Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Questo documento descrive i passaggi di configurazione iniziali necessari per utilizzare Secure Web Proxy.
Prima di poter utilizzare Secure Web Proxy, completa la seguente configurazione:
Ottieni i ruoli Identity and Access Management necessari.
Crea o seleziona un Google Cloud progetto.
Abilita la fatturazione e le API Google Cloud pertinenti.
Crea subnet proxy.
Carica un certificato SSL in Certificate Manager.
Questa configurazione è necessaria solo la prima volta che utilizzi Secure Web Proxy.
Ottenere ruoli IAM
Per ottenere le autorizzazioni:
Per ottenere le autorizzazioni
necessarie per eseguire il provisioning di un'istanza di Secure Web Proxy,
chiedi all'amministratore di concederti i seguenti ruoli IAM nel progetto:
Per configurare i criteri e eseguire il provisioning di un'istanza Secure Web Proxy:
Ruolo Compute Network Admin (roles/compute.networkAdmin)
(Facoltativo) Se hai un insieme di utenti responsabili della gestione continua dei criteri, concedi loro il ruolo Amministratore criteri di sicurezza (roles/compute.orgSecurityPolicyAdmin) per consentire loro di gestire i criteri di sicurezza.
Crea un progetto Google Cloud
Per creare o selezionare un progetto: Google Cloud
Crea una subnet proxy per ogni regione in cui esegui il deployment di Secure Web Proxy.
Crea una subnet di almeno /26 o 64 indirizzi solo proxy. Consigliamo
una dimensione della subnet di /23, ovvero 512 indirizzi solo proxy, perché la connettività
di Secure Web Proxy è fornita da un pool di indirizzi IP riservati
a Secure Web Proxy. Questo pool viene utilizzato per allocare indirizzi IP univoci sul lato di uscita di ogni proxy per l'interazione con Cloud NAT e le destinazioni nella rete VPC.
PROXY_SUBNET_NAME: il nome che vuoi assegnare alla subnet proxy
REGION: la regione in cui eseguire il deployment della subnet proxy
NETWORK_NAME: il nome della tua rete
IP_RANGE: l'intervallo di subnet, ad esempio 192.168.0.0/23
Deployment di un certificato SSL
I certificati SSL sono facoltativi per Secure Web Proxy. Per eseguire il deployment dei certificati
utilizzando Certificate Manager, utilizza uno dei seguenti metodi:
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[],[],null,["This document describes the initial setup steps required to use Secure Web Proxy.\n\nBefore you can use Secure Web Proxy, complete the following setup:\n\n- Obtain necessary Identity and Access Management roles.\n- Create or select a Google Cloud project.\n- Enable billing and relevant Google Cloud APIs.\n- Create proxy subnets.\n- Upload an SSL certificate to Certificate Manager.\n\nThis setup is only required the first time you use Secure Web Proxy.\n\nObtain IAM roles\n\nTo obtain permissions, follow these steps:\n\n1.\n\n To get the permissions that\n you need to provision a Secure Web Proxy instance,\n\n ask your administrator to grant you the\n following IAM roles on your project:\n\n - To configure policies and provision a Secure Web Proxy instance: [Compute Network Admin role](/iam/docs/roles-permissions/compute#compute.networkAdmin) (`roles/compute.networkAdmin`)\n - To upload explicit Secure Web Proxy TLS certificates: [Certificate Manager Editor role](/iam/docs/roles-permissions/certificatemanager#certificatemanager.editor) (`roles/certificatemanager.editor`)\n\n\n For more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\n You might also be able to get\n the required permissions through [custom\n roles](/iam/docs/creating-custom-roles) or other [predefined\n roles](/iam/docs/roles-overview#predefined).\n2. Optional: If you have a set of users responsible for ongoing policy\n management, grant them the Security Policy Admin role\n (`roles/compute.orgSecurityPolicyAdmin`) to let them manage security\n policies.\n\nCreate a Google Cloud project\n\nTo create or select a Google Cloud project, follow these steps: \n\nConsole\n\nIn the Google Cloud console, on the project selector page, select or\n[create a Google Cloud project](/resource-manager/docs/creating-managing-projects).\n\n[Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n\nCloud Shell\n\n- Create a Google Cloud project:\n\n gcloud projects create \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the project ID that you\n want.\n- Select the Google Cloud project that you created:\n\n gcloud config set project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\nEnable billing\n\nMake sure that billing is enabled for your Google Cloud project. For more\ninformation, see [Enable, disable, or change billing for a project](/billing/docs/how-to/modify-project)\nand [Verify the billing status of your projects](/billing/docs/how-to/verify-billing-enabled).