-overview#pre-defined-rules).\n\nIdentity and Access Management (IAM) roles\n------------------------------------------\n\nFor details about IAM roles that govern the actions to create and manage\nregional network firewall policies, see [Use regional network firewall policies](/firewall/docs/use-regional-firewall-policies)."]]
