Cloud Next Generation Firewall (Cloud NGFW) Essentials provides foundational Layer 3 and Layer 4 stateful traffic controls for workloads across a Virtual Private Cloud (VPC) network. Hierarchical firewall policies attach to organization or folder nodes in the resource hierarchy to enforce mandatory rules that lower-level projects cannot override. These hierarchical policies can pass traffic evaluation down to lower-level policies by specifying a goto_next action. At the network level, global network firewall policies apply rules across all regions for an associated VPC, whereas regional network firewall policies enforce rules only within a specific region.
Secure tags enable firewall policies to control traffic based on workload identity and centralized Identity and Access Management (IAM) governance rather than static IP addresses. Unlike legacy network tags that use unmanaged text strings, secure tags use unique identifiers with strict IAM access controls to prevent unauthorized modification. These tags function across VPC Network Peering connections to enforce intra-subnet micro-segmentation that automatically attaches to virtual machine (VM) instances. Alongside firewall policies, legacy VPC firewall rules enforce stateful filtering directly on individual VM instances within a single VPC network, but they cannot be shared across peered networks.
The firewall rule evaluation order processes network connections through a strict sequence of policy layers using the default AFTER_CLASSIC_FIREWALL enforcement mode. Traffic evaluation begins at organization-level hierarchical firewall policies, descends through folder-level hierarchical policies, moves to global network firewall policies, continues to regional network firewall policies, and then evaluates VPC firewall rules. Within each layer, Cloud NGFW filters rules by target resource and traffic direction before evaluating the remaining rules from highest priority (lowest number) to lowest priority (highest number). Evaluation halts as soon as a rule matches with an action like allow, deny, or apply_security_profile_group, while unmatched connections trigger an implied goto_next action that passes evaluation to the next layer.
Fully qualified domain name filtering (FQDN filtering) in Cloud NGFW Standard inspects egress traffic to allow or deny outbound connections based on target domain names instead of static IP addresses. When a client VM initiates an outbound request, the global network firewall policy evaluates the destination against configured FQDN objects. If the traffic matches an approved FQDN object in an allow rule, the connection passes outward to the external endpoint through Cloud NAT or an external IP address. Administrators commonly combine FQDN allow rules with a lower-priority egress rule blocking all other traffic (0.0.0.0/0) to prevent unauthorized data exfiltration.
Google Cloud Threat Intelligence and geolocation matching allow firewall policies to dynamically filter traffic using curated threat feeds and geographic country codes. Google continuously updates threat intelligence lists with known malicious IP addresses, botnet command nodes, and crypto-mining endpoints identified by security research teams. Geolocation filtering evaluates packet metadata against specific country codes to enforce strict data residency or geographic network boundaries. When inbound or outbound packets arrive at the VPC boundary, the Cloud NGFW engine compares the packet metadata against these lists and drops unauthorized packets at the network edge before they reach internal workloads.
A global network firewall policy serves as the central container resource for grouping and managing advanced Cloud NGFW Standard rules across VPC networks. The Standard tier relies on both the compute.googleapis.com and networksecurity.googleapis.com global API endpoints to configure and enforce policy rules. A single global network firewall policy can be associated with multiple VPC networks within the same project, but each individual VPC network can associate with only one global policy at a time. The firewall engine processes user-defined rules sequentially from highest priority to lowest priority, falling back to predefined lowest-priority rules only when no custom rule matches the traffic.
Cloud NGFW Enterprise delivers Layer 7 deep packet inspection and a managed Intrusion Prevention Service (IPS) using dedicated, Google-managed firewall endpoints. To inspect traffic transparently without requiring changes to network routing or compute workloads, Cloud NGFW Enterprise provisions a firewall endpoint as a Google-managed zonal resource. The local firewall endpoint uses packet interception technology to scan Layer 7 traffic against threat signatures powered by Palo Alto Networks. These threat signatures identify application-level exploits, including spyware, vulnerabilities, and command-and-control activity, and execute configured mitigation actions such as alert, allow, or deny.
Transport Layer Security (TLS) inspection in Cloud NGFW Enterprise decrypts encrypted network traffic to allow deep packet scanning of hidden threats before re-encrypting the payload. Administrators configure inspection parameters by creating a security profile of the threat-prevention type and grouping it inside a security profile group. To enable TLS forward proxy capabilities, an administrator creates a Certificate Authority (CA) pool, defines a trust configuration, and references them within a TLS inspection policy. When this TLS inspection policy is attached to a firewall endpoint association, the endpoint decrypts inbound and outbound TLS sessions, scans the cleartext payload against threat rules, and re-encrypts the session before it reaches the final destination.
Deploying Cloud NGFW Enterprise inspection requires a strict sequence of component provisioning and policy associations across the network hierarchy. Administrators first create the threat-prevention security profile and security profile group, followed by the CA pool and TLS inspection policy. Next, the administrator provisions a zonal firewall endpoint in the same zone as the target workloads and associates that endpoint with the VPC network alongside the TLS inspection policy. Finally, a rule is added to a global network firewall policy or hierarchical firewall policy using the apply_security_profile_group action and the --tls-inspect flag to redirect matched workload traffic to the zonal firewall endpoint for scanning.
Cloud NGFW Standard adds edge filtering using domain names (FQDNs), geolocation objects, and Google Cloud Threat Intelligence lists at Layers 3 and 4. Cloud NGFW Enterprise adds Layer 7 deep packet inspection, TLS forward proxy decryption, and managed intrusion prevention using zonal firewall endpoints.
Secure tags are centrally managed objects governed by Identity and Access Management (IAM) permissions and unique resource identifiers, whereas standard network tags are simple text strings without access controls. Secure tags allow firewall policies to enforce micro-segmentation across peered VPC networks based on workload identity rather than IP addresses.
Configuring TLS inspection requires creating a Certificate Authority (CA) pool and trust configuration within a TLS inspection policy, provisioning a zonal firewall endpoint, and associating that endpoint with the target VPC network. Firewall policy rules must then reference a threat-prevention security profile group with the TLS inspection flag enabled to direct traffic to the endpoint for decryption and scanning.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts