Using hierarchical firewall policies

This page assumes that you are familiar with the concepts described in the Hierarchical firewall policies overview. To see examples of hierarchical firewall policy implementations, see Hierarchical firewall policy examples.

Limitations

• Hierarchical firewall policy rules can only use IP ranges to define sources for ingress rules. Source tags and source service accounts are only supported by VPC firewall rules.
• Hierarchical firewall policy rules do not support using network tags to define targets. You must use a target VPC network or target service account instead.
• Firewall policies can be applied at folder and organization level, but not at the VPC network level. Regular VPC firewall rules are supported for VPC networks.
• Only one firewall policy can be associated to a node (folder or organization), although the virtual machine (VM) instances under a folder can inherit rules from the entire hierarchy of nodes above the VM.
• Firewall Rules Logging is supported for allow and deny rules but is not supported for goto_next rules.
• IPv6 addresses are not supported.

Important: The Google Cloud Console does not yet support the new compute.orgFirewallPolicyAdmin and compute.orgFirewallPolicyUser roles. For the time being, users of the Cloud Console need to the compute.orgSecurityPolicyAdmin and/or compute.orgSecurityPolicyUser roles to create and use hierarchical firewall policies. The new roles are supported in the gcloud command-line tool and the API.

Note: When you create a policy, you can give it a short name that is easy to remember. The short name field was previously called display name, and it may appear as display name in certain cases for awhile.

Firewall policy tasks

Creating a firewall policy

You can create a policy at any node, organization, or folder of your organization hierarchy. After you create a policy, you can associate it with any node of your organization. After it's associated, the policy's rules become active for VMs under the associated node in the hierarchy.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.create

Roles

• compute.orgFirewallPolicyAdmin on the node where you want to create the policy

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or a folder within your organization.

3. Click Create firewall policy.

4. Give the policy a Name.

5. If you want to create rules for your policy, click Continue, and then click Add rule.

   For details, see Creating firewall rules.

6. If you want to associate the policy with a node, click Continue, and then click Associate.

   For details, see Associating a policy with the organization or a folder.

7. Click Create.

gcloud

gcloud compute firewall-policies create \
    [--organization ORG_ID] | --folder FOLDER_ID] \
    --short-name SHORT_NAME

Specify the following:

• ORG_ID: your organization's ID
  Specify this ID if you are creating the policy at the organization level. This ID only indicates where the policy lives; it does not automatically associate the policy with the organization node.
• FOLDER_ID: the ID of a folder
  Specify this ID if you are creating the policy in a given folder. This ID only indicates where the policy lives; it does not automatically associate the policy with that folder.
• SHORT_NAME: a name for the policy
  A policy created by using the gcloud command-line tool has two names: a system-generated name and a short name provided by you. When using the gcloud command-line tool to update an existing policy, you can provide either the system-generated name or the short name and the organization ID. When using the API to update the policy, you must provide the system-generated name.

Creating firewall rules

Hierarchical firewall policy rules must be created in a hierarchical firewall policy. The rules are not active until you associate the containing policy to a node.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.update

Roles

• compute.orgFirewallPolicyAdmin on the node containing the policy or on the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains your policy.

3. Click the name of your policy.

4. Click Add rule.

5. Populate the rule fields:

   1. Priority: the numeric evaluation order of the rule. A rule with a priority of 1 is evaluated first. Priorities must be unique for each rule. A good practice is to give rules priority numbers that allow later insertion (such as 100, 200, 300).
   2. Set Logs collection to On or Off.
   3. Under Direction of traffic, specify whether this rule is an Ingress or Egress rule.
   4. Under Action on match, specify whether connections that match the rule are allowed (Allow), denied (Deny), or whether the evaluation of the connection is passed to the next lower firewall rule in the hierarchy (Go to next).
   5. Optional: You can restrict the rule to certain networks only by specifying them in the Target network field.
   6. Optional: You can restrict the rule to VMs running as a specified service account by specifying the service accounts in the Target service account field.
   7. If you are creating an Ingress rule, specify which source IP ranges this rule applies to. If you are creating an Egress rule, specify which destination IP ranges this rule applies to. In both cases, specify 0.0.0.0/0 for all IP addresses.
   8. Under Protocols and ports, either specify that the rule applies to all protocols and all destination ports or specify to which protocols and destination ports it applies.
   9. Click Create.

