Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Aturan firewall Virtual Private Cloud (VPC) berlaku untuk satu jaringan VPC. Untuk memiliki kontrol yang lebih baik atas traffic yang dikirim atau diterima oleh instance mesin virtual (VM) di jaringan VPC, Anda dapat menggunakan tag jaringan atau akun layanan dalam aturan firewall VPC. Namun, aturan firewall VPC memiliki batasan berikut:
Tidak ada pengeditan batch: Aturan firewall VPC diterapkan berdasarkan per aturan dan harus diedit satu per satu, yang dapat menjadi tidak efisien.
Kontrol Identity and Access Management (IAM) terbatas: Tag jaringan tidak menawarkan kontrol IAM yang andal yang diperlukan untuk segmentasi traffic yang ketat.
Untuk mengatasi batasan aturan firewall VPC, Cloud Next Generation Firewall mendukung kebijakan firewall jaringan global dan regional. Anda dapat menentukan dan menerapkan kebijakan firewall jaringan ke beberapa jaringan VPC di beberapa region. Kebijakan ini juga mendukung tag aman yang dikelola IAM yang memungkinkan Anda menerapkan kontrol terperinci di tingkat VM untuk mikro-segmentasi yang aman dan andal dari semua jenis traffic jaringan.
Untuk mengontrol akses ke jaringan VPC, Anda dapat memigrasikan aturan firewall VPC yang ada ke kebijakan firewall jaringan global untuk memanfaatkan kemampuan kebijakan firewall jaringan.
Manfaat memigrasikan aturan firewall VPC ke kebijakan firewall jaringan
Kebijakan firewall jaringan memberikan pengalaman firewall yang konsisten di seluruh
hierarki resource dan menawarkan beberapa manfaat operasional dibandingkan
aturan firewall VPC.Google Cloud
Menyediakan keamanan dan kontrol akses terperinci dengan menggunakan Tag yang diatur IAM. Google Cloud Memungkinkan Anda melampirkan Tag terpisah ke setiap antarmuka jaringan VM. Berdasarkan Tag, Anda dapat menentukan aturan kebijakan firewall untuk membatasi akses yang tidak sah ke traffic workload dan resource Anda. Dengan demikian, Anda mendapatkan tingkat kontrol yang lebih baik atas resource Anda, yang membantu memastikan lingkungan layanan mandiri dengan hak istimewa paling rendah untuk setiap grup atau aplikasi pengguna. Aturan firewall VPC menggunakan tag jaringan,
yang tidak mendukung kontrol akses IAM.
Memungkinkan pengelolaan aturan yang disederhanakan. Kebijakan firewall jaringan mendukung
pengeditan batch, yang memungkinkan Anda mengedit beberapa aturan dalam satu kebijakan.
Aturan firewall VPC hanya beroperasi di tingkat per-aturan.
Memudahkan pengoperasian. Kebijakan firewall jaringan mendukung penggunaan fitur, seperti objek nama domain yang sepenuhnya memenuhi syarat (FQDN), objek geolokasi, deteksi ancaman, pencegahan intrusi, dan grup alamat.
Aturan firewall VPC tidak mendukung fitur lanjutan ini.
Mendukung residensi data yang fleksibel. Kebijakan firewall jaringan dapat diterapkan ke beberapa region atau satu region jaringan.
Aturan firewall VPC hanya dapat diterapkan secara global.
Alat migrasi aturan firewall VPC
Alat migrasi aturan firewall VPC dapat secara otomatis memigrasikan aturan firewall VPC ke kebijakan firewall jaringan global. Alat ini adalah utilitas command line yang dapat Anda akses menggunakan Google Cloud CLI.
Spesifikasi
Alat migrasi membuat kebijakan firewall jaringan global, mengonversi aturan firewall VPC yang ada menjadi aturan kebijakan firewall, dan menambahkan aturan baru ke kebijakan.
Jika dua aturan firewall VPC atau lebih memiliki prioritas yang sama, alat migrasi akan otomatis memperbarui prioritas aturan untuk menghindari tumpang-tindih.
Aturan dengan tindakan deny diberi prioritas yang lebih tinggi daripada aturan dengan tindakan allow.
Saat memperbarui prioritas, alat ini mempertahankan urutan relatif aturan firewall VPC asli.
Misalnya, jika Anda memiliki empat aturan firewall VPC dengan prioritas 1000 dan aturan kelima dengan prioritas 2000, alat migrasi akan menetapkan nomor prioritas unik ke empat aturan pertama dengan urutan—1000, 1001, 1002, dan 1003. Aturan kelima dengan
prioritas 2000 diberi prioritas unik baru 1004. Hal ini memastikan
bahwa prioritas baru untuk empat aturan pertama lebih tinggi daripada semua
aturan yang memiliki prioritas lebih rendah dari 1000.
