Configure the URL filtering service

The URL filtering service lets you control access to specific web domains by blocking or allowing them. To enable the URL filtering service in your network, you must set up multiple Cloud Next Generation Firewall components, including firewall endpoints, security profiles, and security profile groups. This document provides a high-level workflow that describes how to configure these components and enable the URL filtering service.

To learn more about the URL filtering service, see URL filtering service overview.

Configure the URL filtering service without TLS inspection

To configure the URL filtering service in your network, perform the following tasks.

  1. Create a security profile for URL filtering.

    To allow or deny access to specific domains, create a security profile of type url-filtering and use URL lists to specify your matcher strings.

    For more information, see Create a URL filtering security profile.

  2. Optionally, you can create a security profile to scan traffic for threats.

    To scan the traffic for security threats, create another security profile of type threat-prevention. Review the list of threat signatures, evaluate the default responses, and customize actions for the selected signatures according to your requirements.

    For more information, see Create a threat prevention security profile. To learn more about intrusion detection and prevention service, see Intrusion detection and prevention service overview.

  3. Create a security profile group.

    A security profile group acts as a container for security profiles. Create a security profile group to include the security profiles you created in the previous steps.

    For more information, see Create a security profile group.

  4. Create a firewall endpoint.

    A firewall endpoint is a zonal resource that you must create in the same zone as the workload you want to protect with the URL filtering service.

    For more information, see Create a firewall endpoint.

  5. Associate the firewall endpoint with your VPC networks.

    To enable the URL filtering service, associate the firewall endpoint with your VPC networks. Make sure that you're running your workloads in the same zone as the firewall endpoint.

    For more information, see Create firewall endpoint associations.

  6. Configure and apply the URL filtering service to your network traffic.

    To configure the URL filtering service, create a global network firewall policy or a hierarchical firewall policy with Layer 7 inspection.

    • If you create a new global firewall policy or use an existing one, add a firewall policy rule with the apply_security_profile_group action and specify the name of the security profile group that you created previously. Make sure that the firewall policy is associated with the same VPC network as the workloads that require inspection.

      For more information, see Create a global network firewall policy and Create global network firewall rules.

    • If you create a new hierarchical firewall policy or use an existing one, add a firewall policy rule with the apply_security_profile_group action. Make sure that the firewall policy is associated with the same VPC network as the workloads that require inspection.

      For more information, see Create firewall rules.

Configure the URL filtering service with TLS inspection

To configure the URL filtering service with Transport Layer Security (TLS) inspection in your network, perform the following tasks.

  1. Create a security profile for URL filtering.

    To allow or deny access to specific domains, create a security profile of type url-filtering and use URL lists to specify your matcher strings.

    For more information, see Create a URL filtering security profile.

  2. Optionally, you can create a security profile to scan traffic for threats.

    To scan traffic for security threats, create another security profile of type threat-prevention. Review the list of threat signatures, evaluate the default responses, and customize actions for the selected signatures according to your requirements.

    For more information, see Create a threat prevention security profile. To learn more about intrusion detection and prevention service, see Intrusion detection and prevention service overview.

  3. Create a security profile group.

    A security profile group acts as a container for security profiles. Create a security profile group to include the security profiles you created in the previous steps.

    For more information, see Create a security profile group.

  4. Create a firewall endpoint.

    A firewall endpoint is a zonal resource that you must create in the same zone as the workload you want to protect with the URL filtering service.

    For more information, see Create a firewall endpoint.

  5. Create and configure resources to inspect encrypted traffic.

    1. Create a certificate authority (CA) pool.

      A CA pool is a collection of CAs with a common certificate issuance policy and Identity and Access Management (IAM) policy. A regional CA pool must exist before you can configure TLS inspection.

      For more information, see Create a CA pool.

    2. Create a root CA.

      To use TLS inspection, you must have at least one root CA. The root CA signs an intermediate CA, which then signs all leaf certificates for the clients. For more information, see reference documentation for gcloud privateca roots create command.

    3. Grant necessary permissions to the Network Security Service Agent (P4SA).

      Cloud NGFW requires a P4SA to generate intermediate CAs for TLS inspection. The service agent needs the required permissions to request certificates for the CA pool.

      For more information, see Create a service account.

  6. Create a regional TLS inspection policy.

    A TLS inspection policy specifies how to intercept encrypted traffic. A regional TLS inspection policy can hold the configurations for the TLS inspection.

    For more information, see Create a TLS inspection policy.

  7. Associate the firewall endpoint with your VPC networks.

    To enable the URL filtering service, associate the firewall endpoint with your VPC networks. Make sure that you're running your workloads in the same zone as the firewall endpoint.

    In addition, associate the firewall endpoint with a TLS inspection policy.

    For more information, see Create firewall endpoint associations.

  8. Configure and apply the URL filtering service to your network traffic.

    To configure the URL filtering service, create a global network firewall policy or a hierarchical firewall policy with Layer 7 inspection.

    • If you create a new global firewall policy or use an existing one, add a firewall policy rule with the apply_security_profile_group action and specify the name of the security profile group that you created previously. Make sure that the firewall policy is associated with the same VPC network as the workloads that require inspection.

      For more information, see Create global network firewall policy and Create global network firewall policy rules.

    • If you create a new hierarchical firewall policy or use an existing one, add a firewall policy rule with the apply_security_profile_group action configured. Make sure that the firewall policy is associated with the same VPC network as the workloads that require inspection.

      For more information, see Create firewall rules.

Example deployment model

The following diagram shows an example of the URL filtering service deployment with multiple firewall endpoints, configured for two VPC networks in the same region but two different zones.

Deploy the URL filtering service in a region.
Deploy the URL filtering service in a region (click to enlarge).

The example deployment has the following configuration:

  1. Two security profile groups:

    1. Security profile group 1 with security profile Security profile 1.

    2. Security profile group 2 with security profile Security profile 2.

  2. Customer VPC 1 (VPC 1) has a firewall policy with its security profile group set to Security profile group 1.

  3. Customer VPC 2 (VPC 2) has a firewall policy with its security profile group set to Security profile group 2.

  4. Firewall endpoint Firewall endpoint 1 performs URL filtering for workloads running on VPC 1 andVPC 2 in zone us-west1-a.

  5. Firewall endpoint Firewall endpoint 2 performs URL filtering with TLS inspection enabled for workloads running on VPC 1 and VPC 2 in zone us-west1-b.

What's next