6. Click Add rule to add another rule. Click Continue > Associate to associate the policy with a node, or click Create to create the policy.

gcloud

gcloud compute firewall-policies rules create PRIORITY \
    --organization ORG_ID \
    --firewall-policy POLICY_NAME \
    --direction DIRECTION \
    --action ACTION \
    --layer4-configs PROTOCOL_PORT \
    --src-ip-ranges IP_RANGES \
    [--enable-logging | --no-enable-logging] \
    [--disabled]

Specify the following:

• PRIORITY: the numeric evaluation order of the rule
  A rule with a priority of 1 is evaluated first. Priorities must be unique for each rule. A good practice is to give rules priority numbers that allow later insertion (such as 100, 200, 300).
• ORG_ID: your organization's ID
• POLICY_NAME: either the short name or the system-generated name of the policy
• DIRECTION: indicates whether the rule is an ingress or egress rule; default is ingress
• ACTION is one of the following:
  • allow: allows connections that match the rule
  • deny: denies connections that match the rule
  • goto_next: passes connection evaluation to the next level in the hierarchy, either a folder or the network
• PROTOCOL_PORT: a comma-separated list of protocols (tcp, udp, icmp, esp, ah, sctp), protocols and destination ports (tcp:80), or protocols and destination port ranges (tcp:5000-6000)
  You cannot specify a port or port range without a protocol. For icmp, you cannot specify a port or port range; example:
  --layer4-configs tcp:80, tcp:443, udp:4000-5000, icmp
• IP_RANGES: a comma-separated list of CIDR-formatted IP ranges; example:
  --src-ip-ranges 10.100.0.1/32, 10.200.0.0/24
• --disabled: indicates that the firewall rule, although it exists, is not to be considered when processing connections; omitting this flag enables the rule, or you can specify --no-disabled.

Associating a policy with the organization or folder

Associate a policy with a node to activate the policy rules for any VMs under the node in the hierarchy.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.organizations.setFirewallPolicy on the target node
• compute.firewallPolicies.addAssociation on the firewall policy

Roles

• compute.orgSecurityResourceAdmin on the target node and compute.orgFirewallPolicyUser on the policy node or on the policy itself
or
• compute.orgSecurityResourceAdmin on the target node and compute.orgFirewallPolicyAdmin on the policy node or on the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains your policy.

3. Click your policy.

4. Click the Associated with tab.

5. Click Associate.

6. Select the organization root or select folders within the organization.

7. Click Associate.

gcloud

gcloud compute firewall-policies associations create \
    --security-policy POLICY_NAME \
    --organization ORG_ID \
    [ --folder FOLDER_ID ] \
    [ --name ASSOCIATION_NAME ] \
    [ --replace-association-on-target ]

Specify the following:

• POLICY_NAME: either the short name or the system-generated name of the policy
• ORG_ID: your organization's ID
• FOLDER_ID: if you are associating the policy with a folder, specify it here; omit if you are associating the policy to the organization level
• ASSOCIATION_NAME: an optional name for the association; if unspecified, the name is set to "organization ORG_ID" or "folder FOLDER_ID"
• --replace-association-on-target
  By default, if you attempt to insert an association to an organization or folder node that already has an association, the method fails. If you specify this flag, the existing association is deleted at the same time that the new association is created. This prevents the node from being without a policy during the transition.

Moving a policy from one node to another

Moving a policy changes which node owns the policy. To move a policy, you must have move permissions on both the old and new nodes.

Moving a policy does not affect any existing policy associations or the evaluation of existing rules, but it might affect who has permissions to modify or associate the policy after the move.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.move

Roles

• compute.orgFirewallPolicyAdmin on the new node and on either the old node or the policy itself

Console

Use the gcloud command-line tool for this procedure.

gcloud

gcloud compute firewall-policies move POLICY_NAME \
    --organization ORG_ID \
    [--folder FOLDER_ID]

Specify the following:

• POLICY_NAME: either the short name or the system-generated name of the policy that you are moving
• ORG_ID: your organization's ID; if you are moving the policy to the organization node, specify this ID but do not specify a folder
• FOLDER_ID: if you are associating the policy with a folder, specify it here; omit if you are associating the policy to the organization node

Updating a policy description

The only policy field that can be updated is the Description field.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.update

Roles

• compute.orgFirewallPolicyAdmin on the node where the policy lives or on the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click Edit.

4. Modify the Description.

5. Click Save.

gcloud

gcloud compute firewall-policies list-rules POLICY_NAME \
    --organization ORG_ID

Listing policies

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.list

Roles

• compute.orgFirewallPolicyAdmin
or
• compute.orgFirewallPolicyUser

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

   The Firewall policies associated with this node or inherited by the node section shows which policies are associated with this node in your resource hierarchy.

