Firewall Insights is a service within Google Cloud's Network Intelligence Center that analyzes firewall rule configurations and network topology to help administrators monitor and improve firewall behavior. The service uses the Cloud Firewall Insights Service Agent role (roles/firewallinsights.serviceAgent) to retrieve configuration details on the administrator's behalf. This role includes permissions such as compute.firewalls.get, compute.firewalls.list, and compute.networks.getEffectiveFirewalls, which allow the service to evaluate both defined and effective firewall rules across virtual private cloud (VPC) networks. The service agent also fetches metadata about routes, subnetworks, instances, backend services, and forwarding rules, enabling it to map security rules against active network resources.
Flow Analyzer provides visual and metric-based analysis of traffic patterns by processing records generated by VPC Flow Logs. For data to appear in Flow Analyzer, VPC Flow Logs must be enabled on the relevant subnetworks, metadata logging must not be disabled, and the destination log bucket must be upgraded to use Log Analytics. Flow Analyzer groups flow data into defined alignment periods, ranging from one-minute windows for granular anomaly detection to multi-week spans for macro-level trend analysis. Administrators can analyze data using metric types such as Bytes sent or Packets sent, applying alignment calculations including total traffic, average traffic rate, median rate, P95 traffic rate, or maximum rate.
Network traffic logs and performance telemetry provide the granular session attributes and communication trends needed to verify traffic paths. Traffic logs stored in Cloud Logging record connection details, including source and destination IP addresses, source and destination ports, IP protocol, total packets, and total bytes transferred per session. The Performance Dashboard retains up to six weeks of historical metrics to display latency and packet loss trends across zone pairs. Combining session flow attributes with VM-level latency and packet loss data enables administrators to identify specific workloads driving network volume and verify that traffic flows align with architectural requirements.
Firewall Insights assesses security exposure by comparing configured firewall rules against logged traffic flows. It identifies resources, such as virtual machine (VM) instances, that have open or overly permissive ingress rules, which increases their attack surface. The service correlates rule hits with threat intelligence feeds and compliance frameworks to highlight rules that may violate organizational policies or best practices. This analysis helps prioritize which rules to tighten or remove to reduce risk.
The core service agent for Firewall Insights is the Cloud Firewall Insights Service Agent (roles/firewallinsights.serviceAgent). This predefined IAM role grants the service the necessary permissions to retrieve firewall, VM, and route resources on a user's behalf for analysis. The permissions include compute.firewalls.list, compute.instances.list, and compute.networks.getEffectiveFirewalls. This role must only be granted to the Google-managed service agent, not to human users or other principals, to maintain security boundaries.
After Firewall Insights identifies problematic rules, the next step is remediation. Administrators can use the insights to make informed decisions about modifying or deleting firewall rules. For example, a rule with zero hits over a long period may be a candidate for removal to simplify management. Conversely, a rule allowing broad ingress from the internet might be narrowed to specific IP ranges. The tool provides the evidence needed to justify these changes within a compliance or change management framework, ensuring the network's security posture is proactively improved.
Firewall Insights provides metrics that reveal how often each firewall rule has been matched by traffic flows, known as hit counts. When analyzing these metrics, administrators can identify rules with zero hits or extremely low usage over a defined time period. Rules that have never been hit are candidates for deletion, as they represent unnecessary complexity in the firewall configuration without providing security value. Low-hit rules may indicate that the rule was created for a temporary purpose, that the underlying workload has been decommissioned, or that the rule's matching criteria are too specific to ever match production traffic.
Beyond simple hit counts, Firewall Insights helps distinguish between several categories of ineffective rules. Unused rules are those with zero matches that can be safely removed to reduce the attack surface and simplify firewall management. Redundant rules occur when multiple rules perform the same filtering action on overlapping traffic—these can be consolidated into a single rule that covers all the same cases, reducing administrative overhead and improving rule readability. Overly permissive rules are those that match more traffic than intended, such as rules with very broad source IP ranges or rules that allow traffic when the intent was to allow only specific flows; these present security risks and should be refined to match actual requirements.
The analysis of firewall rule utilization directly supports network operations by ensuring that firewall policies remain aligned with actual workload requirements. When administrators review Firewall Insights data as part of routine network operations, they can make informed decisions about which rules to delete, modify, or consolidate. This ongoing optimization helps maintain a lean firewall configuration that supports both security objectives and network performance, while also demonstrating compliance with organizational policies that require regular review of security controls.
StudyCerts
StudyCertsroles/firewallinsights.serviceAgent) to retrieve firewall rules, VM instances, and network metadata for analysis.You must enable VPC Flow Logs on the relevant subnetworks, ensure metadata logging is not disabled, and upgrade the destination log bucket to use Log Analytics. Flow Analyzer then processes the logs and groups data into alignment periods ranging from one minute to multiple weeks.
A rule with zero hits is a candidate for deletion because it adds complexity without providing security value. Before deleting, verify that the rule is not needed for future workloads or compliance requirements, using the evidence from Firewall Insights to justify the change.
A redundant rule performs the same filtering action as another rule on overlapping traffic, so it can be consolidated into a single rule. An overly permissive rule matches more traffic than intended, often due to broad source IP ranges or allowing all traffic when only specific flows are needed. Redundant rules increase administrative overhead, while overly permissive rules increase security risk.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills