Zero-Trust Perimeter with NGFW and IAP

What Cloud NGFW Enterprise, TLS Inspection, and IAP Provide

This solution implements a defense-in-depth, zero-trust network perimeter by combining Cloud Next Generation Firewall (NGFW) threat feeds and Layer 7 deep packet inspection with Identity-Aware Proxy (IAP) context-aware access controls.

How it meets the requirements:

• Automated Threat Intelligence: Google Threat Intelligence lists (such as iplist-tor-exit-nodes and iplist-known-malicious-ips) can be referenced directly inside hierarchical or global network firewall policies with a deny action. These feeds dynamically update to block malicious traffic without requiring manual IP range maintenance.
• Encrypted L7 IPS Inspection: Cloud NGFW Enterprise integrates with Certificate Authority Service (CAS) to dynamically generate intermediate certificates, enabling Transport Layer Security (TLS) decryption. Creating a TLS inspection policy and attaching it to global firewall policy rules using the apply_security_profile_group action and --tls-inspect flag allows firewall endpoints to inspect decrypted session payloads for vulnerabilities, malware, and spyware signatures.
• Zero-Trust Administrative Access: IAP TCP forwarding enables secure tunneling to private Compute Engine VMs over SSH (TCP port 22) without requiring public IP addresses. Traffic originating from IAP is routed through the well-known Google netblock 35.235.240.0/20, allowing strict ingress firewall rules paired with IAM and context-aware access evaluation.

Key advantages:

• Dynamic updates: Threat intelligence feeds are maintained directly by Google, eliminating manual rule drift.
• Hardware-backed trust: CAS CA pools provide root or subordinate certificate issuing authority backed by Hardware Security Modules (HSMs).
• Centralized governance: Hierarchical and global network firewall policies enforce mandatory security guardrails across organizational folders and projects.