네트워크 에지 보안 정책을 사용하면 Google 네트워크 에지에서 트래픽을 허용하거나 차단하도록 규칙을 구성할 수 있습니다. 다음 프런트엔드 유형에 대해 네트워크 에지 보안 정책을 구성할 수 있습니다.
외부 패스 스루 네트워크 부하 분산기
프로토콜 전달
공개 IP 주소가 있는 VM
네트워크 에지 보안 정책을 사용하면 리소스를 소비하지 않고도 Cloud Next Generation Firewall과 유사하게 소스 및 대상 IP 주소 범위를 기준으로 필터링할 수 있습니다. 또한 네트워크 에지 보안 정책은 바이트 오프셋 필터링을 지원하는 유일한 보안 정책 유형입니다.
네트워크 에지 보안 정책의 맞춤 규칙 구성
백엔드 및 에지 보안 정책과 마찬가지로 네트워크 에지 보안 정책의 커스텀 규칙을 구성할 수 있습니다. 다음 예시에서는 네트워크 에지 보안 정책을 만들고, 지정된 소스 IP 주소 범위의 트래픽만 허용하도록 커스텀 규칙을 구성하고, 백엔드 서비스에 정책을 연결합니다.
네트워크 에지 보안 정책은 바이트 오프셋 필터링과 같은 고유한 필터를 비롯한 여러 Google Cloud Armor 필터를 지원합니다. 네트워크 에지 보안 정책에서 지원하는 기능에 관한 자세한 내용은 보안 정책 개요를 참고하세요.
또한 프리뷰 모드에서 네트워크 에지 보안 정책을 배포할 수 있습니다.
TCP/UDP/SCTP의 목적지 포트 번호. 각 요소는 (16비트) 숫자(예: '80') 또는 범위(예: '0-1023')일 수 있습니다.
IP 주소 프로토콜
--network-ip-protocols
IPv4 프로토콜/IPv6 다음 헤더 (확장 헤더 뒤) 각 요소는 8비트 숫자(예: '6') 또는 범위(예: '253-254') 또는 다음 프로토콜 이름 중 하나일 수 있습니다.
tcp
udp
icmp
esp
ah
ipip
sctp
바이트 오프셋 필터링
해당 사항 없음
다음 섹션을 참조하세요.
네트워크 에지 보안 정책에 --network-src-region-codes 플래그를 사용하면 포괄적인 미국 제재가 적용되는 다음 지역에 대해 리전 코드를 사용할 수 있습니다.
지역
할당된 코드
크리미아
XC
일명 도네츠크 인민공화국(DNR) 및
일명 루간스크 인민공화국(LNR)
XD
바이트 오프셋 필터링 구성
패스 스루 네트워크 부하 분산기, 프로토콜 전달 또는 공개 IP 주소가 포함된 VM을 사용할 경우 Google Cloud Armor가 인그레스 트래픽에 대해 심층 패킷 검사를 수행할 수 있습니다. 특정 TCP/UDP 바이트 오프셋 값과 일치하는 보안 정책 규칙을 구성할 수 있습니다. 규칙을 구성하면 구성된 값이 있을 때 또는 없을 때 규칙 작업을 적용할 수 있습니다.
다음 예시에서는 값이 있을 때 트래픽을 허용하고 다른 트래픽은 모두 거부합니다.
새 네트워크 에지 보안 정책을 만듭니다. 기존 네트워크 에지 보안 정책이 있는 경우 이 단계를 건너뛸 수 있습니다.
Google Cloud Armor는 각 네트워크 에지 보안 정책 규칙에 대해 다음 측정항목을 Cloud Monitoring으로 내보냅니다.
packet_count
Blocked: allow 또는 deny 규칙 작업의 결과를 나타내는 불리언 값입니다.
Count: 10,000개 패킷마다 한 번씩 증가하는 packet_count 값입니다. 예를 들어 packet_count 값이 5이면 최소 50,000개의 패킷이 규칙과 일치했음을 의미합니다.
preview_packet_count: packet_count와 동일하며 미리보기 모드의 규칙에 사용됩니다.
