Create and manage mirroring endpoint groups

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This page explains how to configure and manage the mirroring endpoint groups in the consumer's account to represent the producer's mirroring deployment groups by using the Google Cloud CLI.

We recommend that you create the mirroring endpoint group in a project owned by your security administrator. To create the mirroring endpoint group associations, the security administrator must assign the Mirroring Endpoint Admin (roles/networksecurity.mirroringAdmin) and Mirroring Endpoint Network Admin (roles/networksecurity.mirroringEndpointNetworkAdmin) roles to the project or to the network administrator.

If you have enabled the mirroring rule action as MIRROR in the firewall policy associated with your Virtual Private Cloud (VPC) network, and created the mirroring endpoint group associations, the mirrored traffic is forwarded to the mirroring endpoint group.

Before you begin

• You must enable the Compute Engine API in your Google Cloud project.

• You must enable the Network Security API in the Google Cloud project that you want to use for billing.

• Install the gcloud CLI if you want to run the gcloud command-line examples in this guide.

• You must have a mirroring deployment group.

Roles

To get the permissions that you need to create, view, or delete mirroring endpoint groups, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your Google Cloud project. For more information about granting roles, see Manage access to projects, folders, and organizations.

To check the progress of the operations listed on this page, make sure that your user role has the Mirroring Endpoint Admin (roles/networksecurity.mirroringEndpointAdmin) and Mirroring Deployment User (roles/networksecurity.mirroringDeploymentUser) roles and permissions.

The Mirroring Deployment User role (roles/networksecurity.mirroringDeploymentUser) is required on the producer project so that you can connect the consumer's mirroring endpoint group to the producer's mirroring deployment group.

Quotas

To view quotas associated with mirroring endpoint groups, see Quotas and limits.

Create a mirroring endpoint group

Create a mirroring endpoint group in a specific zone.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

• networksecurity.mirroringEndpointGroups.create

Roles

• networksecurity.mirroringEndpointAdmin

gcloud

To create a mirroring endpoint group, use the gcloud beta network-security mirroring-endpoint-groups create command:

 gcloud beta network-security mirroring-endpoint-groups create ENDPOINT_GROUP \
     --location global \
     --project PROJECT_NAME \
     --mirroring-deployment-group DEPLOYMENT_GROUP \
     --no-async

Replace the following:

• ENDPOINT_GROUP: the name of the mirroring endpoint group.

  The endpoint group name is visible to producers that the consumer explicitly granted access to. Therefore, don't include sensitive information such as personally identifiable information or security data in the mirroring endpoint group name.

• PROJECT_NAME: the project name where you want to create the mirroring endpoint group.

• DEPLOYMENT_GROUP: the name of the mirroring deployment group.

To associate the mirroring endpoint group to a VPC network, see Create and manage mirroring endpoint group associations.

View a mirroring endpoint group

You can view the details of a specific mirroring endpoint group.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

• networksecurity.mirroringEndpointgroups.get

Roles

• networksecurity.mirroringEndpointAdmin
• networksecurity.mirroringEndpointViewer

gcloud

To view details of a mirroring endpoint group, use the gcloud beta network-security mirroring-endpoint-groups describe command:

 gcloud beta network-security mirroring-endpoint-groups \
     describe ENDPOINT_GROUP \
     --location global

Replace ENDPOINT_GROUPwith the name of the mirroring endpoint group.

List mirroring endpoint groups

You can list all the mirroring endpoint groups in a project.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

• networksecurity.mirroringEndpointGroups.list

Roles

• networksecurity.mirroringEndpointAdmin
• networksecurity.mirroringEndpointViewer
• networksecurity.mirroringEndpointUser

gcloud

To list all mirroring endpoint groups, use the gcloud beta network-security mirroring-endpoint-groups list command:

 gcloud beta network-security mirroring-endpoint-groups list \
     --project PROJECT_NAME \
     --location global

Replace PROJECT_NAMEwith the name of the project where the mirroring endpoint group was created.

Delete a mirroring endpoint group

You can delete a mirroring endpoint group by specifying its name, location, and project.

Note: You can delete a mirroring endpoint group only if it is not associated with any VPC network.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

• networksecurity.mirroringEndpointGroups.delete

Roles

• networksecurity.mirroringEndpointAdmin

gcloud

To delete a mirroring endpoint group, use the gcloud beta network-security mirroring-endpoint-groups delete command:

 gcloud beta network-security mirroring-endpoint-groups delete ENDPOINT_GROUP
     --project PROJECT_NAME \
     --location global \
     --no-async

Replace the following:

• ENDPOINT_GROUP: the name of the mirroring endpoint group.

• PROJECT_NAME: the project name where the mirroring endpoint group was created.

What's next

• Mirroring endpoint groups overview
• Out-of-band integration overview
• Create and manage mirroring endpoint group associations