Virtual appliance collector pools are scalable groups of network virtual appliances (NVAs) deployed to receive and analyze cloned network traffic without disrupting production workloads. In Google Cloud, out-of-band packet inspection uses VPC Packet Mirroring to clone traffic from virtual machine instances and forward it to an internal passthrough Network Load Balancer. This load balancer then distributes the captured packets across a backend group of NVAs running on Compute Engine instances, allowing security tools like intrusion detection systems to operate out of band and scale dynamically to handle high network throughput.
The internal passthrough Network Load Balancer acts as the central traffic collector and distributor for the virtual appliance instances. Its backend service must be configured with a protocol of UDP or UNSPECIFIED to accept raw network flows. When receiving GENEVE-encapsulated traffic from packet mirroring, the load balancer's forwarding rule must use the UDP protocol on destination port 6081. Each NVA's network interface must be in the same Virtual Private Cloud (VPC) network as the load balancer's backend service. This setup ensures mirrored traffic flows to the appliances while preserving the original packet's source and destination details for full visibility.
Managed instance groups (MIGs) provide the elasticity and redundancy needed to scale collector appliance pools horizontally as traffic increases. To prevent performance bottlenecks and packet drops, NVAs are deployed into autoscaled MIGs behind the internal passthrough Network Load Balancer. For fault isolation, teams deploy zonal MIGs within each specific zone where inspection is required. Administrators must size the NVA instances with sufficient CPU, memory, and network bandwidth to handle peak mirrored traffic. If an appliance needs to connect to multiple networks, each interface must attach to a separate VPC network, and IP forwarding must be enabled on the instance to allow packet forwarding.
Custom health checks ensure high availability by directing traffic only to functioning NVA instances. The internal passthrough Network Load Balancer continuously monitors appliance health using protocols like TCP or HTTP, automatically removing unhealthy VMs from the distribution pool to prevent packet loss. VPC firewall rules must include ingress allow rules for Google Cloud's health-checking probe IP ranges: 35.191.0.0/16 and 130.211.0.0/22. For increased availability, administrators can configure failover backend services on the load balancer. When inspecting bidirectional traffic flows, the load balancer uses symmetric hashing by default to ensure related traffic consistently routes to the same backend NVA.
VPC Packet Mirroring is a Google Cloud service that copies network packets from a source VPC network to a collector appliance for out-of-band security inspection. This enables threat detection and forensic analysis without impacting the original production traffic flow.
A Packet Mirroring policy is the rule that defines which traffic to copy and where to send it. You create this policy in the consumer VPC network, which is the network whose traffic you want to inspect. The policy has three key parts: a collector, filters, and mirrored resources. The collector is the destination, specified as the IP address of an internal passthrough Network Load Balancer that fronts your security appliance backends. The filters let you select traffic by protocol, IP address ranges (CIDR), and direction (ingress or egress). The mirrored resources define the source instances, either by specifying entire subnets or by using network tags applied to individual VMs.
The collector infrastructure receives and processes the mirrored traffic. Its core is an internal passthrough Network Load Balancer deployed in a separate producer VPC network. This load balancer distributes the GENEVE-encapsulated mirrored packets across a backend group of self-managed network virtual appliances (NVAs), such as intrusion detection systems. Each appliance decapsulates the GENEVE packet to extract the original mirrored packet for deep inspection. For performance and cost, the architecture uses zonal mirroring deployments; the load balancer's forwarding rule and the backend NVAs must be in the same zone as the source VM, otherwise the packet is not mirrored.
The mirroring process follows a specific order. First, a packet from a source VM is evaluated against the VPC's standard firewall rules. If allowed, it is then evaluated against any mirroring rules in a global network firewall policy. If a packet matches a mirroring rule with a MIRROR action, a replica is created. This replica is encapsulated inside a new GENEVE packet, with the outer destination IP set to the load balancer's IP and the destination UDP port set to 6081. The encapsulated packet is sent directly to the internal passthrough Network Load Balancer (in direct mode) or first to a Google-managed mirroring endpoint (in broker mode). Finally, the load balancer forwards the packet to a backend NVA for decapsulation and inspection.
