Global network firewall policies (original) (raw)

Global network firewall policies enable you to batch update all firewall rules by grouping them into a single policy object. You can assign network firewall policies to a Virtual Private Cloud (VPC) network. These policies contain rules that can explicitly deny or allow connections.

Specifications

• Global network firewall policies are container resources for firewall rules. Each global network firewall policy resource is defined within a project.
  • After you create a global network firewall policy, you can add, update, and delete firewall rules in the policy.
  • For specification information about the rules in global network firewall policies, see Firewall policy rule components.
• To apply global network firewall policy rules to a VPC network, you must associate the firewall policy with that VPC network.
  • You can associate a global network firewall policy with multiple VPC networks. Make sure that the firewall policy and the associated networks belong to the same project.
  • Each VPC network can be associated with only one global network firewall policy.
  • If the firewall policy isn't associated with any VPC network, the rules in that policy have no effect. A firewall policy that is not associated with any network is an unassociated global network firewall policy.
• When a global network firewall policy is associated with one or more VPC networks, the firewall policy rules are enforced in the following ways:
  • Existing rules are enforced against applicable resources in the associated VPC networks.
  • Any changes made to the rules are enforced against applicable resources in the associated VPC networks.
• Rules in global network firewall policies are enforced along with other firewall rules as described in Policy and rule evaluation order.
• Use global network firewall policy rules to configure Layer 7 inspection of matched traffic, such as when using theURL filtering service or theintrusion detection and prevention service.
  You create a firewall policy rule with apply_security_profile_groupaction and name of the security profile group. The traffic matching the firewall policy rule is transparently forwarded to the firewall endpoint for Layer 7 inspection. To learn how create a firewall policy rule, see Create a rule.

Global network firewall policy rule details

For more information about the components and parameters of rules in a global network firewall policy, see Firewall policy rule components.

The following table summarizes key differences between global network firewall policy rules and VPC firewall rules:

Predefined rules

When you create a global network firewall policy, Cloud Next Generation Firewall adds predefined rules with the lowest priority to the policy. These rules are applied to any connections that don't match an explicitly defined rule in the policy, causing such connections to be passed down to lower-level policies or network rules.

To learn about the various types of predefined rules and their characteristics, see Predefined rules for firewall policies.

Identity and Access Management (IAM) roles

IAM roles govern the following actions with regard to global network firewall policies:

• Creating a global network firewall policy
• Associating a policy with a network
• Modifying an existing policy
• Viewing the effective firewall rules for a particular network or VM

The following table describes which roles are necessary for each action:

The following roles are relevant to global network firewall policies.