Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
En este documento, se describen los pasos de configuración iniciales necesarios para usar el Proxy web seguro.
Antes de usar el Proxy web seguro, completa la siguiente configuración:
Obtén los roles necesarios de Identity and Access Management.
Crea o selecciona un Google Cloud proyecto.
Habilita la facturación y las APIs Google Cloud pertinentes.
Crea subredes de proxy.
Sube un certificado SSL al Administrador de certificados.
Esta configuración solo es necesaria la primera vez que usas el Proxy web seguro.
Cómo obtener roles de IAM
Para obtener permisos, sigue estos pasos:
Para obtener los permisos que
necesitas para aprovisionar una instancia de Secure Web Proxy,
pídele a tu administrador que te otorgue los
siguientes roles de IAM en tu proyecto:
Opcional: Si tienes un conjunto de usuarios responsables de la administración continua de políticas, otórgales el rol de administrador de políticas de seguridad (roles/compute.orgSecurityPolicyAdmin) para que puedan administrar las políticas de seguridad.
Crea un Google Cloud proyecto
Para crear o seleccionar un proyecto Google Cloud , sigue estos pasos:
Crea una subred de proxy para cada región en la que implementes el Proxy web seguro.
Crea un tamaño de subred de al menos /26 o 64 direcciones de solo proxy. Recomendamos un tamaño de subred de /23, o 512 direcciones de solo proxy, ya que un grupo de direcciones IP reservadas para el Proxy web seguro proporciona la conectividad del Proxy web seguro. Este grupo se usa para asignar direcciones IP únicas en el lado de salida de cada proxy para la interacción con Cloud NAT y los destinos en la red de VPC.
PROXY_SUBNET_NAME: El nombre que deseas para tu subred de proxy
REGION: Es la región en la que se implementará la subred del proxy.
NETWORK_NAME: El nombre de tu red
IP_RANGE: Es el rango de la subred, como 192.168.0.0/23.
Implementa un certificado SSL
Los certificados SSL son opcionales para el proxy web seguro. Para implementar certificados con el Administrador de certificados, usa cualquiera de los siguientes métodos:
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-09 (UTC)"],[],[],null,["This document describes the initial setup steps required to use Secure Web Proxy.\n\nBefore you can use Secure Web Proxy, complete the following setup:\n\n- Obtain necessary Identity and Access Management roles.\n- Create or select a Google Cloud project.\n- Enable billing and relevant Google Cloud APIs.\n- Create proxy subnets.\n- Upload an SSL certificate to Certificate Manager.\n\nThis setup is only required the first time you use Secure Web Proxy.\n\nObtain IAM roles\n\nTo obtain permissions, follow these steps:\n\n1.\n\n To get the permissions that\n you need to provision a Secure Web Proxy instance,\n\n ask your administrator to grant you the\n following IAM roles on your project:\n\n - To configure policies and provision a Secure Web Proxy instance: [Compute Network Admin role](/iam/docs/roles-permissions/compute#compute.networkAdmin) (`roles/compute.networkAdmin`)\n - To upload explicit Secure Web Proxy TLS certificates: [Certificate Manager Editor role](/iam/docs/roles-permissions/certificatemanager#certificatemanager.editor) (`roles/certificatemanager.editor`)\n\n\n For more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\n You might also be able to get\n the required permissions through [custom\n roles](/iam/docs/creating-custom-roles) or other [predefined\n roles](/iam/docs/roles-overview#predefined).\n2. Optional: If you have a set of users responsible for ongoing policy\n management, grant them the Security Policy Admin role\n (`roles/compute.orgSecurityPolicyAdmin`) to let them manage security\n policies.\n\nCreate a Google Cloud project\n\nTo create or select a Google Cloud project, follow these steps: \n\nConsole\n\nIn the Google Cloud console, on the project selector page, select or\n[create a Google Cloud project](/resource-manager/docs/creating-managing-projects).\n\n[Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n\nCloud Shell\n\n- Create a Google Cloud project:\n\n gcloud projects create \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the project ID that you\n want.\n- Select the Google Cloud project that you created:\n\n gcloud config set project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\nEnable billing\n\nMake sure that billing is enabled for your Google Cloud project. For more\ninformation, see [Enable, disable, or change billing for a project](/billing/docs/how-to/modify-project)\nand [Verify the billing status of your projects](/billing/docs/how-to/verify-billing-enabled).