Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan langkah-langkah penyiapan awal yang diperlukan untuk menggunakan Secure Web Proxy.
Sebelum dapat menggunakan Secure Web Proxy, selesaikan penyiapan berikut:
Dapatkan peran Identity and Access Management yang diperlukan.
Buat atau pilih Google Cloud project.
Aktifkan penagihan dan API Google Cloud yang relevan.
Buat subnet proxy.
Upload sertifikat SSL ke Certificate Manager.
Penyiapan ini hanya diperlukan saat pertama kali Anda menggunakan Secure Web Proxy.
Mendapatkan peran IAM
Untuk mendapatkan izin, ikuti langkah-langkah berikut:
Untuk mendapatkan izin yang
Anda perlukan untuk menyediakan instance Secure Web Proxy,
minta administrator Anda untuk memberi Anda
peran IAM berikut di project Anda:
Untuk mengonfigurasi kebijakan dan menyediakan instance Secure Web Proxy:
Peran Admin Jaringan Compute (roles/compute.networkAdmin)
Opsional: Jika Anda memiliki sekumpulan pengguna yang bertanggung jawab atas pengelolaan kebijakan berkelanjutan, berikan peran Admin Kebijakan Keamanan (roles/compute.orgSecurityPolicyAdmin) kepada mereka agar mereka dapat mengelola kebijakan keamanan.
Buat Google Cloud project
Untuk membuat atau memilih project Google Cloud , ikuti langkah-langkah berikut:
Buat subnet proxy untuk setiap region tempat Anda men-deploy Secure Web Proxy.
Buat ukuran subnet minimal /26, atau 64 alamat khusus proxy. Sebaiknya gunakan ukuran subnet /23, atau 512 alamat khusus proxy, karena konektivitas Secure Web Proxy disediakan oleh kumpulan alamat IP yang dicadangkan untuk Secure Web Proxy. Kumpulan ini digunakan untuk mengalokasikan alamat IP unik di sisi keluar setiap proxy untuk berinteraksi dengan Cloud NAT dan tujuan di jaringan VPC.
PROXY_SUBNET_NAME: nama yang Anda inginkan untuk subnet proxy
REGION: region tempat subnet proxy akan di-deploy
NETWORK_NAME: nama jaringan Anda
IP_RANGE: rentang subnet, seperti 192.168.0.0/23
Men-deploy sertifikat SSL
Sertifikat SSL bersifat opsional untuk Secure Web Proxy. Untuk men-deploy sertifikat menggunakan Pengelola Sertifikat, gunakan salah satu metode berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-09 UTC."],[],[],null,["This document describes the initial setup steps required to use Secure Web Proxy.\n\nBefore you can use Secure Web Proxy, complete the following setup:\n\n- Obtain necessary Identity and Access Management roles.\n- Create or select a Google Cloud project.\n- Enable billing and relevant Google Cloud APIs.\n- Create proxy subnets.\n- Upload an SSL certificate to Certificate Manager.\n\nThis setup is only required the first time you use Secure Web Proxy.\n\nObtain IAM roles\n\nTo obtain permissions, follow these steps:\n\n1.\n\n To get the permissions that\n you need to provision a Secure Web Proxy instance,\n\n ask your administrator to grant you the\n following IAM roles on your project:\n\n - To configure policies and provision a Secure Web Proxy instance: [Compute Network Admin role](/iam/docs/roles-permissions/compute#compute.networkAdmin) (`roles/compute.networkAdmin`)\n - To upload explicit Secure Web Proxy TLS certificates: [Certificate Manager Editor role](/iam/docs/roles-permissions/certificatemanager#certificatemanager.editor) (`roles/certificatemanager.editor`)\n\n\n For more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\n You might also be able to get\n the required permissions through [custom\n roles](/iam/docs/creating-custom-roles) or other [predefined\n roles](/iam/docs/roles-overview#predefined).\n2. Optional: If you have a set of users responsible for ongoing policy\n management, grant them the Security Policy Admin role\n (`roles/compute.orgSecurityPolicyAdmin`) to let them manage security\n policies.\n\nCreate a Google Cloud project\n\nTo create or select a Google Cloud project, follow these steps: \n\nConsole\n\nIn the Google Cloud console, on the project selector page, select or\n[create a Google Cloud project](/resource-manager/docs/creating-managing-projects).\n\n[Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n\nCloud Shell\n\n- Create a Google Cloud project:\n\n gcloud projects create \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the project ID that you\n want.\n- Select the Google Cloud project that you created:\n\n gcloud config set project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\nEnable billing\n\nMake sure that billing is enabled for your Google Cloud project. For more\ninformation, see [Enable, disable, or change billing for a project](/billing/docs/how-to/modify-project)\nand [Verify the billing status of your projects](/billing/docs/how-to/verify-billing-enabled).