Configure WildFire in your network

WildFire lets you protect your network against unknown, file-based threats and advanced malware. To enable WildFire in your network, you must set up multiple Cloud Next Generation Firewall components, including firewall endpoints, security profiles, and security profile groups. This document provides a high-level workflow that describes how to configure these components and enable WildFire.

To learn more about WildFire, see WildFire overview.

Required roles

Identity and Access Management (IAM) roles govern the actions for configuring and enabling WildFire. The following table describes the roles that are necessary for each step:

Ability	Necessary role
Create a firewall endpoint and a firewall endpoint association for a Virtual Private Cloud (VPC) network.	To perform this task, ensure that you have one of the following roles: Compute Network Admin (`roles/compute.networkAdmin`) Firewall Endpoint Admin (`roles/networksecurity.firewallEndpointAdmin`) at the organization level for organization-level firewall endpoints, and at either the project level (Preview) or organization level for firewall endpoints. These roles include the following permission to create a firewall endpoint: `networksecurity.firewallEndpoints.create` Additionally, these roles include the following permissions to create a firewall endpoint association: `networksecurity.firewallEndpointAssociations.create` `networksecurity.firewallEndpoints.use` on the organization where the firewall endpoint exists
Create a WildFire analysis security profile, a threat prevention security profile, and a security profile group	Security Profile Admin (`roles/networksecurity.securityProfileAdmin`) at the organization level for organization-level security profile groups, and at either the project level (Preview) or organization level for security profile groups. This role includes the following required permissions: `networksecurity.securityProfileGroups.create` to create a security profile group `networksecurity.securityProfiles.create` to create a WildFire analysis security profile or a threat prevention security profile
Create a hierarchical firewall policy and its rules	Compute Organization Firewall Policy Admin (`roles/compute.orgFirewallPolicyAdmin`). You must have this role to create a hierarchical firewall policy. You must grant the role on the resource where you want to create the policy. In addition, you must have this role to create a rule in a hierarchical firewall policy. You must grant the role on the resource containing the policy or on the policy itself. The role includes the following required permissions: `compute.firewallPolicies.create` to create a hierarchical firewall policy `compute.firewallPolicies.update` to create a hierarchical firewall policy rule
Associate a hierarchical firewall policy with an organization or folder	To perform this task, ensure that you have one of the following roles: Compute Organization Resource Admin (`roles/compute.orgSecurityResourceAdmin`) on the target resource and Compute Organization Firewall Policy User (`roles/compute.orgFirewallPolicyUser`) on the policy resource or on the policy itself Compute Organization Resource Admin (`roles/compute.orgSecurityResourceAdmin`) on the target resource and Compute Organization Firewall Policy Admin (`roles/compute.orgFirewallPolicyAdmin`) on the policy resource or on the policy itself These roles include the following required permissions: `compute.firewallPolicies.addAssociation` on the firewall policy `compute.organizations.setFirewallPolicy` on the target resource
Create a global network firewall policy and its rules	Compute Security Admin (`roles/compute.securityAdmin`) You must have this role to create a global network firewall policy. You must grant the role on the project where you want to create the policy. In addition, you must have this role to create a rule in a global network firewall policy. You must grant the role on the project containing the policy or on the policy itself. The role includes the following required permissions: `compute.firewallPolicies.create` to create a global network firewall policy `compute.firewallPolicies.update` to create a global network firewall policy rule
Associate a global network firewall policy with a VPC network	Compute Network Admin (`roles/compute.networkAdmin`) This role includes the following required permissions: `compute.firewallPolicies.use` `compute.networks.setFirewallPolicy`
Create a CA pool	CA Service Operation Manager (`roles/privateca.caManager`) If you use Transport Layer Security (TLS) inspection, you must have this role to create a Certificate Authority (CA) pool.
Create a TLS inspection policy	To perform this task, ensure that you have one of the following roles: Compute Network Admin (`roles/compute.networkAdmin`) Compute Security Admin (`roles/compute.securityAdmin`) If you are using TLS inspection, you need one of the preceding roles to create a TLS inspection policy. These roles include the following required permissions: `certificatemanager.trustconfigs.list` `certificatemanager.trustconfigs.use` `networksecurity.operations.get` `networksecurity.tlsInspectionPolicies.create` `networksecurity.tlsInspectionPolicies.list` `privateca.caPools.list` `privateca.caPools.use` `privateca.certificateAuthorities.list`

Configure WildFire without TLS inspection

To configure WildFire without Transport Layer Security (TLS) inspection in your network, do the following:

Accept the WildFire EULA.

Before you enable WildFire on endpoints, you must review and accept the WildFire End-User License Agreement (EULA) on the billing project. You can accept the EULA when you create or update an endpoint.

For more information, see Create a firewall endpoint.
Create a WildFire analysis security profile.

Create a WILDFIRE_ANALYSIS security profile and specify the types of files to submit for analysis and the traffic direction (upload or download).

For more information, see Create a WildFire analysis security profile.
Create a threat prevention security profile.

A threat prevention security profile is mandatory to use a WildFire analysis profile in a group. Create a THREAT_PREVENTION security profile.

For more information, see Create a threat prevention security profile.
Create a security profile group.

Add the WildFire analysis and threat prevention security profiles to the security profile group.

For more information, see Create a security profile group.
Create a firewall endpoint with WildFire enabled.

Create a firewall endpoint. In the Advanced configuration section, select the Enable WildFire checkbox.