   The Firewall policies located in this node section lists policies that are owned by this node in the resource hierarchy. Such policies might not be associated with this node, but are available to be associated with this or other nodes.

gcloud

gcloud compute firewall-policies list \
    [--organization ORG_ID | --folder FOLDER_ID]

Describing a policy

You can see all the details of a policy, including all its firewall rules. In addition, you can see many attributes that are in all the rules in the policy. These attributes count toward a per-policy limit.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.get

Roles

• compute.orgFirewallPolicyAdmin
or
• compute.orgFirewallPolicyUser on the node or the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click your policy.

gcloud

gcloud compute firewall-policies describe POLICY_NAME \
    --organization ORG_ID

Deleting a policy

You must delete all associations on an organization firewall policy before you can delete it.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.delete

Roles

• compute.orgFirewallPolicyAdmin on the node or on the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click the policy that you want to delete.

4. Click the Associated with tab.

5. Select all associations.

6. Click Remove.

7. After all associations are removed, click Delete.

gcloud

1. List all nodes associated with a firewall policy:

   gcloud compute firewall-policies describe
       --security-policy POLICY_NAME \
       --organization ORG_ID
   

2. Delete individual associations. To remove the association, you must have the compute.orgSecurityResourceAdmin role on the associated node or ancestor of that node.

   gcloud compute firewall-policies associations delete NODE_NAME \
       --organization ORG_ID \
       --security-policy POLICY_NAME
   

3. Delete the policy:

   gcloud compute firewall-policies delete POLICY_NAME \
       --organization ORG_ID
   

Listing associations for a node

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.organizations.listAssociations

Roles

• compute.orgSecurityResourceAdmin

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Associated and inherited policies are listed under Firewall policies associated with this node or inherited by the node.

gcloud

gcloud compute firewall-policies associations list \
  [--organization ORG_ID | --folder FOLDER_ID]

Listing associations for a policy

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.organizations.listAssociations

Roles

• compute.orgSecurityResourceAdmin on the node or on the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click your policy.

4. Click the Associations tab.

5. Associations are listed in the table.

gcloud

gcloud compute firewall-policies describe POLICY_ID

Deleting an association

To stop enforcement of a firewall policy on the organization or a folder, delete the association.

However, if you intend to swap out one firewall policy for another, it is not necessary to delete the existing association first. Doing so would leave a period of time where neither policy is enforced. Instead, replace the existing policy when you associate a new policy.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.organizations.setFirewallPolicy on the target node
• compute.firewallPolicies.addAssociation on the firewall policy

Roles

• compute.orgSecurityResourceAdmin on the target node and compute.orgFirewallPolicyUser on the policy node or the policy itself
or
• compute.orgSecurityResourceAdmin on the target node and compute.orgFirewallPolicyAdmin on the policy node or the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click your policy.

4. Click the Associations tab.

5. Select the association that you want to delete.

6. Click Remove.

gcloud

gcloud compute firewall-policies associations delete ASSOCIATION_NAME \
    --security-policy POLICY_NAME \
    --organization ORG_ID

Rule tasks

Creating a rule in an existing firewall policy

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.update

Roles

• compute.orgFirewallPolicyAdmin on the node that owns the policy or on the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click your policy.

4. Click Add rule.

5. Populate the rule fields:

   1. Priority: the numeric evaluation order of the rule. A rule with a priority of 1 is evaluated first. Priorities must be unique for each rule. A good practice is to give rules priority numbers that allow later insertion (such as 100, 200, 300).
   2. Set Logs collection to On or Off.
   3. Under Direction of traffic, specify whether this rule is an Ingress or Egress rule.
   4. Under Action on match, specify whether connections that match the rule are allowed (Allow), denied (Deny), or whether the evaluation of the connection is passed to the next lower firewall rule in the hierarchy (Go to next).
   5. Optional: You can restrict the rule to certain networks only by specifying them in the Target network field.
   6. Optional: You can restrict the rule to VMs running as a specified service account by specifying the service accounts in the Target service account field.
   7. If you are creating an Ingress rule, specify which source IP ranges this rule applies to. If you are creating an Egress rule, specify which destination IP ranges this rule applies to. In both cases, specify 0.0.0.0/0 for all.
   8. Under Protocols and ports, either specify that the rule applies to all protocols and all destination ports or specify to which protocols and destination ports it applies.