Jika aturan firewall VPC Anda berisi dependensi, seperti tag jaringan atau akun layanan, alat migrasi dapat memanfaatkan Tag yang diatur IAM yang berfungsi sebagai pengganti tag jaringan dan akun layanan tersebut.
Jika jaringan VPC Anda berisi aturan firewall VPC dan kebijakan firewall jaringan terkait, alat migrasi akan memindahkan aturan firewall VPC yang kompatibel serta aturan kebijakan firewall jaringan ke kebijakan firewall jaringan global yang baru.
Alat migrasi mempertahankan setelan log aturan firewall VPC yang ada. Jika logging diaktifkan untuk aturan firewall VPC, alat migrasi akan tetap mengaktifkannya. Jika logging dinonaktifkan, alat migrasi akan tetap menonaktifkannya.
Alat migrasi hanya membuat kebijakan firewall jaringan global. Alat ini tidak menghapus aturan firewall VPC yang ada atau mengaitkan kebijakan firewall jaringan global baru dengan jaringan VPC yang diperlukan. Anda harus mengaitkan kebijakan firewall jaringan global secara manual dengan
jaringan VPC yang diperlukan, lalu menghapus pengaitan
antara aturan firewall VPC dan jaringan
VPC.
Setelah mengaitkan kebijakan firewall jaringan global dengan jaringan VPC yang diperlukan, Anda dapat menonaktifkan aturan firewall VPC jika aturan kebijakan di kebijakan firewall jaringan global berfungsi sebagaimana mestinya.
Jika perlu, Anda juga dapat mengaitkan kebijakan firewall jaringan global baru serta aturan firewall VPC dengan jaringan VPC yang sama karena aturan diterapkan sesuai dengan urutan evaluasi kebijakan dan aturan.
Namun, sebaiknya nonaktifkan aturan firewall VPC.
Skenario migrasi
Pertimbangkan skenario berikut saat Anda memigrasikan aturan firewall VPC ke kebijakan firewall jaringan global:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eVPC firewall rules are limited to a single VPC network and lack batch editing capabilities and robust IAM controls, unlike network firewall policies.\u003c/p\u003e\n"],["\u003cp\u003eNetwork firewall policies offer enhanced control through IAM-governed secure tags, allowing for detailed micro-segmentation of network traffic at the VM level.\u003c/p\u003e\n"],["\u003cp\u003eNetwork firewall policies enable simplified management through batch editing, along with advanced features like FQDN and geolocation objects, which are not supported by VPC firewall rules.\u003c/p\u003e\n"],["\u003cp\u003eThe VPC firewall rules migration tool facilitates the conversion of existing VPC firewall rules into a global network firewall policy, automatically managing priorities and preserving log settings.\u003c/p\u003e\n"],["\u003cp\u003eMigrating to a global network firewall policy allows for greater flexibility in data residency, as it can be applied to multiple or single regions, whereas VPC firewall rules are applied globally.\u003c/p\u003e\n"]]],[],null,["# VPC firewall rules migration overview\n\nVirtual Private Cloud (VPC) firewall rules apply to a single VPC\nnetwork. To have finer control over the traffic sent or received by the virtual\nmachine (VM) instances in your VPC network, you can use\n[network tags](/vpc/docs/add-remove-network-tags) or [service accounts](/iam/docs/service-account-overview)\nin the VPC firewall rules. However, VPC firewall\nrules have the following limitations:\n\n- **No batch editing**: VPC firewall rules are applied on a\n per-rule basis and must be edited individually, which can be inefficient.\n\n- **Limited Identity and Access Management (IAM) control**: Network tags don't offer the\n robust IAM controls needed for strict traffic segmentation.\n\nTo address the limitations of VPC firewall rules,\nCloud Next Generation Firewall supports global and regional network firewall\npolicies. You can define and apply network firewall policies to multiple\nVPC networks across multiple regions. These policies also support\nIAM-governed [secure tags](/firewall/docs/tags-firewalls-overview) that let you enforce granular\ncontrol at the VM level for safe and reliable micro-segmentation of all types of\nnetwork traffic.\n\nFor more information, see [Benefits of migrating VPC firewall rules to a network firewall policy](#benefits).\n\nTo control access to your VPC network, you can migrate your existing VPC firewall rules to a global network firewall policy to take advantage of the capabilities of network firewall policies.\n\nBenefits of migrating VPC firewall rules to a network firewall policy\n---------------------------------------------------------------------\n\nA network firewall policy delivers a consistent firewall experience across the\nGoogle Cloud resource hierarchy and offers multiple operational benefits over\nVPC firewall rules.\n\n- **Provides granular security and access control by using IAM\n governed Tags**. Google Cloud lets you attach separate Tags to each\n network interface of a VM. Based on the Tags, you can define your firewall\n policy rules to restrict unauthorized access to your resources and workload\n traffic. So, you gain a finer level of control over your resources, which\n helps to ensure a least-privilege, self-service environment for each user\n group or application. VPC firewall rules use network tags,\n which don't support IAM access control.