TLS inspection is a security capability where Cloud Next Generation Firewall Enterprise (Cloud NGFW Enterprise) intercepts and decrypts encrypted HTTPS traffic to examine application-layer payloads for threats before re-encrypting the data and forwarding it to its intended destination. The firewall operates as a trusted intermediary in the connection, which requires integration with a trusted Certificate Authority (CA) so that client workloads accept the dynamically generated certificates without raising security warnings. The primary Google Cloud services supporting this architecture are Certificate Authority Service (CAS) for private CA management and Certificate Manager for automating certificate provisioning and renewal.
TLS inspection intercepts traffic flows at Layer 7 by breaking the end-to-end encrypted session into two separate connections. When a client initiates an HTTPS connection, the traffic reaches Cloud NGFW Enterprise, which terminates the initial TLS connection from the client by presenting a certificate signed by a trusted CA. The firewall decrypts and evaluates the payload against security policies, checking for threats and malicious content. After completing the inspection, Cloud NGFW Enterprise opens a new, separate TLS connection to the original destination server, functioning as the client. This interception model requires the firewall to have access to the private key of the CA to dynamically generate certificates on demand for requested domain names.
StudyCerts
StudyCertsClient ===(TLS 1: Signed by CAS CA)===> [ Cloud NGFW Enterprise ] ===(TLS 2: Standard TLS)===> Destination
[ Decrypt & Inspect ]
Certificate Authority Service (CAS) is a managed service used to deploy, configure, and scale private certificate authorities. For TLS inspection deployments, administrators establish a private CA pool within CAS to issue the subordinate or intermediate signing certificates needed by Cloud NGFW Enterprise. The root certificate from this private CA pool must be installed and trusted by all client workloads across the network to establish certificate validation. CAS can also be integrated with Cloud Key Management Service (Cloud KMS) backed by Hardware Security Modules (HSM) to protect CA signing keys under regulatory compliance standards.
Certificate Manager handles the provisioning, deployment, and lifecycle management of certificates generated through CAS. Administrators configure certificate issuance policies within Certificate Manager to automatically request and deploy certificates for target domains directly from the CAS pool. This automation prevents service outages caused by expired certificates by renewing and deploying certificates before their validity period lapses. Through this integration, Cloud NGFW Enterprise continuously maintains a valid trust chain without requiring manual administrative intervention.
TLS inspection establishes a critical trust boundary by decrypting payload data, requiring precise traffic selection to avoid unnecessary performance overhead. Administrators define decryption policies within firewall rules by specifying criteria such as source and destination IP ranges, network tags, or service accounts. Because the root CA is trusted globally across client machines, using a dedicated private CA pool managed strictly through CAS isolates decryption authority and protects against unauthorized certificate issuance.
Cloud NGFW Enterprise provides Layer 7 deep packet inspection to analyze the application-layer contents of network traffic traversing Virtual Private Cloud (VPC) networks. By analyzing payloads rather than relying solely on traditional Layer 3 and Layer 4 header attributes, Cloud NGFW Enterprise identifies application-level threats such as cross-site scripting, SQL injection, and malware hiding in ordinary web traffic.
Network Security Integration enables out-of-band traffic redirection to third-party security appliances for deep packet inspection using a producer-consumer service model. In this architecture, the service producer network contains third-party network security appliances placed as backends behind an internal load balancer. The service consumer network uses firewall policies to select specific network traffic and route it through an endpoint group to the producer network. The internal load balancer in the producer network distributes the incoming traffic to the appliances for inspection, allowing organizations to deploy specialized security tools without changing underlying VPC routing tables.
Regional Firewall Endpoints must be provisioned within the project to process and evaluate traffic passing through VPC networks. Because resource quotas are enforced at the project level, all associated VPC networks must reside within the same project hosting the firewall endpoint infrastructure. In enterprise designs, incoming internet traffic or hybrid connections terminate in an untrusted "outside" VPC network connected to the external interface of the Layer 7 firewall. The traffic must pass through the regional firewall endpoint for full payload inspection before the firewall routes it into trusted internal VPC networks.
[ Internet / Hybrid Interconnect ]
│
▼
[ Untrusted Outside VPC ]
│
▼
[ Regional Firewall Endpoint ] ── (L7 Inspection & Threat Prevention)
│
▼
[ Trusted Internal VPC ]
VPC firewall rules evaluate traffic direction, protocol, port, and priority, processing rules sequentially from the lowest priority number to the highest. These rules are stateful, meaning return traffic for an established connection is permitted automatically. To enable Layer 7 analysis, firewall rules use the apply-security-profile-group action to route matching network flows directly to the Layer 7 inspection engine. This rule action initiates payload analysis on matching packets while permitting non-inspected traffic to proceed along standard routing paths.