6. Click Create.

gcloud

gcloud compute firewall-policies rules create PRIORITY \
    --organization ORG_ID \
    --security-policy POLICY_NAME \
    [--description DESCRIPTION \
    [--action ACTION] \
    [--dest-ip-ranges DEST_RANGES] \
    [--layer4-configs PROTOCOL_PORT] \
    [--direction DIRECTION] \
    [--disabled] \
    [--src-ip-ranges SRC_RANGES] \
    [--target-resources NETWORKS] \
    [--target-service-accounts SERVICE_ACCOUNTS] \
    [--enable-logging | --no-enable-logging]

Specify the following:

• PRIORITY: the numeric evaluation order of the rule
  A rule with a priority of 1 is evaluated first. Priorities must be unique for each rule. A good practice is to give rules priority numbers that allow later insertion (such as 100, 200, 300).
• ORG_ID: your organization's ID
• POLICY_NAME: the name of the policy to contain the rule
• DESCRIPTION: the text description of the rule
• ACTION is one of the following:
  • allow: allows connections that match the rule
  • deny: denies connections that match the rule
  • goto_next: passes connection evaluation to the next level in the hierarchy, either a folder or the network
• DEST_RANGES: for egress rules only, a comma-separated list of CIDR-formatted IP ranges that indicates which target IP addresses are affected by the rule; example:
  --dest-ip-ranges 10.100.0.1/32, 10.200.0.0/24
• PROTOCOL_PORT: a comma-separated list of protocols (tcp, udp, icmp, esp, ah, sctp), protocols and destination ports (tcp:80), or protocols and destination port ranges (tcp:5000-6000)
  You cannot specify a port or port range without a protocol. For icmp, you cannot specify a port or port range; example:
  --layer4-configs tcp:80, tcp:443, udp:4000-5000, icmp
• DIRECTION: indicates whether the rule is an ingress or egress rule; default is ingress
  Destination ranges are only supported for egress connections. Source ranges are only supported for ingress connections.
• --disabled: indicates that the firewall rule, although it exists, is not to be considered when processing connections; omitting this flag enables the rule, or you can specify --no-disabled.
• SRC_RANGES: for ingress rules only, a comma-separated list of CIDR-formatted IP ranges that indicates which source IP addresses are affected by the rule; example:
  --src-ip-ranges 10.100.0.1/32, 10.200.0.0/24
• NETWORKS: a comma-separated list of networks where this rule is applied; if omitted, the rule applies to all networks under the node
• SERVICE_ACCOUNTS: a comma-separated list of service accounts; the rule is only applied to VMs of this service account
• --enable-logging and --no-enable-logging: enables or disables Firewall Rules Logging for the given rule

Listing all rules in a policy

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.get

Roles

• compute.orgFirewallPolicyAdmin
or
• compute.orgFirewallPolicyUser on the node or on the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click your policy. Rules are listed on the Firewall rules tab.

gcloud

gcloud compute firewall-policies list-rules POLICY_NAME \
    --organization ORG_ID

Describing a rule

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.get

Roles

• compute.orgFirewallPolicyAdmin
or
• compute.orgFirewallPolicyUser

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click your policy.

4. Click the priority of the rule.

gcloud

gcloud compute firewall-policies rules describe PRIORITY \
    --organization ORG_ID \
    --security-policy POLICY_NAME

Specify the following:

• PRIORITY: the priority of the rule that you want to view; because each rule must have a unique priority, this setting uniquely identifies a rule
• ORG_ID: your organization's ID
• POLICY_NAME: the short name or system-generated name of the policy that contains the rule

Updating a rule

For field descriptions, see Creating firewall rules.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.update

Roles

• compute.orgFirewallPolicyAdmin

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click your policy.

4. Click the priority of the rule.

5. Click Edit.

6. Modify the fields that you want to change.

7. Click Save.

gcloud

gcloud compute firewall-policies rules update RULE_NAME \
    --security-policy POLICY_NAME \
    --organization ORG_ID \
    [...fields you want to modify...]

Cloning rules from one policy to another

Remove all rules from the target policy and replace them with the rules in the source policy.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.copyRule

Roles

• compute.orgFirewallPolicyAdmin on the node or on the policies themselves

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click the policy that you want to copy rules from.

