Deploy Secure Web Proxy as a Private Service Connect service attachment

To centralize your Secure Web Proxy deployment when there are multiple networks, you can add Secure Web Proxy as a Private Service Connect service attachment.

You can deploy Secure Web Proxy as a Private Service Connect service attachment as follows:

1. Add Secure Web Proxy as a Private Service Connect service attachment on the producer side of a Private Service Connect connection.
2. Create a Private Service Connect consumer endpoint in each VPC network that needs to be connected to the Private Service Connect service attachment.
3. Point your workload egress traffic to the centralized Secure Web Proxy within the region and apply policies to this traffic.

Secure Web Proxy deployment in the Private Service Connect service attachment mode (click to enlarge).

Deploy Secure Web Proxy as a Private Service Connect service attachment using a hub and spoke model

Console

1. Deploy a Secure Web Proxy instance.

2. Deploy Secure Web Proxy as a service attachment in the central (Hub) Virtual Private Cloud (VPC) network.

   For more information, see Publish services by using Private Service Connect.

3. Point the source workload to the Secure Web Proxy by creating a Private Service Connect endpoint in the VPC network that includes the workload.

   For more information, see Create an endpoint.

4. Create a policy with a rule that allows traffic from the workload (identified by the source IP address) to a particular destination (For example: example.com).

5. Create a policy with a rule that blocks traffic from the workload (identified by the source IP address) to a particular destination (For example: altostrat.com).

   For more information, see Create a Secure Web Proxy policy.

gcloud

1. Deploy a Secure Web Proxy instance.

2. Deploy Secure Web Proxy as a service attachment in the central (Hub) VPC network.

   gcloud compute service-attachments create SERVICE_ATTACHMENT_NAME \
     --target-service=SWP_INSTANCE \ 
     --connection-preference ACCEPT_AUTOMATIC \ 
     --nat-subnets NAT_SUBNET_NAME \ 
     --region REGION  \
     --project PROJECT
   

   Replace the following:

   • SERVICE_ATTACHMENT_NAM: the name of the service attachment
   • SWP_INSTANCE: the URL to access the Secure Web Proxy instance
   • NAT_SUBNET_NAME: the name of the Cloud NAT subnet
   • REGION: the region of the Secure Web Proxy deployment
   • PROJECT: the project of the deployment

3. Create a Private Service Connect endpoint in the VPC network that includes the workload.

   gcloud compute forwarding-rules create ENDPOINT_NAME \
     --region REGION  \
     --target-service-attachment=SERVICE_ATTACHMENT_NAME  \
     --project PROJECT \
     --network NETWORK \
     --subnet SUBNET  \
     --address= ADDRESS
   

   Replace the following:

   • ENDPOINT_NAM: the name of the Private Service Connect endpoint
   • REGION: the region of the Secure Web Proxy deployment
   • SERVICE_ATTACHMENT_NAME: the name of the service attachment created earlier
   • PROJECT: the project of the deployment
   • NETWORK: the VPC network within which the endpoint is created
   • SUBNET: the subnet of the deployment
   • ADDRESS: the address of the endpoint

4. Point the workload to the Secure Web Proxy by using a proxy variable.

5. Create a policy with a rule that allows traffic from the workload (identified by the source IP address) to a particular destination (For example: example.com).

6. Create a policy with a rule that blocks traffic from the workload (identified by the source IP address) to a particular destination (For example: altostrat.com).

What's next?

• Configure TLS inspection
• Use tags to create policies
• Assign static IP addresses for egress traffic
• Additional considerations for Private Service Connect service attachment mode