配额用于指定您可以使用的可计数共享资源的数量。配额由 Cloud 新一代防火墙等 Google Cloud 服务定义。
系统限制是无法更改的固定值。
Google Cloud 使用配额来帮助确保公平性并减少资源使用和可用性的激增。配额用于限制您的 Google Cloud 项目可使用的Google Cloud 资源的数量。配额适用于一系列资源类型，包括硬件、软件和网络组件。例如，配额可以限制对某项服务的 API 调用次数、您的项目并发使用的负载均衡器数量或者您可以创建的项目数量。配额可以防止服务过载，从而保护Google Cloud 用户社区。配额还可帮助您管理自己的 Google Cloud 资源。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eCloud Next Generation Firewall (NGFW) uses quotas to manage the usage of shared resources across Google Cloud projects, ensuring fairness and preventing service overload, while system limits are fixed constraints that cannot be altered.\u003c/p\u003e\n"],["\u003cp\u003eQuotas apply at the Google Cloud project level, and define the maximum amount of specific resources, such as firewall rules, address groups, and policies, that can be used in each project, and in certain cases, organizations.\u003c/p\u003e\n"],["\u003cp\u003eQuotas can typically be increased by submitting a request through the Google Cloud console, while system limits are fixed and cannot be increased, with the type of resource and where they apply being able to be found in the document.\u003c/p\u003e\n"],["\u003cp\u003eFirewall policies have limits on the number of attributes and domain names that can be included, with each firewall rule contributing to the total count of these attributes.\u003c/p\u003e\n"],["\u003cp\u003eExceeding a quota generally results in the system blocking access to the resource, with error codes or messages being displayed via the CLI or API.\u003c/p\u003e\n"]]],[],null,["# Quotas and limits\n\nThis document lists the quotas and system limits that apply to\nCloud Next Generation Firewall.\n\n- *Quotas* specify the amount of a countable, shared resource that you can use. Quotas are defined by Google Cloud services such as Cloud Next Generation Firewall.\n- *System limits* are fixed values that cannot be changed.\n\nGoogle Cloud uses quotas to help ensure fairness and reduce\nspikes in resource use and availability. A quota restricts how much of a\nGoogle Cloud resource your Google Cloud project can use. Quotas\napply to a range of resource types, including hardware, software, and network\ncomponents. For example, quotas can restrict the number of API calls to a\nservice, the number of load balancers used concurrently by your project, or the\nnumber of projects that you can create. Quotas protect the community of\nGoogle Cloud users by preventing the overloading of services. Quotas also\nhelp you to manage your own Google Cloud resources.\n\nThe Cloud Quotas system does the following:\n\n- Monitors your consumption of Google Cloud products and services\n- Restricts your consumption of those resources\n- Provides a way to [request changes to the quota value](/docs/quotas/help/request_increase) and [automate quota adjustments](/docs/quotas/quota-adjuster)\n\nIn most cases, when you attempt to consume more of a resource than its quota\nallows, the system blocks access to the resource, and the task that\nyou're trying to perform fails.\n\nQuotas generally apply at the Google Cloud project\nlevel. Your use of a resource in one project doesn't affect\nyour available quota in another project. Within a Google Cloud project, quotas\nare shared across all applications and IP addresses.\n\n\nThere are also *system limits* on Cloud NGFW resources.\nSystem limits can't be changed.\n\nQuotas\n------\n\nThis section lists the quotas that apply to Cloud Next Generation Firewall.\n\nTo monitor per-project quotas that use Cloud Monitoring, set up monitoring\nfor the metric `serviceruntime.googleapis.com/quota/allocation/usage` on the\n`Consumer Quota` resource type. Set additional label filters (`service`,\n`quota_metric`) to get to the quota type. For information about monitoring quota\nmetrics, see [Chart and monitor quota metrics](/monitoring/alerts/using-quota-metrics).\nEach quota has a limit and a usage value.\n\nUnless noted otherwise, to change a quota, see\n[Request a quota adjustment](/docs/quotas/view-manage#requesting_higher_quota).\n\n### Per project\n\nThe following table highlights Cloud NGFW quotas that are per\nproject:\n\n### Per organization\n\nThe following table highlights Cloud NGFW quotas that are per\norganization. To change an organization-level quota, [file a Support\ncase](https://cloud.google.com/support-hub).