Billing Overview
Last updated:2025-12-19 15:43:43
Tencent Cloud Firewall provides users with three paid editions: Premium Edition, Enterprise Edition, and Ultimate Edition. Each edition is categorized based on feature modules and default specifications to accommodate customers with different asset scales and requirement types. The Premium, Enterprise, and Ultimate editions support elastic scaling based on performance specifications and asset scale. The billing details are as follows:
Note:
Please confirm the edition to be purchased before buying. Currently, CFW does not support downgrading.
Enterprise Security Group currently supports all editions. Some editions will not be supported in the future. (If adjustments are required, Tencent Cloud will provide advance notice as agreed, and such adjustments will not affect existing customers; you can continue to use it within the service period.)
Billing related | Premium Edition | Enterprise Edition | Ultimate Edition | Elastic scaling |
Billing Mode | Yearly/monthly subscription | Yearly/monthly subscription | Yearly/monthly subscription | Not supported |
Base price | 420 USD/month | 1450 USD/month | 3900 USD/month | Not supported |
Available purchase duration | 1 month, 3 months, 6 months, 1 year, 2 years, 3 years | | | Not supported |
Discount | Purchase for 6 months or less: Original price Purchase 1 year: 15% off Purchase 2 years: 30% off Purchase 3 years: 50% off | | | Not supported |
North-South Bandwidth: Can be allocated to serial firewalls for the Internet boundary and NAT Firewalls | Default 20Mbps, scalable to 200Mbps | Default 100Mbps, scalable to 1Gbps | Default 300Mbps, scalable to 60Gbps | Prepaid scaling: USD 16/Mbps/month |
| | | | Postpaid scaling: elastic protection for NAT Border Firewall at USD 2.41/Mbps/day Note: |
Public IP address quantity | 10 | 50 | 200 | For every 1Mbps scaled in North-South Bandwidth, the number of public IP addresses supported increases by one. |
Number of general instances: Can be used to create Internet serial Firewall, NAT Border Firewall Instance, and VPC Border Firewall instances | 1 | 2 | 3 partitions | Supports scaling, USD 430 / unit / month |
Number of Access Control Rules: Can be used to create Internet Border Firewall, NAT Border Firewall, and VPC Border Firewall Access Control rules. | Internet Border Firewall, NAT Border Firewall, and VPC Border Firewall each have 1000 rules. | Internet Border Firewall, NAT Border Firewall, and VPC Border Firewall each have 2000 rules. | Internet Border Firewall, NAT Border Firewall, and VPC Border Firewall each have 5000 rules. | Internet Border Firewall Access Control rules, NAT Border Firewall Access Control rules, VPC Border Firewall Access Control rules, Intrusion Defense blocklist number of blocked IP addresses, Intrusion Defense allowlist strategy, and Enterprise Security Group number of scaling rules at USD 0.2 / rule / month, supports purchasing CFW general rule extensions. |
Intrusion Defense blocklist number of blocked IP addresses | 4,000 entries | 10,000 entries | 20,000 entries | |
Intrusion Defense allowlist strategy | 4,000 entries | 10,000 entries | 20,000 entries | |
Enterprise-grade Security Group | 100 entries | 1,000 entries | 2,000 entries | |
Geo-blocking for Internet Access Control | Not supported | Supported | Supported | Not supported |
bandwidth for the VPC Border Firewall | Not supported | Default 100Mbps, scalable up to 200Gbps+1000Mbps | Default 300Mbps, scalable up to 200Gbps+1000Mbps | Prepaid scaling: Expand 10Mbps for the VPC Border Firewall: USD 12/month Expand 1Gbps for the VPC Border Firewall: 749 USD/month |
| | | | Postpaid scaling: Elastic Protection for VPC Border Firewall 0.09 USD/Mbps/day Note: Firewall instances below 1Gbps are lightweight instances and do not include the feature of Intrusion Defense. Postpaid scaling feature requires submitting a ticket for application. |
Network Detection and Response | Not supported | Supported | Supported | Prepaid scaling: Scaling All traffic detection and response (NDR) to 1 Gbps: USD 833/month |
| | | | Postpaid scaling: Elastic Analysis: USD 83.3/Gbps/day |
Log analysis | CFW stores logs by default for 7 days with 50 GB. If you need to store logs for a longer period or meet compliance requirements, you need to enable the Log Analysis feature. The Log Analysis feature costs USD 99/set/month and includes 1000 GB of log storage. | | | Not supported |
Log storage (Scalable after Log analysis is purchased) | Scalable storage range: 1000~100000 GB | Scalable storage range: 3000~100000 GB | Scalable storage range: 5000-100000 GB | Prepaid scaling: Scaling for Log storage: USD 0.13/GB/month |
| | | | Postpaid scaling: 0 - 5120 GB (inclusive of 5120): USD 0.006/GB/day Above 5120 GB: USD 0.004/GB/day |
Traffic Visualization | Supported | Supported | Supported | Not supported |
Intrusion Defense (IPS) (Intelligently blocks intrusive activities) | Supported | Supported | Supported | Not supported |
Address Template | 10 | 10 | 10 | Quantity of extension templates: USD 4.8 / unit / month |
Integration of Threat Intelligence (Automatically blocks malicious outbound connections) | Supported | Supported | Supported | Not supported |
Security baseline | Not supported | Not supported | Supported | Not supported |
Network honeypot | Supported, expandable after the main package is purchased, priced at $99/unit/month. | | | Not supported |
After you have successfully purchased CFW, you can use it in the following ways:
Method 1: Log in to CFW console to perform operations.
Method 2: Access via API. For details, see Firewall Introduction.
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No
Feedback