4. Click Clone at the top of the screen.

5. Provide the name of a target policy.

6. Click Continue > Associate if you want to associate the new policy immediately.

7. Click Clone.

gcloud

gcloud compute firewall-policies clone-rules POLICY_NAME \
    --organization ORG_ID \
    --source-security-policy SOURCE_POLICY

Specify the following:

• POLICY_NAME: the policy to receive the copied rules
• ORG_ID: your organization's ID
• SOURCE_POLICY: the policy to copy the rules from; must be the URL of the resource

Deleting a rule from a policy

Deleting a rule from a policy removes the rule from all VMs that are inheriting the rule.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.update

Roles

• compute.orgFirewallPolicyAdmin on the node hosting the policy or on the policy itself

Console

1. In the Google Cloud Console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click your policy.

4. Select the rule that you want to delete.

5. Click Delete.

gcloud

gcloud compute firewall-policies rules delete PRIORITY \
    --organization ORG_ID \
    --security-policy POLICY_NAME

Specify the following:

• PRIORITY: the priority of the rule that you want to delete from the policy
• ORG_ID: your organization's ID
• POLICY_NAME: the policy containing the rule

Get effective firewall rules for a network

Displays all hierarchical firewall policy rules and VPC firewall rules applied to a specified VPC network.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.networks.getEffectiveFirewalls on the network

Roles

• compute.securityAdmin
• compute.viewer
• compute.networkUser
• compute.networkViewer

Console

Use the gcloud command-line tool for this procedure.

gcloud

gcloud compute networks get-effective-firewalls NETWORK_NAME

Specify the following:

• NETWORK_NAME: the network to get effective rules for

Get effective firewall rules for a VM interface

Displays all hierarchical firewall policy rules and VPC firewall rules applied to a specified Compute Engine VM interface.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.instances.getEffectiveFirewalls on the network

Roles

• compute.securityAdmin
• compute.viewer
• compute.networkUser
• compute.networkViewer

Console

1. In the Google Cloud Console, go to the VM instances page.

   Go to the VM instances page

2. In the project selector pull-down menu, select the project containing the VM.

3. Click the VM.

4. Under Network interfaces, click the interface.

5. Effective firewall rules appear under Firewall and routes details.

gcloud

gcloud compute instances network-interfaces get-effective-firewalls INSTANCE_NAME \
    [--network-interface INTERFACE \
    [--zone ZONE]

Specify the following:

• INSTANCE_NAME: the VM to get effective rules for; if no interface is specified, returns rules for the primary interface (nic0)
• INTERFACE: the VM interface to get effective rules for; default is nic0
• ZONE: the zone of the VM; optional if the desired zone is already set as the default

Troubleshooting

This section contains explanations for error messages you might encounter.

FirewallPolicy may not specify a name. One will be provided.

You cannot specify a policy name. Hierarchical firewall policy "names" are numerical IDs generated by Google Cloud when the policy is created. However, you can specify a friendlier short name that acts as an alias in many contexts.

FirewallPolicy may not specify associations on creation.

Associations can only be created after hierarchical firewall policies are created.

Can not move firewall policy to a different organization.

Hierarchical firewall policy moves must stay within the same organization.

The attachment already has an association. Please set the option of replacing existing association to true if you want to replace the old one.

If a node is already attached with a hierarchical firewall policy, the attachment operation fails unless the option of replacing the existing associations is set to true.

Cannot have rules with the same priorities.

Priorities of rules are required to be unique within a hierarchical firewall policy.

Direction must be specified on firewall policy rule.

When creating hierarchical firewall policy rules by sending REST requests directly, the direction of the rule must be specified. When using the gcloud command-line tool and no direction is specified, it defaults to INGRESS.

Can not specify enable_logging on a goto_next rule.

Firewall Logging is not allowed for rules with goto_next action, as goto_next actions are used to represent the evaluation order of different firewall policies, and are not terminal actions i.e. ALLOW or DENY.

IP protocol must be specified on firewall policy rule.

The configuration of DestinationPort in the firewall policy rule must set the field of protocol, such as TCP, UDP and ICMP.

IPv6 addresses are not supported for firewall rules.

Only IPv4 addresses are supported for organization firewall policies.

Should not specify src range for egress direction.

Egress rules can only contain destination IP ranges.

Must specify dest range for egress direction.

Egress rules must specify a destination IP range in the rule.

Should not specify dest range for ingress direction.

Ingress rules can only contain source IP ranges.

Must specify src range for ingress direction.

Ingress rules must specify a source IP range. Source tag and source service account are not supported for hierarchical firewall policies.

For more details on troubleshooting for firewall policy rules, see VPC firewall rules troubleshooting

What's next

• To understand VPC firewall rules, see VPC firewall rules.
• To see examples of hierarchical firewall policy implementations, see Hierarchical firewall policy examples.