\n\n### Per firewall policy\n\nThe following table highlights Cloud NGFW quotas that are per\nfirewall policy resource:\n\n#### Rule attribute count details\n\nEach firewall policy supports a maximum total number of attributes from all\nrules in the policy. To determine the rule attribute count for a given firewall\npolicy, describe the policy. For directions, see the following:\n\n- [Describe a policy](/firewall/docs/using-firewall-policies#describe-policy) in the hierarchical firewall policy documentation\n- [Describe a global network firewall\n policy](/firewall/docs/use-network-firewall-policies#describe-network-firewall-policy)\n- [Describe a regional network firewall\n policy](/firewall/docs/use-regional-firewall-policies#describe-network-firewall-policy)\n\nThe following table lists example rules and the attribute count for each example\nrule.\n\nLimits\n------\n\nLimits *cannot* be increased unless specifically noted.\n\n### Per organization\n\nThe following limits apply to organizations:\n\n### Per project\n\nThe following limits apply to project:\n\n### Per network\n\nThe following limits apply to VPC networks:\n\n### Per firewall rule\n\nThe following limits apply to firewall rules:\n\n### Per address group\n\nThe following limits apply to address groups used by Cloud NGFW.\n\n### Per firewall endpoint\n\nThe following limits apply to firewall endpoints:\n\n### Per security profile\n\nThe following limits apply to security profiles:\n\n### Per secure tag\n\nThe following limits apply to secure tags:\n\n### Per VM network interface\n\nThe following limits apply to VM network interfaces:\n\nManage quotas\n-------------\n\nCloud Next Generation Firewall enforces quotas on resource usage for various reasons.\nFor example, quotas protect the community of Google Cloud users by\npreventing unforeseen spikes in usage. Quotas also help users who are exploring\nGoogle Cloud with the\n[free tier](/free/docs/gcp-free-tier)\nto stay within their trial.\n\nAll projects start with the same quotas, which you can change by\n[requesting additional quota](#requesting-additional-quota). Some quotas might increase\nautomatically based on your use of a product.\n\n### Permissions\n\nTo view quotas or request quota increases, Identity and Access Management (IAM) principals need one of the\nfollowing roles.\n\n### Check your quota\n\n### Console\n\n1. In the Google Cloud console, go to the **Quotas** page.\n\n [Go to Quotas](https://console.cloud.google.com/iam-admin/quotas)\n2. To search for the quota that you want to update, use the **Filter table**. If you don't know the name of the quota, use the links on this page instead.\n\n### gcloud\n\nUsing the Google Cloud CLI, run the following command to\ncheck your quotas. Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your own project ID. \n\n```\n gcloud compute project-info describe --project PROJECT_ID\n```\n\nTo check your used quota in a region, run the following command: \n\n```\n gcloud compute regions describe example-region\n \n```\n\n### Errors when exceeding your quota\n\nIf you exceed a quota with a `gcloud` command,\n`gcloud` outputs a `quota exceeded` error\nmessage and returns with the exit code `1`.\n\nIf you exceed a quota with an API request, Google Cloud returns the\nfollowing HTTP status code: `413 Request Entity Too Large`.\n\n### Request additional quota\n\nTo adjust most quotas, use the Google Cloud console.\nFor more information, see\n[Request a quota adjustment](/docs/quotas/help/request_increase).\n\n### Resource availability\n\nEach quota represents a maximum number for a particular type of resource that you can create,\nif that resource is available. It's important to note that quotas *don't*\nguarantee resource availability. Even if you have available quota, you can't create\na new resource if it is not available.\n\nFor example, you might have sufficient quota to create a new regional, external IP address\nin a given region. However, that is not possible if there are no\navailable external IP addresses in that region. Zonal resource\navailability can also affect your ability to create a new resource.\n\nSituations where resources are unavailable in an entire region are rare. However, resources\nwithin a zone can be depleted from time to time, typically without impact to the service level\nagreement (SLA) for the type of resource. For more information, review the relevant SLA for the\nresource.\n\nRelated information\n-------------------\n\n- [VPC resource quotas](/vpc/docs/quota)\n- [Compute Engine resource quotas](/compute/quotas)"]]