Out-of-band network security integration copies production traffic from a consumer VPC network to a producer VPC network for inspection by security appliances. This approach uses VPC Packet Mirroring to create replica packets that are analyzed for threats while maintaining production workload performance.
Traffic mirroring begins when a VM instance in the consumer VPC sends or receives a packet that matches a mirroring firewall rule with the MIRROR action. This rule references a security profile group containing a security profile of type CUSTOM_MIRRORING, which points to a mirroring endpoint group. For each matching packet, a replica is created and encapsulated using the GENEVE protocol, using UDP port 6081. In direct mode, the global mirroring endpoint group references a deployment group in the producer network. If a deployment exists in the same zone as the packet origin, the IP address of an internal passthrough Network Load Balancer is used as the destination. The load balancer then distributes packets to backend NVAs, which decapsulate the GENEVE packet and perform deep packet inspection on the original traffic.
Mirroring rules reference security profiles within security profile groups to implement deep packet inspection. A security profile specifies the mirroring endpoint group that receives the traffic, and for broker mode, also lists the authorized mirroring deployment groups. These profiles and profile groups are organizational-level and project-level resources, meaning they can be created at the organization level and referenced by projects throughout the organization. When creating a mirroring rule, the security profile group is associated with the rule, and matching traffic is mirrored to the endpoint group referenced by the security profile.
Network firewall policies in the consumer VPC select traffic for mirroring through mirroring rules, which are evaluated separately from standard firewall policy rules. Mirroring rules support three actions: MIRROR permits mirroring and stops evaluation, DO_NOT_MIRROR disallows mirroring and stops evaluation, and GOTO_NEXT delegates evaluation to lower priority rules. For ingress traffic, standard firewall rules are evaluated first, and only allowed traffic is then evaluated against mirroring rules. For egress traffic, mirroring rules are evaluated first. Mirroring rules are evaluated in descending order of priority, with priority 0 being the highest, and each rule within a firewall policy must have a unique priority.
Cloud IDS is a Google-managed intrusion detection service that provides threat detection by creating a Google-managed peered network with mirrored VM instances. It works by mirroring traffic from the consumer VPC to Google-managed IDS VMs, where advanced threat detection technologies analyze the traffic. Each IDS endpoint can inspect traffic from any zone in its region, with a maximum inspection capacity of 5 Gbps per endpoint and support for traffic spikes up to 17 Gbps. Cloud IDS supports filtering traffic based on protocol, IP range, or direction, providing visibility into both north-south and east-west traffic to detect lateral movement. The service includes application identification and configurable threat severity levels.
Security telemetry from Cloud IDS and packet mirroring deployments can be exported to centralized Security Information and Event Management (SIEM) platforms through Cloud Logging. Threat logs generated by Cloud IDS are stored in Cloud Logging and can be accessed or exported to external SIEM systems for correlation with other security events. Organizations can configure log sinks to forward these security events to their SIEM platforms, enabling centralized security monitoring and incident response.
StudyCerts
StudyCertsUDP or UNSPECIFIED protocol and use destination port 6081 for GENEVE-encapsulated traffic.MIRROR, DO_NOT_MIRROR, and GOTO_NEXT to control which traffic is copied for security analysis.The consumer VPC is the source network whose traffic is being copied for inspection. The producer VPC is the separate network that hosts the collector infrastructure, including the internal passthrough Network Load Balancer and the backend network virtual appliances (NVAs) that analyze the mirrored traffic.
Use a zonal managed instance group (MIG) when you require fault isolation within a specific zone or when your Packet Mirroring deployment is zonal. The internal passthrough Network Load Balancer and its backend NVAs must be in the same zone as the source VM's traffic capture point for the packets to be successfully mirrored and processed.
Cloud IDS is a fully Google-managed intrusion detection service where Google provisions and manages the inspection endpoints, simplifying operations. A self-managed NVA solution using Packet Mirroring gives you full control over the choice of security appliance, its configuration, and scaling, but requires you to manage the underlying Compute Engine instances and software.
GENEVE encapsulation wraps the original mirrored packet inside a new packet header. This allows the mirrored traffic to be routed to the collector infrastructure (the load balancer) without interfering with the original packet's path. The backend network virtual appliance must decapsulate this GENEVE packet to access and inspect the original traffic.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills