[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eNetwork edge security policies allow you to configure rules to allow or block traffic at the edge of Google's network for external passthrough Network Load Balancers, protocol forwarding, and VMs with public IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eThese policies filter traffic by source and destination IP address ranges, similar to Cloud Next Generation Firewall, but they also uniquely offer byte-offset filtering for deep packet inspection, without consuming your own resources.\u003c/p\u003e\n"],["\u003cp\u003eTo use custom rules in network edge security policies, an active Cloud Armor Enterprise subscription and advanced network DDoS protection are required, which are configurable within your gcloud compute environment.\u003c/p\u003e\n"],["\u003cp\u003eYou can configure custom rules for network edge security policies using the Google Cloud CLI, which includes setting up user-defined fields, and rules that specify the action to be taken based on custom filter parameters.\u003c/p\u003e\n"],["\u003cp\u003eNetwork edge security policies provide metrics like \u003ccode\u003epacket_count\u003c/code\u003e and \u003ccode\u003epreview_packet_count\u003c/code\u003e in Cloud Monitoring, allowing you to track rule effectiveness, and you must enable the Network Security API to be able to view them.\u003c/p\u003e\n"]]],[],null,["# Configure network edge security policies\n\nNetwork edge security policies let you configure rules to allow or block traffic\nat the edge of Google's network. You can configure network edge security\npolicies for the following frontend types:\n\n- External passthrough Network Load Balancers\n- Protocol forwarding\n- VMs with public IP addresses\n\nYou can use network edge security policies to filter by source and destination\nIP address ranges similarly to Cloud Next Generation Firewall but without consuming your\nresources. In addition, a network edge security policy is the only security\npolicy type with support for [byte offset filtering](#byte-offset).\n| **Note:** Network edge security policies aren't supported for VM instances using [Dynamic NICs](/vpc/docs/multiple-interfaces-concepts#nic-types).\n\nConfigure custom rules for network edge security policies\n---------------------------------------------------------\n\n| **Note:** When you add a network edge security service to a network edge security policy, you can't remove the network edge security service using the Google Cloud console. You can only remove the network edge security service by using the Google Cloud CLI or the API.\n\nLike backend and edge security policies, you can configure custom rules for\nnetwork edge security policies. In the following example, you create a network\nedge security policy, configure a custom rule to allow traffic from only a given\nsource IP address range, and attach the policy to your backend service.\n\nNetwork edge security policies support several Cloud Armor filters,\nincluding unique filters like byte-offset filtering. For more information about\nwhat features network edge security policies support, see the\n[security policy overview](/armor/docs/security-policy-overview#policy-types).\nIn addition, you can deploy network edge security policies in\n[preview mode](/armor/docs/security-policy-overview#preview_mode).\n\nBefore you proceed, you must\n[enroll in Google Cloud Armor Enterprise](/armor/docs/armor-enterprise-using#enrolling)\nand\n[configure advanced network DDoS protection](/armor/docs/advanced-network-ddos#activate-advanced-ddos-protection).\nYou cannot use custom rules for network edge security policies without an active\nCloud Armor Enterprise subscription and advanced network DDoS protection.\n\nTo configure custom rules, follow these steps:\n\n1. Create a new network edge security policy with the name\n \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e in the region\n \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e. Don't use the same security policy\n that you used when you enabled advanced network DDoS protection.\n\n ```\n gcloud compute security-policies create POLICY_NAME \\\n --type=CLOUD_ARMOR_NETWORK \\\n --region=REGION\n ```\n2. Change your policy's\n [default rule](/armor/docs/security-policy-overview#default-rule) from\n `allow` to `deny` to block traffic that is not explicitly allowed by\n other rules.\n\n ```\n gcloud compute security-policies rules update 2147483647 \\\n --security-policy=POLICY_NAME \\\n --action=deny \\\n --region=REGION\n ```\n3. In the same security policy, add a rule at priority\n \u003cvar translate=\"no\"\u003eRULE_PRIORITY\u003c/var\u003e that allows requests in the source IP\n address range \u003cvar translate=\"no\"\u003eRANGE\u003c/var\u003e.\n\n ```\n gcloud compute security-policies rules create RULE_PRIORITY \\\n --security-policy=POLICY_NAME \\\n --network-src-ip-ranges=RANGE \\\n --action=allow \\\n --region=REGION\n ```\n4. Associate the security policy with your backend service\n \u003cvar translate=\"no\"\u003eBACKEND_SERVICE_NAME\u003c/var\u003e.