\n\nEnable the required APIs\n\nYou must enable the following Google Cloud APIs:\n\n- `compute.googleapis.com`\n- `certificatemanager.googleapis.com`\n- `networkservices.googleapis.com`\n- `networksecurity.googleapis.com`\n- `privateca.googleapis.com` (optional)\n\nTo enable the required Google Cloud APIs, do the following: \n\nConsole\n\n1. Enable the Compute Engine API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=compute)\n2. Enable the Certificate Manager API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=certificatemanager)\n3. Enable the Network Services API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=networkservices)\n4. Enable the Network Security API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=networksecurity)\n5. Optional: If you plan to [configure TLS inspection](/secure-web-proxy/docs/enable-tls-inspection)\n for your proxy, then you must enable the Certificate Authority Service API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=privateca)\n\ngcloud\n\nRun the following command: \n\n```\n gcloud services enable \\\n --compute.googleapis.com \\\n --certificatemanager.googleapis.com \\\n --networkservices.googleapis.com \\\n --networksecurity.googleapis.com \\\n --privateca.googleapis.com\n```\n\nCreate a proxy subnet\n\nCreate a proxy subnet for each region that you deploy Secure Web Proxy in.\nCreate a subnet size of at least /26, or 64 proxy-only addresses. We recommend\na subnet size of /23, or 512 proxy-only addresses, because Secure Web Proxy\nconnectivity is provided by a pool of IP addresses reserved for\nSecure Web Proxy. This pool is used to allocate unique IP addresses on the\negress side of each proxy for interaction with Cloud NAT and destinations in\nthe VPC network.\n**Important:** This subnet is *not* referenced when creating a Secure Web Proxy instance. For more information, see [Proxy-only subnets for Envoy-based load balancers](/load-balancing/docs/proxy-only-subnets). \n\ngcloud \n\n gcloud compute networks subnets create \u003cvar translate=\"no\"\u003ePROXY_SUBNET_NAME\u003c/var\u003e \\\n --purpose=REGIONAL_MANAGED_PROXY \\\n --role=ACTIVE \\\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --network=\u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e \\\n --range=\u003cvar translate=\"no\"\u003eIP_RANGE\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROXY_SUBNET_NAME\u003c/var\u003e: the name that you want for your proxy subnet\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region to deploy the proxy subnet in\n- \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e: your network name\n- \u003cvar translate=\"no\"\u003eIP_RANGE\u003c/var\u003e: the subnet range, such as `192.168.0.0/23`\n\nDeploy an SSL certificate\n\nSSL certificates are optional for Secure Web Proxy. To deploy certificates\nusing Certificate Manager, use any of the following methods:\n\n- Deploy a regional Google-managed certificate with per-project DNS\n authorization. For more information, see [Deploy a regional Google-managed certificate](/certificate-manager/docs/deploy-google-managed-regional).\n\n- Deploy a regional Google-managed certificate with Certificate Authority Service. For\n more information, see [Deploy a regional Google-managed certificate with CA Service](/certificate-manager/docs/deploy-google-managed-cas-regional).\n\n- Deploy a regional self-managed certificate.\n\n The following example shows how to deploy a regional self-managed certificate using Certificate Manager.\n\n \u003cbr /\u003e\n\n1. To create an SSL certificate:\n\n openssl req -x509 -newkey rsa:2048 \\\n -keyout \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e \\\n -out \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e -days 365 \\\n -subj '/CN=\u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e' -nodes -addext \\\n \"subjectAltName=DNS:\u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e: the path to save the key, such as `~/key.pem`\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e: the path to save the certificate, such as `~/cert.pem`\n - \u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e: the hostname for your Secure Web Proxy instance, such as `myswp.example.com`\n2. To upload the SSL certificate to Certificate Manager:\n\n gcloud certificate-manager certificates create \u003cvar translate=\"no\"\u003eCERTIFICATE_NAME\u003c/var\u003e \\\n --certificate-file=\u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e \\\n --private-key-file=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_NAME\u003c/var\u003e: the name of your certificate\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e: the path to the certificate file\n - \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e: the path to the key file\n\n For more information about SSL certificates, see\n [SSL certificates overview](/load-balancing/docs/ssl-certificates).\n\nWhat's next\n\n- [Deploy and test a Secure Web Proxy instance](/secure-web-proxy/docs/quickstart)\n- [Use tags to create policies](/secure-web-proxy/docs/use-tags)\n- [Use a URL list to create policies](/secure-web-proxy/docs/use-url-list)\n- [Assign static IP addresses for egress traffic](/secure-web-proxy/docs/assign-static-ip-addresses-for-egress-traffic)"]]
