Cloud NGFW overview

Cloud Next Generation Firewall is a distributed firewall service that lets you secure your Google Cloud workloads. The workloads include applications and services that run on Google Cloud or that consume Google Cloud resources. Using Cloud NGFW, you can protect your workloads against external threats from the public internet and internal threats within your own network.

Cloud NGFW has the following benefits:

• Distributed firewall service. Cloud NGFW applies firewall rules to each workload in a network and checks every incoming and outgoing connection for threats.

  This approach sets up a zero-trust security framework, where the firewall service verifies each connection before it reaches its destination. If a workload of your network is compromised, Cloud NGFW keeps other workloads secure by verifying every incoming or outgoing connection to and from other workloads.

• Simplified configuration and deployment. Cloud NGFW implements network and hierarchical firewall policies that can be attached to a resource hierarchy node. These policies provide a consistent firewall experience across the Google Cloud resource hierarchy.

• Granular control and micro-segmentation. Cloud NGFW lets you control network traffic in detail. It does this by combining firewall policies with secure tags.

  This approach allows precise control over network traffic, even for a single virtual machine (VM). Cloud NGFW helps you manage traffic entering and leaving Google Cloud (north-south traffic) and traffic between applications and services within Google Cloud (east-west traffic). This control extends across Virtual Private Cloud (VPC) networks and organizations.

Cloud NGFW is available in the following tiers:

• Cloud Next Generation Firewall Essentials
• Cloud Next Generation Firewall Standard
• Cloud Next Generation Firewall Enterprise

Cloud NGFW also provides additional features that you can add on top of these tiers. For more information about the pricing of the firewall tiers and additional features, see Cloud NGFW pricing .

Cloud NGFW Essentials

Cloud NGFW Essentials is the foundational firewall service offered by Google Cloud. It includes the following features and capabilities:

• Global network firewall policies and regional network firewall policies enable you to group firewall rules into a policy object applicable to all regions or specific regions.

• Secure tags combined with network firewall policies provide micro-segmentation and fine-grain control of your Google Cloud resources. Secure tags are managed centrally with unique IDs and strict IAM control. You can reference these secure tags in network firewall policy rules for tighter and uniform access control across your regions and network.

• Address groups combine multiple IP addresses and IP ranges into a single named logical unit. You can reference the same address group in multiple firewall rules for ingress and egress control.

• VPC firewall rules that use network tags and service accounts filter incoming and outgoing traffic at the network level.

Cloud NGFW Standard

Cloud NGFW Standard extends the Cloud NGFW Essentials features to provide enhanced capabilities to help protect your cloud infrastructure from malicious attacks.

It includes the following features:

• Fully qualified domain name (FQDN) objects in firewall policy rules filter incoming or outgoing traffic from or to specific domains. Based on the traffic direction, the IP addresses associated with the domain names are matched against the source or destination of the traffic.

• Geolocation objects in firewall policy rules filter external IPv4 and IPv6 traffic based on specific geographic locations or regions.

• Google Threat Intelligence for firewall policy rules let you secure your network by allowing or blocking traffic based on Google Threat Intelligence data lists.

Cloud NGFW Enterprise

Cloud Next Generation Firewall Enterprise provides advanced Layer 7 security capabilities that help protect your Google Cloud workloads from threats and malicious attacks.

Cloud Next Generation Firewall Enterprise includes signature-based intrusion detection and prevention service with Transport Layer Security (TLS) interception and decryption, which provides threat detection and prevention from malware, spyware, and command-and-control attacks on your network.

Additional features

In addition to the features available in the Cloud NGFW Essentials, Cloud NGFW Standard, and Cloud NGFW Enterprise tiers, Cloud NGFW offers the following features:

• Hierarchical firewall policy rules create and enforce a consistent firewall policy across your organization. You can assign hierarchical firewall policies to the organization as a whole or to individual folders.

• Firewall Rules Logging lets you verify whether firewall rules are being used as intended.

What's next

• Firewall policy rules