Manage firewall endpoint associations

This page explains how to manage firewall endpoint associations by using the Google Cloud console and Google Cloud CLI.

When you associate a firewall endpoint with one or more Virtual Private Cloud (VPC) networks, you create the association in the same zone of the firewall endpoint. You can associate a VPC network in a zone with a project-level or an organization-level firewall endpoint.

When you configure endpoint associations, follow these requirements:

• In a single zone, you can associate a VPC network with only one firewall endpoint (either project-level (Preview) or organization-level). However, you can associate one VPC network with different firewall endpoints across multiple zones.

• You can associate a VPC network with a firewall endpoint in a separate project. This applies to both project-level (Preview) and organization-level endpoints. If the project-level endpoint is in a separate project, that project must reside in the same organization as your VPC network.

A firewall endpoint with jumbo frame support can accept packets only up to 8,500 bytes. Alternatively, a firewall endpoint without jumbo frame support can accept packets only up to 1,460 bytes. If you need URL filtering service or intrusion detection and prevention service, we recommend that you configure the associated VPC networks to use the maximum transmission unit (MTU) limits of 8,500 bytes and 1,460 bytes. For more information, see Supported packet size.

Caution: A firewall endpoint doesn't perform URL filtering service or intrusion detection and prevention service for a VPC network if the network is configured with an MTU that's greater than the firewall endpoint's limit.

To check the progress of the operations listed on this page, make sure that your user role has the following Compute Network User (roles/compute.networkUser) permissions:

• networksecurity.operations.get
• networksecurity.operations.list

Before you begin

• You need a VPC network and a subnet.

• You must enable the Compute Engine API in your Google Cloud project.

• You must enable the Network Security API in your Google Cloud project.

• You must enable the Certificate Authority Service API in your Google Cloud project.

• Install the gcloud CLI if you want to run the gcloud command-line examples in this guide.

• You need a firewall endpoint.

Roles

To get the permissions that you need to create, view, update, or delete firewall endpoint associations, ask your administrator to grant you the necessary IAM roles on your organization and project. For more information about granting roles, see Manage access.

Quotas

To view quotas for firewall endpoint associations, see Quotas and limits.

View a firewall endpoint association

To view details of an organization-level firewall endpoint association or a project-level firewall endpoint association, use the gcloud CLI.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

• networksecurity.firewallEndpointAssociations.get

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Compute Network User (roles/compute.networkUser)
• Compute Network Viewer (roles/compute.networkViewer)
• Firewall Endpoint Admin (roles/networksecurity.firewallEndpointAdmin) at the organization level or the project level

gcloud

To view a firewall endpoint association, use the gcloud network-security firewall-endpoint-associations describe command.

Organization-level firewall endpoint

gcloud network-security firewall-endpoint-associations \
    describe NAME \
    --zone ZONE \
    [ --project PROJECT_ID ]

Project-level firewall endpoint

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

gcloud beta network-security firewall-endpoint-associations \
    describe NAME \
    --zone ZONE \
    [ --project PROJECT_ID ]

Replace the following:

• NAME: the name of the firewall endpoint association.

• ZONE: the zone of the firewall endpoint association.

• PROJECT_ID: the Google Cloud project ID where the association is created.

List all firewall endpoint associations

To list all organization-level firewall endpoint associations, use Google Cloud console or the gcloud CLI. To list all project-level firewall endpoint association, use the gcloud CLI.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

• networksecurity.firewallEndpointAssociations.list

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Compute Network User (roles/compute.networkUser)
• Compute Network Viewer (roles/compute.networkViewer)
• Firewall Endpoint Admin (roles/networksecurity.firewallEndpointAdmin) at the organization level or the project level

Console

1. In the Google Cloud console, go to the Firewall endpoints page.

   Go to Firewall endpoints

2. In the project selector menu, select your Google Cloud project.

   In the Firewall endpoint associations section, the table lists all the configured firewall endpoint associations for this project.

gcloud

To list firewall endpoint associations for a specific network, use the gcloud network-security firewall-endpoint-associations list command with the --filter flag.

