Single service comparison

GCP enforces firewall rules in the hypervisor at each VM NIC, so there is no single inspection appliance, throughput limit, or failover domain to size; protection scales with the fleet. Huawei CFW is a centralized next-generation firewall inspected at the Internet border and inter-VPC (ER) boundaries, with per-edition traffic caps (e.g. 50 Mbit/s Internet border, 200 Mbit/s inter-VPC, scalable to 200 Gbit/s). CFW adds IPS, antivirus, reverse-shell detection and custom signatures that GCP VPC Firewall Rules lack, but CFW east-west coverage requires steering VPC traffic through the CFW boundary rather than native per-VM enforcement.

GCP rules are managed through the VPC Firewall API/CLI/Terraform as priority-ordered 5-tuple allow/deny rules targeting tags or service accounts; IAM controls who writes them, and Cloud Logging/Logging-sink plus VPC Flow Logs observe them. Huawei CFW policies are managed in the CFW console/API as ACL groups, IPS profiles, and NAT egress rules, with CTS auditing and LTS/SecMaster log pipelines. The data models differ: GCP maps identity (service accounts) and labels to enforcement, while CFW maps IP ranges, domain names, and geography to centralized inspection points, so rule translation is not one-to-one.

DDoS handled by GCP is implicit and cloud-managed at the edge (no separate rule object), whereas Huawei splits volumetric defense into Anti-DDoS Service (AAD) with high-defense IPs and scrubbing centers. AAD is a distinct subscription, not part of CFW, and protects against SYN/ACK/UDP/ICMP floods plus CC attacks. Architects must therefore compose CFW (policy/IPS/segmentation) and AAD (volumetric DDoS) to approximate GCP's combined default-edge protection plus distributed firewall model; the two Huawei services are not interchangeable and are billed separately.

Start with assessment: export GCP firewall rules and VPC topology, classify ingress/egress intent by source/destination, tag/service-account targets, and priority. Choose target by workload variant: pure east-west segmentation between VPCs and Internet-border IPS maps to CFW (Professional edition for inter-VPC protection); volumetric or application-layer DDoS exposure on public endpoints maps to AAD high-defense IPs. Do not assume one service covers both; CFW does not scrub Tbit/s floods and AAD does not enforce inter-VPC ACLs. Confirm CFW regional availability and edition quotas (protected EIPs, VPCs, peak bandwidth) for the target regions before design.

Re-architect enforcement points: GCP's per-VM distributed model must be re-expressed as boundary policies. Route Internet-facing EIPs through CFW for north-south inspection and enable IPS; use Enterprise Router or VPC peering plus CFW VPC-border firewall for east-west control. Replace service-account/tag targeting with IP range, domain, and geography ACLs, and use CTS for change audit and LTS for flow logs in place of VPC Flow Logs. For AAD, point public DNS to high-defense IPs and configure forwarding to the origin EIP/ELB so traffic is scrubbed before reaching CFW.

Migrate configuration iteratively rather than via an automated import: there is no documented one-click GCP-to-CFW converter, so each rule group must be transcribed, re-prioritized within CFW ACL limits (up to ~20,000 ACLs), and validated against a mirror or test VPC. Use CFW's policy import for native format only; from GCP you will author rules manually. Run CFW in audit-only mode initially to baseline allowed/denied flows against current GCP Flow Logs so regressions surface before enforcement flips to deny.

Validate and cutover with parity testing: generate representative north-south and east-west traffic, confirm CFW access logs match expected allow/deny outcomes, and run an AAD test or review scrubbing thresholds. Watch the billing model shift-GCP firewall rules are free (you pay only for Flow Logs), while CFW is edition-priced per month plus expandable EIP/VPC/bandwidth add-ons, and AAD is billed by high-defense IP and scrubbing traffic. Recalculate TCO with peak traffic, protected-asset count, and log retention, then flip enforcement and remove legacy GPC rules post stabilization.