Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Este documento descreve as etapas de configuração inicial necessárias para usar o Secure Web Proxy.
Antes de usar o proxy seguro, conclua a seguinte configuração:
Receba os papéis necessários do Identity and Access Management.
Crie ou selecione um Google Cloud projeto.
Ative o faturamento e as APIs Google Cloud relevantes.
Crie sub-redes de proxy.
Faça upload de um certificado SSL no Gerenciador de certificados.
Essa configuração só é necessária na primeira vez que você usa o proxy seguro da Web.
Receber papéis do IAM
Para conseguir permissões, siga estas etapas:
Para receber as permissões necessárias para provisionar uma instância do Secure Web Proxy,
peça ao administrador para conceder a você os
seguintes papéis do IAM no projeto:
Opcional: se você tiver um conjunto de usuários responsáveis pelo gerenciamento contínuo de políticas, conceda a eles o papel de administrador de políticas de segurança (roles/compute.orgSecurityPolicyAdmin) para que possam gerenciar as políticas de segurança.
Criar um projeto Google Cloud
Para criar ou selecionar um projeto Google Cloud , siga estas etapas:
Crie uma sub-rede de proxy para cada região em que você implanta o Secure Web Proxy.
Crie uma sub-rede de pelo menos /26 ou 64 endereços somente proxy. Recomendamos um tamanho de sub-rede de /23, ou 512 endereços somente proxy, porque a conectividade do Secure Web Proxy é fornecida por um pool de endereços IP reservados para o Secure Web Proxy. Esse pool é usado para alocar endereços IP exclusivos no lado de saída de cada proxy para interação com o Cloud NAT e destinos na rede VPC.
PROXY_SUBNET_NAME: o nome que você quer dar à sub-rede de proxy
REGION: a região em que a sub-rede de proxy será implantada
NETWORK_NAME: o nome da sua rede
IP_RANGE: o intervalo de sub-rede, como 192.168.0.0/23
Implantar um certificado SSL
Os certificados SSL são opcionais para o Secure Web Proxy. Para implantar certificados
usando o Gerenciador de certificados, use um dos seguintes métodos:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-27 UTC."],[],[],null,["# Initial setup steps\n\nThis document describes the initial setup steps required to use Secure Web Proxy.\n\nBefore you can use Secure Web Proxy, complete the following setup:\n\n- Obtain necessary Identity and Access Management roles.\n- Create or select a Google Cloud project.\n- Enable billing and relevant Google Cloud APIs.\n- Create proxy subnets.\n- Upload an SSL certificate to Certificate Manager.\n\nThis setup is only required the first time you use Secure Web Proxy.\n\nObtain IAM roles\n----------------\n\nTo obtain permissions, follow these steps:\n\n1.\n\n To get the permissions that\n you need to provision a Secure Web Proxy instance,\n\n ask your administrator to grant you the\n following IAM roles on your project:\n\n - To configure policies and provision a Secure Web Proxy instance: [Compute Network Admin role](/iam/docs/roles-permissions/compute#compute.networkAdmin) (`roles/compute.networkAdmin`)\n - To upload explicit Secure Web Proxy TLS certificates: [Certificate Manager Editor role](/iam/docs/roles-permissions/certificatemanager#certificatemanager.editor) (`roles/certificatemanager.editor`)\n\n\n For more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\n You might also be able to get\n the required permissions through [custom\n roles](/iam/docs/creating-custom-roles) or other [predefined\n roles](/iam/docs/roles-overview#predefined).\n2. Optional: If you have a set of users responsible for ongoing policy\n management, grant them the Security Policy Admin role\n (`roles/compute.orgSecurityPolicyAdmin`) to let them manage security\n policies.\n\nCreate a Google Cloud project\n-----------------------------\n\nTo create or select a Google Cloud project, follow these steps: \n\n### Console\n\nIn the Google Cloud console, on the project selector page, select or\n[create a Google Cloud project](/resource-manager/docs/creating-managing-projects).\n\n[Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n\n### Cloud Shell\n\n- Create a Google Cloud project:\n\n gcloud projects create \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the project ID that you\n want.\n- Select the Google Cloud project that you created:\n\n gcloud config set project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\nEnable billing and APIs\n-----------------------\n\nTo enable billing and relevant Google Cloud APIs, follow these steps:\n\n1. Make sure that billing is enabled for your Google Cloud project. Learn how to\n [verify the billing status of your projects](/billing/docs/how-to/verify-billing-enabled).