Organization-level firewall endpoint

gcloud network-security firewall-endpoint-associations list \
    --filter network:NETWORK_NAME \
    [ --project PROJECT_ID ]

Project-level firewall endpoint

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

gcloud beta network-security firewall-endpoint-associations list \
    --filter network:NETWORK_NAME \
    [ --project PROJECT_ID ]

Replace the following:

• NETWORK_NAME: the name of the VPC network.
• PROJECT_ID: the Google Cloud project ID where the firewall endpoint association is created.

Edit a firewall endpoint association

To edit an organization-level firewall endpoint association, use Google Cloud console or the gcloud CLI. To edit a project-level firewall endpoint association, use the gcloud CLI.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

• networksecurity.firewallEndpointAssociations.update

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Firewall Endpoint Admin (roles/networksecurity.firewallEndpointAdmin) at the organization level or the project level

Console

1. In the Google Cloud console, go to the Firewall endpoints page.

   Go to Firewall endpoints

2. In the project selector menu, select your Google Cloud project.

   In the Firewall endpoint associations section, the table lists all the configured firewall endpoint associations for this project.

3. Next to the firewall endpoint association that you want to update, click Edit.

4. To disable the firewall endpoint association, clear the Enable association checkbox.

5. To update the TLS inspection policy, select a new policy from the TLS inspection policy list.

6. Click Save.

gcloud

To update a firewall endpoint association, use the gcloud network-security firewall-endpoint-associations update command.

Organization-level firewall endpoint

gcloud network-security firewall-endpoint-associations
    update NAME \
    --zone ZONE \
    --project PROJECT_ID \
    [ --disabled ] \
    [ --tls-inspection-policy projects/TLS_PROJECT_NAME/locations/REGION_NAME/tlsInspectionPolicies/TLS_POLICY_NAME ]

Project-level firewall endpoint

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

gcloud beta network-security firewall-endpoint-associations
    update NAME \
    --zone ZONE \
    --project PROJECT_ID \
    [ --disabled ] \
    [ --tls-inspection-policy projects/TLS_PROJECT_NAME/locations/REGION_NAME/tlsInspectionPolicies/TLS_POLICY_NAME ]

Replace the following:

• NAME: the name of the firewall endpoint association.

• ZONE: the zone of the firewall endpoint association.

• PROJECT_ID: the Google Cloud project ID where the association is created.

• TLS_PROJECT_NAME: the Google Cloud project name of the TLS inspection policy.

• REGION_NAME: the region name of the TLS inspection policy.

• TLS_POLICY_NAME: the name of the TLS inspection policy.

Delete a firewall endpoint association

To delete an organization-level firewall endpoint association, use Google Cloud console or the gcloud CLI. To delete a project-level firewall endpoint association, use the gcloud CLI.

When a Google Cloud project is deleted, its associated firewall endpoint associations are automatically removed. This deletion is irreversible, even if the project is later restored.

However, the deletion process for these associations might sometimes fail. If this happens and the project is restored, the associated firewall endpoints appear in ORPHAN state within the restored project. This indicates the broken link between the project and its resources due to the unsuccessful deletion.

You can view these orphaned associations on the Google Cloud console, however, you can't edit these associations. Cloud Next Generation Firewall periodically runs a background process that deletes these orphaned resources.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

• networksecurity.firewallEndpointAssociations.delete

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Firewall Endpoint Admin (roles/networksecurity.firewallEndpointAdmin) at the organization level or the project level

Console

1. In the Google Cloud console, go to the Firewall endpoints page.

   Go to Firewall endpoints

2. In the project selector menu, select your Google Cloud project.

   In the Firewall endpoint associations section, the table lists all the configured firewall endpoint associations for this project.

3. Select the firewall endpoint association, and then click Delete.

4. Click Delete again to confirm.

gcloud

To delete a firewall endpoint association, use the gcloud network-security firewall-endpoint-associations delete command.

Organization-level firewall endpoint

gcloud network-security firewall-endpoint-associations \
    delete NAME \
    --zone ZONE \
    --project PROJECT_ID

Project-level firewall endpoint

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

gcloud beta network-security firewall-endpoint-associations \
    delete NAME \
    --zone ZONE \
    --project PROJECT_ID

Replace the following:

• NAME: the name of the firewall endpoint association.

• ZONE: the zone of the firewall endpoint association.

• PROJECT_ID: the Google Cloud project ID where the association is created.

What's next

• Create firewall endpoint associations
• Use hierarchical firewall policies and rules
• Use global network firewall policies and rules