Agent skill · aliyun
alibabacloud-cfw-nat-firewall-protect
Manage Alibaba Cloud Firewall (CFW) NAT Firewall (NAT boundary firewall): query firewalls and protection status, enable/disable the protection switch, assess which NAT gateways can be protected and produce a plan, run the creation pre-check, diagnose route-entry inconsistency (route-diff), prepare manual-mode diversion assets, create a firewall (auto or manual vswitch diversion), and change engine strict mode. Deleting/releasing a firewall is NOT supported: protection can be switched off, but the resource must be released by the user in the console. Use when users mention NAT firewall, NAT boundary firewall, NAT gateway protection, protecting private-network outbound traffic, opening/closing the NAT firewall switch, assessing how to enable protection, or diagnosing creation failures from inconsistent custom route entries. 管理阿里云云防火墙（CFW）NAT边界防火墙：查询防火墙与防护状态、开启/关闭防护开关、开墙评估与开墙方案、 创建预检查、路由条目不一致诊断、手动引流准备、创建NAT防火墙、修改引擎模式。不支持删除/释放防火墙， 需用户在控制台自行操作。适用于NAT防火墙、NAT网关防护、私网出方向防护、开关NAT墙、开墙评估等场景。
What it needs
About 11k tokens when loaded.
What this skill does
Operation Routing Identify the user's intent, then route to the matching execution path: User Intent Execution Path --- --- Query NAT firewall list / which NAT gateways are protected nat-fw-switch.sh query with filters Which NAT gateways are unprotected, and how should I protect them? nat-fw-lifecycle.sh assess (read-only assessment + per-gateway recommendation) Can THIS NAT gateway be protected? Give me the enablement plan nat-fw-lifecycle.sh assess --nat-gateway-id <id> (adds the server pre-check + a ready-to-run plan) Enable/disable protection for specific NAT firewalls nat-fw-switch.sh enable/disable --proxy-ids "..." (three-phase workflow below) Check whether a NAT gateway can have a NAT firewall created nat-fw-lifecycle.sh precheck Query NAT firewall authorization quota nat-fw-lifecycle.sh quota Diagnose inconsistent custom route entries (creation failed with ErrorNatCustomRouteEntryDifferent, or assess warned about it) nat-fw-lifecycle.sh route-diff (read-only per-table diff + alignment plan; NEVER modifies routes) Prepare manual-mode assets (vswitch + custom route table) nat-fw-lifecycle.sh prepare (idempotent; reuses qualifying assets) Create a NAT firewall for a NAT gateway Creation workflow: assess -> quota -> precheck -> nat-fw-lifecycle.sh create Delete / release a NAT firewall NOT SUPPORTED - releasing the resource is the user's own action. Offer nat-fw-switch.sh disable to stop protection instead, and point to the Cloud Firewall console (NAT Boundary Firewall -> Delete) for the actual release. nat-fw-lifecycle.sh delete only prints this guidance plus a read-only impact report Rename a NAT firewall / change loose-strict engine mode nat-fw-lifecycle.sh update (built-in verification runs automatically) Key concept: one NAT gateway maps to exactly one NAT firewall. The firewall must be created before its switch can be toggled. Status normal means the switch is open (protecting); closed means the switch is off. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aliyun/alibabacloud-cfw-nat-firewall-protect