\n\n2. Enable the Compute Engine API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=compute)\n3. Enable the Certificate Manager API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=certificatemanager)\n4. Enable the Network Services API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=networkservices)\n5. Enable the Network Security API.\n\n [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=networksecurity)\n\nCreate a proxy subnet\n---------------------\n\nCreate a proxy subnet for each region that you deploy Secure Web Proxy in.\nCreate a subnet size of at least /26, or 64 proxy-only addresses. We recommend\na subnet size of /23, or 512 proxy-only addresses, because Secure Web Proxy\nconnectivity is provided by a pool of IP addresses reserved for\nSecure Web Proxy. This pool is used to allocate unique IP addresses on the\negress side of each proxy for interaction with Cloud NAT and destinations in\nthe VPC network.\n**Important:** This subnet is *not* referenced when creating a Secure Web Proxy instance. For more information, see [Proxy-only subnets for Envoy-based load balancers](/load-balancing/docs/proxy-only-subnets). \n\n### gcloud\n\n gcloud compute networks subnets create \u003cvar translate=\"no\"\u003ePROXY_SUBNET_NAME\u003c/var\u003e \\\n --purpose=REGIONAL_MANAGED_PROXY \\\n --role=ACTIVE \\\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --network=\u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e \\\n --range=\u003cvar translate=\"no\"\u003eIP_RANGE\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROXY_SUBNET_NAME\u003c/var\u003e: the name that you want for your proxy subnet\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region to deploy the proxy subnet in\n- \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e: your network name\n- \u003cvar translate=\"no\"\u003eIP_RANGE\u003c/var\u003e: the subnet range, such as `192.168.0.0/23`\n\nDeploy an SSL certificate\n-------------------------\n\nSSL certificates are optional for Secure Web Proxy. To deploy certificates\nusing Certificate Manager, use any of the following methods:\n\n- Deploy a regional Google-managed certificate with per-project DNS\n authorization. For more information, see [Deploy a regional Google-managed certificate](/certificate-manager/docs/deploy-google-managed-regional).\n\n- Deploy a regional Google-managed certificate with Certificate Authority Service. For\n more information, see [Deploy a regional Google-managed certificate with CA Service](/certificate-manager/docs/deploy-google-managed-cas-regional).\n\n- Deploy a regional self-managed certificate.\n\n The following example shows how to deploy a regional self-managed certificate using Certificate Manager.\n\n \u003cbr /\u003e\n\n1. To create an SSL certificate:\n\n openssl req -x509 -newkey rsa:2048 \\\n -keyout \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e \\\n -out \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e -days 365 \\\n -subj '/CN=\u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e' -nodes -addext \\\n \"subjectAltName=DNS:\u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e: the path to save the key, such as `~/key.pem`\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e: the path to save the certificate, such as `~/cert.pem`\n - \u003cvar translate=\"no\"\u003eSWP_HOST_NAME\u003c/var\u003e: the hostname for your Secure Web Proxy instance, such as `myswp.example.com`\n2. To upload the SSL certificate to Certificate Manager:\n\n gcloud certificate-manager certificates create \u003cvar translate=\"no\"\u003eCERTIFICATE_NAME\u003c/var\u003e \\\n --certificate-file=\u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e \\\n --private-key-file=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_NAME\u003c/var\u003e: the name of your certificate\n - \u003cvar translate=\"no\"\u003eCERTIFICATE_PATH\u003c/var\u003e: the path to the certificate file\n - \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e: the path to the key file\n\n For more information about SSL certificates, see\n [SSL certificates overview](/load-balancing/docs/ssl-certificates).\n\nWhat's next\n-----------\n\n- [Deploy and test a Secure Web Proxy instance](/secure-web-proxy/docs/quickstart)\n- [Use tags to create policies](/secure-web-proxy/docs/use-tags)\n- [Use a URL list to create policies](/secure-web-proxy/docs/use-url-list)\n- [Assign static IP addresses for egress traffic](/secure-web-proxy/docs/assign-static-ip-addresses-for-egress-traffic)"]]
