If your Virtual Private Cloud (VPC) firewall rules don't use any network tags or service accounts, perform the following tasks to migrate the VPC firewall rules to a global network firewall policy:
- Assess your environment.
- Migrate the VPC firewall rules.
- Review the new global network firewall policy.
- Complete the postmigration tasks.
Before you begin
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Enable the Compute Engine API.
- Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Enable the Compute Engine API.
- Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
- Make sure that you have the Compute Security Admin role (
roles/compute.securityAdmin
).
Assess your environment
- Identify the number of existing VPC firewall rules in your network.
- Make a note of the priorities associated with each VPC firewall rule.
- Make sure that you have the required Identity and Access Management (IAM) roles and permissions to create, associate, modify, and view global network firewall policies.
Migrate the VPC firewall rules
After assessing your environment, migrate your VPC firewall
rules to a global network firewall policy by using the
compute firewall-rules migrate
command.
gcloud beta compute firewall-rules migrate \ --source-network=NETWORK_NAME \ –-target-firewall-policy=POLICY_NAME
Replace the following:
NETWORK_NAME
: the name of your VPC network containing the VPC firewall rules that you want to migrate.POLICY_NAME
: the name of the global network firewall policy to create during migration.
Review the new global network firewall policy
Before you attach the new global network firewall policy to a VPC network, Google recommends that you review the policy to help ensure that the migration process has completed accurately.
Verify the firewall policy rules configuration, and check if the following rule components are properly migrated for each rule:
- Relative priority
- Direction of traffic
- Action on match
- Log settings
- Target parameters
- Source parameters (for ingress rules)
- Destination parameters (for egress rules)
- Protocol and port constraints
For more information about the components of a firewall policy rule, see Firewall policy rules.
Postmigration tasks
To activate and use your global network firewall policy, you must complete the postmigration tasks covered in the following sections.
Associate the global network firewall policy with your network
The migration tool creates the global network firewall policy based on the
existing VPC firewall rules. You must manually associate the
policy with the required VPC network to activate the policy rules
for any VMs within that network. To associate the global network firewall policy,
use the compute network-firewall-policies associations create
command.
gcloud compute network-firewall-policies associations create \ --firewall-policy=POLICY_NAME \ --network=NETWORK_NAME \ --global-firewall-policy --replace-association-on-target
Replace the following:
POLICY_NAME
: the name of the global network policy that you want to associate with your VPC network.NETWORK_NAME
: the name of your VPC network.
For more information about associating a global network firewall policy to a VPC network, see Associate a policy with the network.
Change the policy and rule evaluation order
By default, Cloud Next Generation Firewall evaluates the VPC
firewall rules before it evaluates a global network firewall policy. To make sure
that global network firewall policies take precedence over VPC
firewall rules, use the compute networks update
command
to change the rule evaluation order.
gcloud compute networks update NETWORK-NAME \ --network-firewall-policy-enforcement-order=BEFORE_CLASSIC_FIREWALL
Replace NETWORK_NAME
with the name of your VPC network.
To verify whether the global network firewall policy is evaluated before the VPC
firewall rules, use the
compute networks get-effective-firewalls
command.
gcloud compute networks get-effective-firewalls NETWORK_NAME
In the output of the preceding command, if TYPE: network-firewall-policy
is
displayed before TYPE: network-firewall
, then the global network firewall policy
is evaluated first.
For more information about the changing policy and rule evaluation order, see Change policy and rule evaluation order.
// tslint:disable-next-line:objectLiteralShorthand
Enable logging of firewall rules
Logging helps you to determine whether a firewall rule is functioning as intended.
The migration tool retains the logging status of the existing VPC
firewall rules when it creates the new global network firewall policy. Make sure
that logging is enabled for the rules inside the global network firewall policy.
To enable logging for firewall policy rules, use the
compute network-firewall-policies rules update
command.
gcloud compute network-firewall-policies rules update PRIORITY \ --firewall-policy=POLICY_NAME \ --enable-logging --global-firewall-policy
Replace the following:
PRIORITY
: the priority of the rule to be updated.POLICY_NAME
: the name of the global network firewall policy whose rule you want to update.
Test your global network firewall policy
Before deleting your VPC firewall rules, test your global network firewall policy to check whether the policy rules are working according to your expectations for any traffic that matches the rules.
Do the following:
- Ensure that you have enabled logging on VPC firewall rules and the global network firewall policy.
- Change the rule evaluation order, so that the global network firewall policy is evaluated before your VPC firewall rules.
- Monitor the logs to verify that the global network firewall policy has hit counts and the VPC firewall rules are shadowed.
Delete the VPC firewall rules from your network
Google recommends that you disable the VPC firewall rules first before entirely deleting them. You can revert to those rules if the global network firewall policy created by the migration tool fails to provide the expected results.
To disable a VPC firewall rule, use the
compute firewall-rules update
command.
gcloud compute firewall-rules update RULE_NAME --disabled
Replace RULE_NAME
with the name of the VPC firewall rule
to be disabled.
To delete a VPC firewall rule, use the
compute firewall-rules delete
command.
gcloud compute firewall-rules delete RULE_NAME
What's next
- Learn more about migrating VPC firewall rules.
- Migrate VPC firewall rules with dependencies.