Security groups provide layer-3 network security control for VM instances, effectively filtering TCP/UDP/ICMP packets at the ingress and egress points of the NIC based on specified security rules.

The Cloud supports configuring firewalls for VPC vRouters. After a VPC firewall is created, the system automatically configures an ingress rule set for the VPC vRouter, and you can flexibly configure the egress rule set. Each interface direction of a VPC vRouter only allows the application of one rule set. By filtering north-south traffic at the VPC vRouter interfaces, the VPC firewall effectively protects the communication security of the entire VPC and the VPC vRouter security. The VPC firewall complements security groups, which act on VM virtual NICs and focus on protecting east-west communication security within the VPC.

The Cloud supports the VPC vRouter high availability (HA) group feature. You can deploy a pair of active-standby VPC vRouters in a VPC vRouter HA group. If the primary VPC vRouter becomes abnormal, an HA switchover is triggered within seconds, automatically switching to the secondary VPC vRouter to ensure continuous and stable business operation.