Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Memverifikasi bahwa endpoint IDS berfungsi
Untuk mengonfirmasi bahwa endpoint IDS berfungsi, lakukan tindakan berikut:
Pastikan endpoint IDS muncul di konsol Google Cloud Cloud IDS,
dan ada kebijakan duplikasi paket di kolom Attached Policies.
Pastikan kebijakan yang dilampirkan diaktifkan dengan mengklik nama kebijakan, dan
pastikan Policy Enforcement ditetapkan ke Enabled.
Untuk memverifikasi bahwa traffic sedang dicerminkan, pilih Instance VM di VPC yang dipantau, buka tab Observability, dan pastikan dasbor Mirrored
Bytes menampilkan traffic yang dicerminkan ke endpoint IDS.
Pastikan traffic (atau VM) yang sama tidak terpengaruh oleh lebih dari satu
kebijakan duplikasi paket, karena setiap paket hanya dapat diduplikasi ke satu
tujuan. Periksa kolom Attached Policies, dan pastikan hanya ada satu kebijakan per VM.
Buat pemberitahuan pengujian menggunakan SSH untuk terhubung ke VM di jaringan yang dipantau, lalu jalankan perintah berikut:
Jika curl tidak tersedia di platform, Anda dapat menggunakan alat serupa untuk
melakukan permintaan HTTP.
Setelah beberapa detik, pemberitahuan akan muncul di UI Cloud IDS dan di Cloud Logging (Threat Log).
Mendekripsi traffic untuk pemeriksaan
Untuk memeriksa traffic, Cloud IDS menggunakan Duplikasi Paket untuk mengirim
salinan traffic yang dikonfigurasi di tingkat paket ke VM IDS. Meskipun
tujuan kolektor menerima semua paket yang dicerminkan, setiap paket yang membawa data yang
dienkripsi menggunakan protokol aman seperti TLS, HTTPS, atau HTTP2 tidak dapat didekripsi
oleh Cloud IDS.
Misalnya, jika Anda menggunakan HTTPS atau HTTP2 sebagai protokol layanan backend untuk load balancer aplikasi eksternal, paket yang dikirim ke backend load balancer dapat dicerminkan ke Cloud IDS. Namun, permintaan tidak dapat diperiksa oleh Cloud IDS karena paket tersebut membawa data terenkripsi. Untuk mengaktifkan pemeriksaan Cloud IDS, Anda harus mengubah protokol layanan backend ke HTTP. Atau,
Anda dapat menggunakan Google Cloud Armor untuk pencegahan
intrusi, dan mengaktifkan log load balancer aplikasi untuk pemeriksaan permintaan. Untuk mengetahui informasi selengkapnya tentang logging permintaan load balancer aplikasi, lihat Logging dan monitoring Load Balancer Aplikasi eksternal global dan Logging dan monitoring Load Balancer Aplikasi eksternal regional.
Hanya volume traffic kecil yang diperiksa
Cloud IDS memeriksa traffic yang dikirim ke atau diterima oleh resource di subnet yang dicerminkan, termasuk VM, node, dan Pod GKE. Google Cloud
Jika subnet yang dicerminkan tidak berisi VM, Cloud IDS tidak memiliki traffic untuk diperiksa.
Kebijakan endpoint diabaikan saat menggunakan kebijakan pemeriksaan L7 Cloud NGFW
Saat Anda menggunakan kebijakan pemeriksaan L7 Cloud Next Generation Firewall (aturan dengan tindakan apply_security_profile_group) dan Cloud IDS secara bersamaan, aturan kebijakan firewall dievaluasi dan traffic tidak dicerminkan untuk pemeriksaan Cloud IDS. Anda dapat menghindari situasi ini dengan memastikan bahwa
kebijakan inspeksi L7 Cloud NGFW tidak berlaku untuk paket yang
perlu Anda periksa dengan Cloud IDS.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eTo confirm an IDS endpoint is functional, verify its presence in the Cloud IDS console, ensure the attached packet mirroring policy is enabled, and confirm traffic mirroring via the \u003ccode\u003eMirrored Bytes\u003c/code\u003e dashboard.\u003c/p\u003e\n"],["\u003cp\u003eEach packet can only be mirrored to one destination, so ensure that a VM is not affected by more than one packet mirroring policy, which can be confirmed in the \u003ccode\u003eAttached Policies\u003c/code\u003e column.\u003c/p\u003e\n"],["\u003cp\u003eGenerate a test alert by using SSH to connect to a VM and run a specific \u003ccode\u003ecurl\u003c/code\u003e command (or similar HTTP request tool) to trigger an alert, which should then be visible in the Cloud IDS UI and Cloud Logging (Threat Log).\u003c/p\u003e\n"],["\u003cp\u003eCloud IDS cannot decrypt traffic encrypted with secure protocols like TLS, HTTPS, or HTTP2, so for inspection, backend service protocols should be changed to HTTP, or use Google Cloud Armor for intrusion prevention.\u003c/p\u003e\n"],["\u003cp\u003eTraffic is only inspected if sent to or received by resources within mirrored subnets, and Cloud NGFW L7 inspection policies will prevent mirroring for Cloud IDS if they apply to the same packets.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot endpoints and inspection\n\nVerify that an IDS endpoint is functional\n-----------------------------------------\n\n| **Note:** If your endpoint generates any alerts, it is considered to be functional.\n\nTo confirm that an IDS endpoint is functional, do the following:\n\n1. Verify that the IDS endpoint appears in the Cloud IDS Google Cloud console, and that there is a packet mirroring policy in the `Attached Policies` column.\n2. Ensure that the attached policy is enabled by clicking the policy name, and make sure that `Policy Enforcement` is set to **Enabled**.\n3. To verify that traffic is being mirrored, choose a VM Instance in the monitored VPC, go to the **Observability** tab, and make sure that the `Mirrored\n Bytes` dashboard shows traffic being mirrored to the IDS endpoint.\n4. Ensure that the same traffic (or VM) is not affected by more than one packet mirroring policy, as each packet can be mirrored to only one destination. Check the `Attached Policies` column, and ensure that there is only one policy per VM.\n5. Generate a test alert by using SSH to connect to a VM in the monitored\n network, then run the following command:\n\n ```\n curl http://example.com/cgi-bin/../../../..//bin/cat%%20/etc/passwd\n ```\n\n If curl is unavailable on the platform, you can use a similar tool for\n performing HTTP requests.\n\n After a few seconds, an alert should show up in both the Cloud IDS UI and\n in Cloud Logging (Threat Log).\n\nDecrypting traffic for inspection\n---------------------------------\n\nTo inspect traffic, Cloud IDS uses Packet Mirroring to send\npacket-level copies of configured traffic to the IDS VM. Even though the\ncollector destination receives all mirrored packets, any packets that carry data that was\nencrypted using a secure protocol like TLS, HTTPS, or HTTP2 can't be decrypted\nby Cloud IDS.\n\nFor example, if you use HTTPS or HTTP2 as the backend service protocol for an\nexternal application load balancer, packets sent to the load balancer's backends\ncan be mirrored to Cloud IDS; however, the requests cannot be inspected by\nCloud IDS because the packets carry encrypted data. To enable Cloud IDS\ninspection, you must change the backend service protocol to HTTP. Alternatively,\nyou can use [Google Cloud Armor](/armor/docs/cloud-armor-overview) for intrusion\nprevention, and enable application load balancer logs for request inspection. For\nmore information about application load balancer request logging, see\n[Global external Application Load Balancer logging and\nmonitoring](/load-balancing/docs/https/https-logging-monitoring#logging) and\n[Regional external Application Load Balancer logging and\nmonitoring](/load-balancing/docs/https/https-reg-logging-monitoring#logging).\n\nOnly a small volume of traffic is inspected\n-------------------------------------------\n\nCloud IDS inspects traffic sent to or received by resources in mirrored\nsubnets, including Google Cloud VMs and GKE nodes and\nPods.\n\nIf a mirrored subnet contains no VMs, Cloud IDS has no traffic to inspect.\n\nEndpoint policies are ignored when using Cloud NGFW L7 inspection policies\n--------------------------------------------------------------------------\n\nWhen you use Cloud Next Generation Firewall L7 inspection policies (rules with the\n`apply_security_profile_group` action) and Cloud IDS together, firewall\npolicy rules are evaluated and traffic is not mirrored for Cloud IDS\ninspection. You can avoid this situation by ensuring that\nCloud NGFW L7 inspection policies don't apply to packets that you\nneed to inspect with Cloud IDS."]]