\n\n- **Enables simplified rule management**. Network firewall policies support\n batch editing, which lets you edit multiple rules within a single policy.\n VPC firewall rules operate only at a per-rule level.\n\n- **Provides ease of operations**. Network firewall policies support the use\n of features, such as fully qualified domain name (FQDN) objects,\n geolocation objects, threat detection, intrusion prevention, and address groups.\n VPC firewall rules don't support these advanced features.\n\n- **Supports flexible data residency**. Network firewall policies can be\n applied to either multiple regions or a single region of a network.\n VPC firewall rules can only be applied globally.\n\nVPC firewall rules migration tool\n---------------------------------\n\nThe VPC firewall rules migration tool can automatically migrate\nVPC firewall rules to a global network firewall policy. The tool\nis a command-line utility that you can access using the Google Cloud CLI.\n\n### Specifications\n\n- The migration tool creates a global network firewall policy, converts the\n existing VPC firewall rules into firewall policy rules, and\n adds the new rules to the policy.\n\n- If two or more VPC firewall rules have the same priority, the\n migration tool automatically updates the rule priorities to avoid any overlap.\n A rule with a `deny` action is given a higher priority than a rule with an `allow` action.\n While updating the priorities, the tool preserves the relative sequence of the\n original VPC firewall rules.\n\n For example, if you have four VPC firewall rules with a priority\n of `1000` and a fifth rule with a priority of `2000`, the migration tool\n assigns a unique priority number to the first four rules with the\n sequence---`1000`, `1001`, `1002`, and `1003`. The fifth rule with the\n priority of `2000` is assigned a new unique priority of `1004`. This ensures\n that the new priorities for the first four rules are higher than that of all\n rules that have priority lower than `1000`.\n | **Note:** Before you attach the new global network firewall policy to a VPC network, review the new priorities and make sure that the automatically generated priorities align with your original VPC network configuration.\n- If your VPC firewall rules contain dependencies, such as network\n tags or service accounts, the migration tool can take advantage of\n IAM-governed Tags that serve as a replacement to those network\n tags and services accounts.\n\n- If your VPC network contains VPC firewall\n rules and an associated network firewall policy, the migration tool moves\n the compatible VPC firewall rules as well as the network\n firewall policy rules to the new global network firewall policy.\n\n- The migration tool preserves the log settings of the existing VPC\n firewall rules. If a VPC firewall rule has logging turned on,\n the migration tool keeps it on. If logging is off, the migration tool keeps it turned off.\n\n- The migration tool generates the global network firewall policy only. The\n tool does not delete existing VPC firewall rules or associate\n the new global network firewall policy with the required VPC\n network. You must manually associate the global network firewall policy with\n the required VPC network, and then remove the association\n between the VPC firewall rules and the VPC\n network.\n\n- After you associate the global network firewall policy with the required\n VPC network, you can disable the VPC firewall\n rules if the policy rules in the global network firewall policy are working\n as intended.\n\n If necessary, you can associate the new global network firewall policy as well\n as the VPC firewall rules with the same VPC\n network because the rules are applied according to the [policy and rule\n evaluation order](/vpc/docs/firewall-policies-overview#rule-evaluation).\n However, we recommend you disable the VPC firewall rules.\n\nMigration scenarios\n-------------------\n\nConsider the following scenarios when you migrate your VPC firewall\nrules to a global network firewall policy:\n\n- [VPC firewall rules don't contain network tags or service accounts](/firewall/docs/migrate-firewall-rules-no-dependencies).\n- [VPC firewall rules contain network tags or target service accounts, or both](/firewall/docs/migrate-firewall-rules-with-dependencies).\n\nThe following diagram shows the migration workflow for the preceding configuration\ncombinations. Choose the workflow that matches your network requirements.\n[](/static/firewall/images/vpc-rules-migration.png) **Figure 1.** VPC firewall rules migration flow (click to enlarge).\n\nWhat's next\n-----------\n\n- [Migrate VPC firewall rules that don't use network tags and service accounts](/firewall/docs/migrate-firewall-rules-no-dependencies)\n- [Migrate VPC firewall rules that use network tags and service accounts](/firewall/docs/migrate-firewall-rules-with-dependencies)"]]