For more information, see Create a firewall endpoint.
Associate the firewall endpoint with your VPC networks.

To enable the WildFire, associate the firewall endpoint with your VPC networks. Ensure that your workloads run in the same zone as the firewall endpoint.

A firewall endpoint with jumbo frame support can accept packets only up to 8,500 bytes. Alternatively, a firewall endpoint without jumbo frame support can accept packets only up to 1,460 bytes. If you need WildFire, we recommend that you configure the associated VPC networks to use the maximum transmission unit (MTU) limits of 8,500 bytes and 1,460 bytes. For more information, see Supported packet size.

Caution: A firewall endpoint doesn't perform WildFire for a VPC network if the network is configured with an MTU that's greater than the firewall endpoint's limit.

For more information, see Create firewall endpoint associations.
Configure and apply WildFire to your network traffic.

Create a global or hierarchical firewall policy rule with the apply_security_profile_group action. Specify your security profile group. Ensure that the firewall policy is associated with the same VPC network as the workloads to inspect.

For more information, see Create hierarchical firewall policies and rules and Create global network firewall policies and rules.

Configure WildFire with TLS inspection

To configure WildFire with TLS inspection in your network, do the following:

Accept the WildFire EULA.

Before you enable WildFire on endpoints, you must review and accept the WildFire EULA on the billing project. You can accept the EULA when you create or update an endpoint.

For more information, see Create a firewall endpoint.
Create a WildFire analysis security profile.

Create a WILDFIRE_ANALYSIS security profile and specify the types of files to submit for analysis and the traffic direction (upload or download).

For more information, see Create a WildFire analysis security profile.
Create a threat prevention security profile.

A threat prevention security profile is mandatory to use a WildFire analysis profile in a group. Create a THREATPREVENTION security profile.

For more information, see Create a threat prevention security profile.
Create a security profile group.

Add the WildFire analysis and threat prevention security profiles to the security profile group.

For more information, see Create a security profile group.
Create a firewall endpoint with WildFire enabled.

Create a firewall endpoint. In the Advanced configuration section, select the Enable WildFire checkbox.

For more information, see Create a firewall endpoint.
Associate the firewall endpoint with your VPC networks.

To enable the WildFire, associate the firewall endpoint with your VPC networks. Ensure that your workload run in the same zone as the firewall endpoint.

A firewall endpoint with jumbo frame support can accept packets only up to 8,500 bytes. Alternatively, a firewall endpoint without jumbo frame support can accept packets only up to 1,460 bytes. If you need WildFire, we recommend that you configure the associated VPC networks to use the maximum transmission unit (MTU) limits of 8,500 bytes and 1,460 bytes. For more information, see Supported packet size.

Caution: A firewall endpoint doesn't perform WildFire for a VPC network if the network is configured with an MTU that's greater than the firewall endpoint's limit.

For more information, see Create firewall endpoint associations.
Create and configure resources to inspect encrypted traffic.
1. Create a CA pool.
  
  A CA pool is a collection of CAs with a common certificate issuance policy and IAM policy. A regional CA pool must exist before you can configure TLS inspection.
  
  For more information, see Create a CA pool.
2. Create a root CA.
  
  To use TLS inspection, you must have at least one root CA. The root CA signs an intermediate CA, which then signs all leaf certificates for the clients. For more information, see reference documentation for gcloud privateca roots create command.
3. Grant permissions to the Network Security Service Agent (P4SA).
  
  Cloud NGFW requires a P4SA to generate intermediate CAs for TLS inspection. The service agent needs the required permissions to request certificates for the CA pool.
  
  For more information, see Create a service account.
Create a regional TLS inspection policy.

A TLS inspection policy specifies how to intercept encrypted traffic. A regional TLS inspection policy can hold the configurations for the TLS inspection.

For more information, see Create a TLS inspection policy.
Add a TLS inspection policy to a firewall endpoint association.

To add the TLS inspection policy to a firewall endpoint association, see Create firewall endpoint associations.
Configure and apply WildFire to your network traffic.

To configure WildFire, create a global network firewall policy or a hierarchical firewall policy with Layer 7 inspection.
- In a new or existing global firewall policy, add a rule with the apply_security_profile_group action. Specify the name of the security profile group that you created previously. Ensure that the firewall policy is associated with the same VPC network as the workloads to inspect.
  
  For more information, see Create global network firewall policy and Create a rule.
- In a new or existing hierarchical firewall policy, add a rule with the apply_security_profile_group action. Ensure that the firewall policy is associated with the same VPC network as the workloads to inspect.
  
  For more information, see Create a rule.

Upgrade an existing firewall endpoint to enable WildFire

If you have already deployed Cloud Next Generation Firewall Enterprise endpoints in your network with active threat prevention security profiles and security profile groups, do the following to configure and enable WildFire:

Accept the WildFire EULA.

Analyze and accept the WildFire EULA on the billing project for your endpoints.
Create a WildFire analysis security profile.

Create a WILDFIRE_ANALYSIS security profile and define the file submission rules and custom protocol or threat overrides. For more information, see Create a WildFire analysis security profile.
Update your security profile group.

Add the new WildFire analysis security profile to your security profile group. The security profile group must contain a threat prevention profile. For more information, see Update a security profile group.
Enable WildFire on the firewall endpoint.

Update the firewall endpoint and select the Enable WildFire checkbox in the advanced configuration for the zonal endpoint. For more information, see Update a firewall endpoint.