\n\nEnable the required APIs\n\nYou must enable the following Google Cloud APIs:\n\n- `compute.googleapis.com`\n- `certificatemanager.googleapis.com`\n- `networkservices.googleapis.com`\n- `networksecurity.googleapis.com`\n- `privateca.googleapis.com` (optional)\n\nTo enable the required Google Cloud APIs, do the following: \n\nConsole\n\n1. Enable the Compute Engine API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=compute)\n2. Enable the Certificate Manager API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=certificatemanager)\n3. Enable the Network Services API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=networkservices)\n4. Enable the Network Security API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=networksecurity)\n5. Optional: If you plan to [configure TLS inspection](/secure-web-proxy/docs/enable-tls-inspection)\n for your proxy, then you must enable the Certificate Authority Service API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=privateca)\n\ngcloud\n\nRun the following command: \n\n```\n gcloud services enable \\\n --compute.googleapis.com \\\n --certificatemanager.googleapis.com \\\n --networkservices.googleapis.com \\\n --networksecurity.googleapis.com \\\n --privateca.googleapis.com\n```\n\nCreate a proxy subnet\n\nCreate a proxy subnet for each region that you deploy Secure Web Proxy in.\nCreate a subnet size of at least /26, or 64 proxy-only addresses. We recommend\na subnet size of /23, or 512 proxy-only addresses, because Secure Web Proxy\nconnectivity is provided by a pool of IP addresses reserved for\nSecure Web Proxy. This pool is used to allocate unique IP addresses on the\negress side of each proxy for interaction with Cloud NAT and destinations in\nthe VPC network.\n**Important:** This subnet is *not* referenced when creating a Secure Web Proxy instance. For more information, see [Proxy-only subnets for Envoy-based load balancers](/load-balancing/docs/proxy-only-subnets). \n\ngcloud \n\n gcloud compute networks subnets create \u003cvar translate=\"no\"\u003ePROXY_SUBNET_NAME\u003c/var\u003e \\\n --purpose=REGIONAL_MANAGED_PROXY \\\n --role=ACTIVE \\\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --network=\u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e \\\n --range=\u003cvar translate=\"no\"\u003eIP_RANGE\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROXY_SUBNET_NAME\u003c/var\u003e: the name that you want for your proxy subnet\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region to deploy the proxy subnet in\n- \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e: your network name\n- \u003cvar translate=\"no\"\u003eIP_RANGE\u003c/var\u003e: the subnet range, such as `192.168.0.0/23`\n\nDeploy an SSL certificate\n\nSSL certificates are optional for Secure Web Proxy. To deploy certificates\nusing Certificate Manager, use any of the following methods:\n\n- Deploy a regional Google-managed certificate with per-project DNS\n authorization. For more information, see [Deploy a regional Google-managed certificate](/certificate-manager/docs/deploy-google-managed-regional).\n\n- Deploy a regional Google-managed certificate with Certificate Authority Service. For\n more information, see [Deploy a regional Google-managed certificate with CA Service](/certificate-manager/docs/deploy-google-managed-cas-regional).\n\n- Deploy a regional self-managed certificate.\n\n The following example shows how to deploy a regional self-managed certificate using Certificate Manager.\n\n \u003cbr /\u003e\n\n1. To create an SSL certificate:\n\n openssl req -x509 -newkey rsa:2048 \\\n -keyout \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e \\\n -out \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e -days 365 \\\n -subj '/CN=\u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e' -nodes -addext \\\n \"subjectAltName=DNS:\u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e: the path to save the key, such as `~/key.pem`\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e: the path to save the certificate, such as `~/cert.pem`\n - \u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e: the hostname for your Secure Web Proxy instance, such as `myswp.example.com`\n2. To upload the SSL certificate to Certificate Manager:\n\n gcloud certificate-manager certificates create \u003cvar translate=\"no\"\u003eCERTIFICATE_NAME\u003c/var\u003e \\\n --certificate-file=\u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e \\\n --private-key-file=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_NAME\u003c/var\u003e: the name of your certificate\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e: the path to the certificate file\n - \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e: the path to the key file\n\n For more information about SSL certificates, see\n [SSL certificates overview](/load-balancing/docs/ssl-certificates).\n\nWhat's next\n\n- [Deploy and test a Secure Web Proxy instance](/secure-web-proxy/docs/quickstart)\n- [Use tags to create policies](/secure-web-proxy/docs/use-tags)\n- [Use a URL list to create policies](/secure-web-proxy/docs/use-url-list)\n- [Assign static IP addresses for egress traffic](/secure-web-proxy/docs/assign-static-ip-addresses-for-egress-traffic)"]]
