管理安全网关

本页面介绍了如何完成常见的安全网关管理任务。

设置 shell 环境

为了简化设置流程并与安全网关 API 进行交互，请在工作 shell 中定义以下环境变量。

  • 常规参数

    API="beyondcorp.googleapis.com"
API_VERSION=v1
PROJECT_ID=MY_PROJECT_ID
APPLICATION_ID=MY_APPLICATION_ID
APPLICATION_DISPLAY_NAME="MY_APPLICATION_DISPLAY_NAME"
HOST_NAME=MY_HOST_NAME

    替换以下内容：

    • MY_PROJECT_ID：创建安全网关的项目的 ID。
    • MY_APPLICATION_ID：您的应用的 ID，例如 github。名称最多可包含 63 个字符，并且可以包含小写字母、数字和连字符。第一个字符必须是字母，最后一个字符可以是字母或数字。
    • MY_APPLICATION_DISPLAY_NAME：要显示的直观易懂的名称。

    • MY_HOST_NAME：应用的 hostname。例如 github.com。主机名不得超过 253 个字符，并且必须遵循以下格式之一：

      • 有效的 IPv4 地址
      • 有效的 IPv6 地址
      • 有效的 DNS 名称
      • 星号 (*)
      • 星号 (*) 后跟有效的 DNS 名称

  • 安全网关参数

    SECURITY_GATEWAY_ID=MY_SECURITY_GATEWAY_ID
SECURITY_GATEWAY_DISPLAY_NAME="MY_SECURITY_GATEWAY_DISPLAY_NAME"

    替换以下内容：

    • MY_SECURITY_GATEWAY_ID：安全网关的 ID。ID 最多可包含 63 个字符，并且可以包含小写字母、数字和连字符。第一个字符应为字母，最后一个字符可以是字母或数字。
    • MY_SECURITY_GATEWAY_DISPLAY_NAME：安全网关的人类可读名称。名称不得超过 63 个字符，并且只能包含可打印的字符。

更新安全网关

以下示例展示了如何更新现有安全网关的 Hub。

gcloud

gcloud beta beyondcorp security-gateways update ${SECURITY_GATEWAY_ID} \
  --project=${PROJECT_ID} \
  --location=global \
  --hubs=us-central1,us-east1

REST

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-X PATCH \
-d "{ \"hubs\": {\"us-central1\": {}, \"us-east1\": {}} }" \
"https://${API}/${API_VERSION}/projects/${PROJECT_ID}/locations/global/securityGateways/${SECURITY_GATEWAY_ID}?update_mask=hubs"

获取安全网关的详细信息

如需获取安全网关的详细信息，请运行以下命令。

gcloud

gcloud beta beyondcorp security-gateways describe ${SECURITY_GATEWAY_ID} \
  --project=${PROJECT_ID} \
  --location=global

REST

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://${API}/${API_VERSION}/projects/${PROJECT_ID}/locations/global/securityGateways/${SECURITY_GATEWAY_ID}"

列出安全网关

如需列出项目中的所有安全网关，请运行以下命令。

gcloud

gcloud beta beyondcorp security-gateways list \
  --project=${PROJECT_ID} \
  --location=global

REST

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://${API}/${API_VERSION}/projects/${PROJECT_ID}/locations/global/securityGateways"

删除安全网关

如需删除安全网关，请运行以下命令。

gcloud

gcloud beta beyondcorp security-gateways delete ${SECURITY_GATEWAY_ID} \
  --project=${PROJECT_ID} \
  --location=global

REST

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-X DELETE \
"https://${API}/${API_VERSION}/projects/${PROJECT_ID}/locations/global/securityGateways/${SECURITY_GATEWAY_ID}"

更新应用资源

以下示例展示了如何更新现有应用。 允许修改的字段包括：

  • display_name
  • endpoint_matchers

您可以使用 update_mask 来控制要更新的字段。以下示例展示了如何更新 endpoint_matchers 字段：

gcloud

gcloud beta beyondcorp security-gateways applications update ${APPLICATION_ID} \
  --project=${PROJECT_ID} \
  --security-gateway=${SECURITY_GATEWAY_ID} \
  --location=global \
  --endpoint-matchers="hostname=${HOST_NAME}"

REST

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-X PATCH \
-d "{ \"endpoint_matchers\": [{hostname: \"${HOST_NAME}\"}] }" \
"https://${API}/${API_VERSION}/projects/${PROJECT_ID}/locations/global/securityGateways/${SECURITY_GATEWAY_ID}/applications/${APPLICATION_ID}?update_mask=endpoint_matchers"

获取应用资源的详细信息

如需获取应用的详细信息，请运行以下命令。

gcloud

gcloud beta beyondcorp security-gateways applications describe ${APPLICATION_ID} \
  --project=${PROJECT_ID} \
  --security-gateway=${SECURITY_GATEWAY_ID} \
  --location=global

REST

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://${API}/${API_VERSION}/projects/${PROJECT_ID}/locations/global/securityGateways/${SECURITY_GATEWAY_ID}/applications/${APPLICATION_ID}"

列出应用资源

如需列出安全网关中的所有应用，请运行以下命令。

gcloud

gcloud beta beyondcorp security-gateways applications list \
  --project=${PROJECT_ID} \
  --security-gateway=${SECURITY_GATEWAY_ID} \
  --location=global

REST

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://${API}/${API_VERSION}/projects/${PROJECT_ID}/locations/global/securityGateways/${SECURITY_GATEWAY_ID}/applications"

删除应用资源

如需删除应用，请运行以下命令。

gcloud

gcloud beta beyondcorp security-gateways applications delete ${APPLICATION_ID} \
  --project=${PROJECT_ID} \
  --security-gateway=${SECURITY_GATEWAY_ID} \
  --location=global

REST

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-X DELETE \
"https://${API}/${API_VERSION}/projects/${PROJECT_ID}/locations/global/securityGateways/${SECURITY_GATEWAY_ID}/applications/${APPLICATION_ID}"