\n\nEnable the required APIs\n\nYou must enable the following Google Cloud APIs:\n\n- `compute.googleapis.com`\n- `certificatemanager.googleapis.com`\n- `networkservices.googleapis.com`\n- `networksecurity.googleapis.com`\n- `privateca.googleapis.com` (optional)\n\nTo enable the required Google Cloud APIs, do the following: \n\nConsole\n\n1. Enable the Compute Engine API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=compute)\n2. Enable the Certificate Manager API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=certificatemanager)\n3. Enable the Network Services API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=networkservices)\n4. Enable the Network Security API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=networksecurity)\n5. Optional: If you plan to [configure TLS inspection](/secure-web-proxy/docs/enable-tls-inspection)\n for your proxy, then you must enable the Certificate Authority Service API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=privateca)\n\ngcloud\n\nRun the following command: \n\n```\n gcloud services enable \\\n --compute.googleapis.com \\\n --certificatemanager.googleapis.com \\\n --networkservices.googleapis.com \\\n --networksecurity.googleapis.com \\\n --privateca.googleapis.com\n```\n\nCreate a proxy subnet\n\nCreate a proxy subnet for each region that you deploy Secure Web Proxy in.\nCreate a subnet size of at least /26, or 64 proxy-only addresses. We recommend\na subnet size of /23, or 512 proxy-only addresses, because Secure Web Proxy\nconnectivity is provided by a pool of IP addresses reserved for\nSecure Web Proxy. This pool is used to allocate unique IP addresses on the\negress side of each proxy for interaction with Cloud NAT and destinations in\nthe VPC network.\n**Important:** This subnet is *not* referenced when creating a Secure Web Proxy instance. For more information, see [Proxy-only subnets for Envoy-based load balancers](/load-balancing/docs/proxy-only-subnets). \n\ngcloud \n\n gcloud compute networks subnets create \u003cvar translate=\"no\"\u003ePROXY_SUBNET_NAME\u003c/var\u003e \\\n --purpose=REGIONAL_MANAGED_PROXY \\\n --role=ACTIVE \\\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --network=\u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e \\\n --range=\u003cvar translate=\"no\"\u003eIP_RANGE\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROXY_SUBNET_NAME\u003c/var\u003e: the name that you want for your proxy subnet\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region to deploy the proxy subnet in\n- \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e: your network name\n- \u003cvar translate=\"no\"\u003eIP_RANGE\u003c/var\u003e: the subnet range, such as `192.168.0.0/23`\n\nDeploy an SSL certificate\n\nSSL certificates are optional for Secure Web Proxy. To deploy certificates\nusing Certificate Manager, use any of the following methods:\n\n- Deploy a regional Google-managed certificate with per-project DNS\n authorization. For more information, see [Deploy a regional Google-managed certificate](/certificate-manager/docs/deploy-google-managed-regional).\n\n- Deploy a regional Google-managed certificate with Certificate Authority Service. For\n more information, see [Deploy a regional Google-managed certificate with CA Service](/certificate-manager/docs/deploy-google-managed-cas-regional).\n\n- Deploy a regional self-managed certificate.\n\n The following example shows how to deploy a regional self-managed certificate using Certificate Manager.\n\n \u003cbr /\u003e\n\n1. To create an SSL certificate:\n\n openssl req -x509 -newkey rsa:2048 \\\n -keyout \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e \\\n -out \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e -days 365 \\\n -subj '/CN=\u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e' -nodes -addext \\\n \"subjectAltName=DNS:\u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e: the path to save the key, such as `~/key.pem`\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e: the path to save the certificate, such as `~/cert.pem`\n - \u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e: the hostname for your Secure Web Proxy instance, such as `myswp.example.com`\n2. To upload the SSL certificate to Certificate Manager:\n\n gcloud certificate-manager certificates create \u003cvar translate=\"no\"\u003eCERTIFICATE_NAME\u003c/var\u003e \\\n --certificate-file=\u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e \\\n --private-key-file=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_NAME\u003c/var\u003e: the name of your certificate\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e: the path to the certificate file\n - \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e: the path to the key file\n\n For more information about SSL certificates, see\n [SSL certificates overview](/load-balancing/docs/ssl-certificates).\n\nWhat's next\n\n- [Deploy and test a Secure Web Proxy instance](/secure-web-proxy/docs/quickstart)\n- [Use tags to create policies](/secure-web-proxy/docs/use-tags)\n- [Use a URL list to create policies](/secure-web-proxy/docs/use-url-list)\n- [Assign static IP addresses for egress traffic](/secure-web-proxy/docs/assign-static-ip-addresses-for-egress-traffic)"]]