네트워크 에지 보안 정책의 측정항목을 보려면 먼저 Network Security API(networksecurity.googleapis.com)를 사용 설정해야 합니다. 이 권한은 Compute 보안 관리자 역할(roles/compute.securityAdmin)에 포함되어 있습니다. Network Security API를 사용 설정한 후 Google Cloud 콘솔의 Monitoring에서 측정항목을 볼 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-31(UTC)"],[[["\u003cp\u003eNetwork edge security policies allow you to configure rules to allow or block traffic at the edge of Google's network for external passthrough Network Load Balancers, protocol forwarding, and VMs with public IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eThese policies filter traffic by source and destination IP address ranges, similar to Cloud Next Generation Firewall, but they also uniquely offer byte-offset filtering for deep packet inspection, without consuming your own resources.\u003c/p\u003e\n"],["\u003cp\u003eTo use custom rules in network edge security policies, an active Cloud Armor Enterprise subscription and advanced network DDoS protection are required, which are configurable within your gcloud compute environment.\u003c/p\u003e\n"],["\u003cp\u003eYou can configure custom rules for network edge security policies using the Google Cloud CLI, which includes setting up user-defined fields, and rules that specify the action to be taken based on custom filter parameters.\u003c/p\u003e\n"],["\u003cp\u003eNetwork edge security policies provide metrics like \u003ccode\u003epacket_count\u003c/code\u003e and \u003ccode\u003epreview_packet_count\u003c/code\u003e in Cloud Monitoring, allowing you to track rule effectiveness, and you must enable the Network Security API to be able to view them.\u003c/p\u003e\n"]]],[],null,["# Configure network edge security policies\n\nNetwork edge security policies let you configure rules to allow or block traffic\nat the edge of Google's network. You can configure network edge security\npolicies for the following frontend types:\n\n- External passthrough Network Load Balancers\n- Protocol forwarding\n- VMs with public IP addresses\n\nYou can use network edge security policies to filter by source and destination\nIP address ranges similarly to Cloud Next Generation Firewall but without consuming your\nresources. In addition, a network edge security policy is the only security\npolicy type with support for [byte offset filtering](#byte-offset).\n| **Note:** Network edge security policies aren't supported for VM instances using [Dynamic NICs](/vpc/docs/multiple-interfaces-concepts#nic-types).\n\nConfigure custom rules for network edge security policies\n---------------------------------------------------------\n\n| **Note:** When you add a network edge security service to a network edge security policy, you can't remove the network edge security service using the Google Cloud console. You can only remove the network edge security service by using the Google Cloud CLI or the API.\n\nLike backend and edge security policies, you can configure custom rules for\nnetwork edge security policies. In the following example, you create a network\nedge security policy, configure a custom rule to allow traffic from only a given\nsource IP address range, and attach the policy to your backend service.\n\nNetwork edge security policies support several Cloud Armor filters,\nincluding unique filters like byte-offset filtering. For more information about\nwhat features network edge security policies support, see the\n[security policy overview](/armor/docs/security-policy-overview#policy-types).\nIn addition, you can deploy network edge security policies in\n[preview mode](/armor/docs/security-policy-overview#preview_mode).\n\nBefore you proceed, you must\n[enroll in Google Cloud Armor Enterprise](/armor/docs/armor-enterprise-using#enrolling)\nand\n[configure advanced network DDoS protection](/armor/docs/advanced-network-ddos#activate-advanced-ddos-protection).\nYou cannot use custom rules for network edge security policies without an active\nCloud Armor Enterprise subscription and advanced network DDoS protection.\n\nTo configure custom rules, follow these steps:\n\n1. Create a new network edge security policy with the name\n \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e in the region\n \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e. Don't use the same security policy\n that you used when you enabled advanced network DDoS protection.\n\n ```\n gcloud compute security-policies create POLICY_NAME \\\n --type=CLOUD_ARMOR_NETWORK \\\n --region=REGION\n ```\n2. Change your policy's\n [default rule](/armor/docs/security-policy-overview#default-rule) from\n `allow` to `deny` to block traffic that is not explicitly allowed by\n other rules.\n\n ```\n gcloud compute security-policies rules update 2147483647 \\\n --security-policy=POLICY_NAME \\\n --action=deny \\\n --region=REGION\n ```\n3. In the same security policy, add a rule at priority\n \u003cvar translate=\"no\"\u003eRULE_PRIORITY\u003c/var\u003e that allows requests in the source IP\n address range \u003cvar translate=\"no\"\u003eRANGE\u003c/var\u003e.\n\n ```\n gcloud compute security-policies rules create RULE_PRIORITY \\\n --security-policy=POLICY_NAME \\\n --network-src-ip-ranges=RANGE \\\n --action=allow \\\n --region=REGION\n ```\n4. Associate the security policy with your backend service\n \u003cvar translate=\"no\"\u003eBACKEND_SERVICE_NAME\u003c/var\u003e.