\n\n ```\n gcloud compute backend-services update BACKEND_SERVICE_NAME \\\n --security-policy=POLICY_NAME \\\n --region=REGION\n ```\n\n Alternatively, you can associate the security policy with a single VM\n instance by using the following command: \n\n ```\n gcloud beta compute instances network-interfaces update VM_NAME \\\n --security-policy=POLICY_NAME \\\n --security-policy-region=REGION \\\n --network-interface=NETWORK_INTERFACE \\\n --zone=ZONE_NAME\n ```\n5. Optional: You can verify that the security policy is attached by using the\n following command. If successful, the `securityPolicy` field in the output\n has a link to your security policy resource.\n\n ```\n gcloud compute instances describe VM_NAME --zone=ZONE_NAME\n ```\n\nAfter you create the preceding example, you can continue to add rules to your\nnetwork edge security policy by using the `security-policies rules update` command.\nThe supported fields for network edge security policies are as follows:\n\nWhen you use the `--network-src-region-codes` flag with a network edge security\npolicy, you can use region codes for the following territories subject to\ncomprehensive US sanctions:\n\nConfigure byte-offset filtering\n-------------------------------\n\nIf you use external passthrough Network Load Balancers, protocol forwarding, or VMs with public IP\naddresses, Cloud Armor can perform deep packet inspection on ingressed\ntraffic. You can configure a security policy rule that matches on a specific\nTCP/UDP byte offset value. You can configure the rule to apply the rule action\nwhen the configured value is present, or alternatively when it is absent.\n\nThe following example allows traffic when the value is present, and denies\nall other traffic:\n\n1. Create a new network edge security policy. You can skip this step if you\n have an existing network edge security policy.\n\n ```\n gcloud compute security-policies create POLICY_NAME \\\n --type=CLOUD_ARMOR_NETWORK \\\n --region=REGION_NAME\n ```\n2. Update your network edge security policy to add user-defined fields\n by using the following parameters:\n\n - **Base** : value can be `IPv4`, `IPv6`, `TCP`, or `UDP`\n - **Offset**: offset of the field from the base in bytes\n - **Size** : size of the field in bytes (maximum value is `4`)\n - **Mask**: the mask for the bits in the field to be matched\n\n You can use up to eight user-defined fields per policy. In the following example,\n you create two user defined fields. \n\n ```\n gcloud compute security-policies add-user-defined-field POLICY_NAME \\\n --user-defined-field-name=USER_DEFINED_FIELD_NAME_TCP \\\n --base=TCP \\\n --offset=OFFSET \\\n --size=SIZE \\\n --mask=MASK \\\n --region=REGION_NAME\n ``` \n\n ```\n gcloud compute security-policies add-user-defined-field POLICY_NAME \\\n --user-defined-field-name=USER_DEFINED_FIELD_NAME_UDP \\\n --base=UDP \\\n --offset=OFFSET \\\n --size=SIZE \\\n --mask=MASK \\\n --region=REGION_NAME\n ```\n3. In your network edge security policy, add a rule with the same custom field name\n that you used in the previous example. Replace \u003cvar translate=\"no\"\u003eVALUE1\u003c/var\u003e\n and \u003cvar translate=\"no\"\u003eVALUE2\u003c/var\u003e with values that match traffic that\n you want to allow.\n\n ```\n gcloud compute security-policies rules create RULE_PRIORITY \\\n --security-policy=POLICY_NAME \\\n --network-user-defined-fields=\"USER_DEFINED_FIELD_NAME_TCP;VALUE1:VALUE2,USER_DEFINED_FIELD_NAME_UDP;VALUE1:VALUE2,USER_DEFINED_FIELD_NAME_UDP;VALUE1,VALUE2\" \\\n --action=allow \\\n --region=REGION_NAME\n ```\n4. Set the default rule in your network edge security policy to be a\n deny rule. You can skip this step if the default rule in your security\n policy is already a deny rule.\n\n ```\n gcloud compute security-policies rules update 2147483647 \\\n --security-policy=POLICY_NAME \\\n --action=deny \\\n --region=REGION_NAME\n ```\n5. Associate your network edge security policy with your external passthrough Network Load Balancer's\n backend service.\n\n ```\n gcloud compute backend-services update BACKEND_SERVICE_NAME \\\n --security-policy=POLICY_NAME \\\n --region=REGION_NAME\n ```\n\nMonitoring\n----------\n\nCloud Armor exports the following metrics to Cloud Monitoring for\neach of your network edge security policy rules:\n\n- `packet_count`\n - `Blocked`: a boolean value representing the result of an `allow` or `deny` \n rule action\n - `Count`: the value of `packet_count` incremented once for each 10,000 packets---for example, a `packet_count` value of `5` means that at least 50,000 packets have matched your rule\n- `preview_packet_count`: the same as `packet_count`, used for rules in preview mode\n\nTo view metrics for network edge security policies, you must first enable the\n[Network Security API](/traffic-director/docs/reference/network-security/rest)\n(`networksecurity.googleapis.com`). This permission is included in the\n[Compute Security Admin role](/iam/docs/understanding-roles#compute.securityAdmin)\n(`roles/compute.securityAdmin`). After you enable the Network Security API,\nyou can view the metrics in Monitoring in the Google Cloud console.\n\n[Go to Monitoring](https://console.cloud.google.com/monitoring)"]]
