ZStack Cloud provides security group control for the VM instances on L3 networks, effectively filtering TCP/UDP/ICMP data packets, and controlling specified VM NIC according to the security rules.

ZStack Cloud allows you to configure firewalls for VPC vRouters. After you create a VPC firewall, the system will automatically configure the ingress rule set for the VPC vRouter. The egress rule set is configured flexibly by yourself. You can configure one rule set for each interface direction of the VPC vRouter, which is used to filter the north-south traffic at its interface, and effectively ensures the VPC vRouter security and the communication security of the VPC network. The firewall works together with the security group, which is working on the VM NIC, and focusing on the east-west communication security of the VPC.

ZStack Cloud supports the feature of VPC vRouter HA group. You can deploy two VPC vRouters in a VPC vRouter HA group. Either of them can act as a primary or secondary VPC vRouter in the group. If the primary VPC vRouter does not work as expected, the other one will automatically replace it as the primary VPC vRouter within seconds, thus ensuring the business stability.