\n\n ```\n gcloud compute backend-services update BACKEND_SERVICE_NAME \\\n --security-policy=POLICY_NAME \\\n --region=REGION\n ```\n\n Alternatively, you can associate the security policy with a single VM\n instance by using the following command: \n\n ```\n gcloud beta compute instances network-interfaces update VM_NAME \\\n --security-policy=POLICY_NAME \\\n --security-policy-region=REGION \\\n --network-interface=NETWORK_INTERFACE \\\n --zone=ZONE_NAME\n ```\n5. Optional: You can verify that the security policy is attached by using the\n following command. If successful, the `securityPolicy` field in the output\n has a link to your security policy resource.\n\n ```\n gcloud compute instances describe VM_NAME --zone=ZONE_NAME\n ```\n\nAfter you create the preceding example, you can continue to add rules to your\nnetwork edge security policy by using the `security-policies rules update` command.\nThe supported fields for network edge security policies are as follows:\n\nWhen you use the `--network-src-region-codes` flag with a network edge security\npolicy, you can use region codes for the following territories subject to\ncomprehensive US sanctions:\n\nConfigure byte-offset filtering\n-------------------------------\n\nIf you use external passthrough Network Load Balancers, protocol forwarding, or VMs with public IP\naddresses, Cloud Armor can perform deep packet inspection on ingressed\ntraffic. You can configure a security policy rule that matches on a specific\nTCP/UDP byte offset value. You can configure the rule to apply the rule action\nwhen the configured value is present, or alternatively when it is absent.\n\nThe following example allows traffic when the value is present, and denies\nall other traffic:\n\n1. Create a new network edge security policy. You can skip this step if you\n have an existing network edge security policy.\n\n ```\n gcloud compute security-policies create POLICY_NAME \\\n --type=CLOUD_ARMOR_NETWORK \\\n --region=REGION_NAME\n ```\n2. Update your network edge security policy to add user-defined fields\n by using the following parameters:\n\n - **Base** : value can be `IPv4`, `IPv6`, `TCP`, or `UDP`\n - **Offset**: offset of the field from the base in bytes\n - **Size** : size of the field in bytes (maximum value is `4`)\n - **Mask**: the mask for the bits in the field to be matched\n\n You can use up to eight user-defined fields per policy. In the following example,\n you create two user defined fields. \n\n ```\n gcloud compute security-policies add-user-defined-field POLICY_NAME \\\n --user-defined-field-name=USER_DEFINED_FIELD_NAME_TCP \\\n --base=TCP \\\n --offset=OFFSET \\\n --size=SIZE \\\n --mask=MASK \\\n --region=REGION_NAME\n ``` \n\n ```\n gcloud compute security-policies add-user-defined-field POLICY_NAME \\\n --user-defined-field-name=USER_DEFINED_FIELD_NAME_UDP \\\n --base=UDP \\\n --offset=OFFSET \\\n --size=SIZE \\\n --mask=MASK \\\n --region=REGION_NAME\n ```\n3. In your network edge security policy, add a rule with the same custom field name\n that you used in the previous example. Replace \u003cvar translate=\"no\"\u003eVALUE1\u003c/var\u003e\n and \u003cvar translate=\"no\"\u003eVALUE2\u003c/var\u003e with values that match traffic that\n you want to allow.\n\n ```\n gcloud compute security-policies rules create RULE_PRIORITY \\\n --security-policy=POLICY_NAME \\\n --network-user-defined-fields=\"USER_DEFINED_FIELD_NAME_TCP;VALUE1:VALUE2,USER_DEFINED_FIELD_NAME_UDP;VALUE1:VALUE2,USER_DEFINED_FIELD_NAME_UDP;VALUE1,VALUE2\" \\\n --action=allow \\\n --region=REGION_NAME\n ```\n4. Set the default rule in your network edge security policy to be a\n deny rule. You can skip this step if the default rule in your security\n policy is already a deny rule.\n\n ```\n gcloud compute security-policies rules update 2147483647 \\\n --security-policy=POLICY_NAME \\\n --action=deny \\\n --region=REGION_NAME\n ```\n5. Associate your network edge security policy with your external passthrough Network Load Balancer's\n backend service.\n\n ```\n gcloud compute backend-services update BACKEND_SERVICE_NAME \\\n --security-policy=POLICY_NAME \\\n --region=REGION_NAME\n ```\n\nMonitoring\n----------\n\nCloud Armor exports the following metrics to Cloud Monitoring for\neach of your network edge security policy rules:\n\n- `packet_count`\n - `Blocked`: a boolean value representing the result of an `allow` or `deny` \n rule action\n - `Count`: the value of `packet_count` incremented once for each 10,000 packets---for example, a `packet_count` value of `5` means that at least 50,000 packets have matched your rule\n- `preview_packet_count`: the same as `packet_count`, used for rules in preview mode\n\nTo view metrics for network edge security policies, you must first enable the\n[Network Security API](/traffic-director/docs/reference/network-security/rest)\n(`networksecurity.googleapis.com`). This permission is included in the\n[Compute Security Admin role](/iam/docs/understanding-roles#compute.securityAdmin)\n(`roles/compute.securityAdmin`). After you enable the Network Security API,\nyou can view the metrics in Monitoring in the Google Cloud console.\n\n[Go to Monitoring](https://console.cloud.google.com/monitoring)"]]