Multi-VPC architectures often combine Cloud NGFW Enterprise with Network Connectivity Center (NCC) to centralize traffic inspection across complex environments. An NCC hub connects spoke VPC networks, shared services VPCs, and hybrid transit paths like Cloud Interconnect or High Availability VPN (HA VPN). External transit connections terminate in a transit VPC, allowing Cloud NGFW Enterprise to inspect traffic before NCC routes packets across spoke networks. This setup avoids creating dedicated interconnect attachments for every individual VPC while maintaining strict security boundaries between trusted and untrusted environments.
VPC Service Controls (VPC SC) complements Cloud NGFW Enterprise by establishing perimeter security boundaries around Google Cloud resources to prevent unauthorized data exfiltration. While Cloud NGFW Enterprise inspects traffic payloads traversing VPC networks, VPC Service Controls restricts managed API calls to ensure services cannot be accessed from outside the perimeter or exfiltrate data to unauthorized external projects. Combining both tools provides defense-in-depth, pairing payload inspection at the network level with identity- and perimeter-based access controls at the service layer.
Security profiles and security profile groups structure how Layer 7 threat rules and packet filtering are defined and applied across Cloud NGFW Enterprise. Administrators configure Threat Prevention security profiles to evaluate traffic against Intrusion Prevention System (IPS) signature databases to detect and block malicious payloads. These profiles are bundled into reusable security profile groups and attached to firewall policies to enforce protection across target networks.
┌─────────────────────────────────────────────────────────────┐
│ Security Profile Group │
│ ┌───────────────────────────────┐ ┌──────────────────────┐ │
│ │ Threat Prevention Profile │ │ URL Filtering │ │
│ │ (IPS Signatures: CVEs/Malware)│ │ Profile │ │
│ └───────────────────────────────┘ └──────────────────────┘ │
└──────────────────────────────┬──────────────────────────────┘
│
▼ Attached via 'apply-security-profile-group'
┌─────────────────────────────────────────────────────────────┐
│ Hierarchical or Global Network Firewall Policy │
└─────────────────────────────────────────────────────────────┘
A Threat Prevention security profile specifies the exact Layer 7 inspection rules, protocol decoders, and IPS signature sets used to detect and mitigate network attacks. The profile leverages native Intrusion Detection and Prevention System (IDPS) capabilities to monitor network streams and automatically drop or flag packets containing known vulnerabilities, exploits, or malware. In specialized environments like Google Distributed Cloud, activating these IDPS threat prevention capabilities requires coordination with an Infrastructure Operator (IO). Threat Prevention profiles protect inbound traffic from the internet, outbound egress traffic, and east-west traffic moving between internal VPCs.
A security profile group bundles multiple security profiles—such as Threat Prevention profiles and URL filtering profiles—into a single logical management object. Network firewall rules reference the security profile group name rather than individual inspection profiles, applying the entire group configuration using the apply-security-profile-group rule action. This approach standardizes policy application across the organization and allows administrators to update underlying security profiles without modifying individual firewall rules.
Security profile groups can be attached to both hierarchical firewall policies and global network firewall policies to enforce uniform inspection rules across enterprise topologies. In hub-and-spoke topologies managed by Network Connectivity Center, traffic moving between spoke VPCs or entering through Cloud Interconnect and HA VPN is routed through firewall policies that invoke these security profile groups. Because native Cloud NGFW Enterprise processes traffic inline across distributed VPC workloads, it performs Layer 7 payload analysis without requiring network virtual appliances (NVAs) or complex routing hops through internal load balancers.
apply-security-profile-group action.Cloud NGFW Enterprise acts as a trusted intermediary during TLS inspection, terminating incoming client TLS connections and establishing new outbound connections to destination servers. To prevent client workloads from encountering certificate trust errors, the firewall must use intermediate certificates issued by a private CA pool within CAS whose root certificate is distributed to and trusted by all clients.
A security profile group bundles distinct Layer 7 policies—such as Threat Prevention profiles based on IPS signatures and URL filtering profiles—into a single deployable object. This allows firewall policy rules to reference one profile group, enabling administrators to update threat signatures and inspection settings centrally without needing to rewrite individual firewall rules.
Traditional VPC firewall rules filter traffic based only on Layer 3 and Layer 4 header attributes such as IP addresses, protocols, and ports. Cloud NGFW Enterprise uses regional Firewall Endpoints and security profile groups to perform deep packet inspection on the actual Layer 7 application payload, detecting threats such as malware, SQL injection, and cross-site scripting inside active connections.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills