[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-04-30。"],[[["\u003cp\u003eFirewall endpoints are zonal resources that provide Layer 7 advanced protection capabilities, such as intrusion prevention, to traffic within your network.\u003c/p\u003e\n"],["\u003cp\u003eCloud Next Generation Firewall (NGFW) utilizes packet intercept technology to redirect traffic from Virtual Private Cloud (VPC) networks to firewall endpoints for Layer 7 inspection, ensuring that only traffic with the appropriate configuration is intercepted.\u003c/p\u003e\n"],["\u003cp\u003eFirewall endpoints are created and managed in the same zone as the workloads they monitor to minimize latency, reduce costs, and ensure traffic reliability by avoiding cross-zonal traffic.\u003c/p\u003e\n"],["\u003cp\u003eIAM roles are necessary for managing firewall endpoints and their associations, with specific permissions required for creating, modifying, viewing, and deleting endpoints and associations within organizations and projects.\u003c/p\u003e\n"],["\u003cp\u003eFirewall endpoints have a capacity of up to 2 Gbps for traffic with Transport Layer Security (TLS) inspection and 10 Gbps for traffic without, and Google manages the underlying infrastructure, including load balancing, autoscaling, and lifecycle management.\u003c/p\u003e\n"]]],[],null,["# Firewall endpoint overview\n\nFirewall endpoint is a Cloud Next Generation Firewall resource that enables Layer 7\nadvanced protection capabilities, such as intrusion detection and prevention service, in your network.\n\nThis page provides a detailed overview of firewall endpoints and their\ncapabilities.\n\nSpecifications\n--------------\n\n- A firewall endpoint is an organizational resource created at the zonal level.\n\n- Firewall endpoints perform Layer 7 firewall inspection on the intercepted\n traffic.\n\n- Cloud Next Generation Firewall uses Google Cloud's packet intercept technology to\n transparently redirect traffic from the Google Cloud workloads in a\n Virtual Private Cloud (VPC) network to the firewall endpoints.\n\n Packet intercept is a Google Cloud capability that transparently inserts\n network appliances in the path of selected network traffic without\n modifying their existing routing policies.\n- Cloud NGFW redirects the workload traffic in a\n VPC network to the firewall endpoint only if the Layer 7\n inspection is configured to be applied to this flow.\n\n- Cloud NGFW adds a VPC network identifier to each\n packet redirected to the firewall endpoint for Layer 7 inspection. If you have\n multiple VPC networks with overlapping IP address ranges,\n this network identifier helps to ensure that each redirected packet is correctly\n associated with its VPC network.\n\n- You can create a firewall endpoint in a zone and attach it to one or more\n VPC networks to monitor workloads in the same zone. If your\n VPC network spans multiple zones, you can attach one firewall\n endpoint in each zone. If you don't attach a firewall endpoint to a\n VPC network in a specific zone, no Layer 7\n inspection is performed on the workload traffic for that zone.\n\n You use [firewall endpoint association](/firewall/docs/configure-firewall-endpoint-associations#create-endpoint-association)\n to attach a firewall endpoint to a VPC network.\n- The endpoint and the workloads for which you want to enable Layer 7 inspection\n must be in the same zone. Creating the firewall endpoint in the same\n zone as workloads has the following benefits:\n\n - Lower latency. Because firewall endpoints can intercept, inspect, and\n reinject the traffic back into the network, latency is lower than that\n of firewall endpoints in different zones.\n\n - No cross-zonal traffic. Keeping traffic within the same zone\n ensures lower costs.\n\n - More reliable traffic. Keeping traffic within the same zone removes\n the risk of cross-zonal outages.\n\n- Firewall endpoints can process up to 2 Gbps of traffic with Transport Layer\n Security (TLS) inspection, and 10 Gbps of traffic without TLS inspection.\n Sending more traffic can result in packet loss. To monitor the firewall\n endpoint's capacity utilization, see\n [firewall endpoint metrics](/monitoring/api/metrics_gcp_i_o#gcp-networksecurity).\n\n- Firewall endpoints can have a per-connection throughput maximum of 250 Mbps of\n traffic with TLS inspection and 1.25 Gbps of traffic without TLS inspection.\n\n- You can delete a firewall endpoint only when there are no VPC\n networks associated with it.\n\n- Google manages the infrastructure, load balancing, autoscaling, and\n lifecycle of the firewall endpoints. When you create a firewall endpoint,\n Google provides a set of dedicated virtual machine (VM) instances, which\n ensures reliability, performance, and security isolation for your traffic,\n along with certificate management.\n\n- Google provides high availability by using proper failover mechanisms for\n the firewall endpoints, which ensures reliable firewall protection for all\n VM instances covered within the attached VPC network.\n\nFirewall endpoint associations\n------------------------------\n\nFirewall endpoint association links a firewall endpoint to a\nVPC network in the same zone. After you define this association,\nCloud NGFW forwards the zonal workload traffic in your\nVPC network that requires Layer 7 inspection to the attached\nfirewall endpoint.\n\nIdentity and Access Management roles\n------------------------------------\n\nIdentity and Access Management (IAM) roles govern the following actions for managing the\nfirewall endpoints:\n\n- Creating a firewall endpoint in an organization\n- Modifying or deleting a firewall endpoint\n- Viewing details of a firewall endpoint\n- Viewing all the firewall endpoints configured in an organization\n\nThe following table describes the roles that are necessary for each step.\n\nIAM roles govern the following actions for the\nfirewall endpoint associations:\n\n- Creating a firewall endpoint association in a project\n- Modifying or deleting a firewall endpoint association\n- Viewing details of a firewall endpoint association\n- Viewing all the firewall endpoint associations configured in a project\n\nThe following table describes the roles that are necessary for each step.\n\nQuotas\n------\n\nTo view quotas associated with firewall endpoints, see [Quotas and limits](/firewall/docs/quotas).\n\nPricing\n-------\n\nPricing for firewall endpoints is described in the [Cloud NGFW pricing](/firewall/pricing).\n\nWhat's next\n-----------\n\n- [Configure intrusion detection and prevention service](/firewall/docs/configure-intrusion-prevention)\n- [Create and manage firewall endpoints](/firewall/docs/configure-firewall-endpoints)\n- [Create and manage firewall endpoint associations](/firewall/docs/configure-firewall-endpoint-associations)"]]
