This page describes the firewall policy rules logging structure in
Cloud Logging. When a firewall rule with logging enabled applies to traffic
to or from a virtual machine (VM) instance, Cloud Logging creates a log
entry. Log records appear in the JSON
payload field of a
Logging LogEntry
.
Firewall log records consist of base fields, which are the core fields of every log record, and an optional metadata fields. To reduce storage costs, you can exclude metadata fields.
Some log fields can contain other fields as values. For example, the connection
field uses the IpConnection
format, which includes the source and
destination IP address and port, and the protocol, in a single field.
The following table describes the log fields supported for Cloud Next Generation Firewall policy rules, such as hierarchical, global, and regional, excluding legacy fields such as network tags and service accounts, which are unsupported for Cloud NGFW policies.
| Field | Description | Field type: base or optional metadata |
|---|---|---|
connection
|
IpConnection
5-Tuple describing the source and destination IP address, source and destination port, and IP protocol of this connection. |
Base |
disposition
|
Indicates whether the connection was ALLOWED
, DENIED
, or INTERCEPTED
. |
Base |
rule_details.reference
|
Reference to the firewall policy rule. The log format is {folder tier index}/firewallPolicy:{firewall policy ID}
or network:{network name}/firewallPolicy:{firewall policy ID}
based on the scope of the policy. |
Base |
rule_details.priority
|
The priority defined for the firewall policy rule. | Base |
rule_details.action
|
The action defined for the firewall policy rule. It can be set as ALLOWED
, DENIED
, or APPLY_SECURITY_PROFILE_GROUP
. |
Base |
rule_details.apply_security_profile_fallback_action
|
Only applicable if the action is APPLY_SECURITY_PROFILE_GROUP
.
It can be set as ALLOW
or UNSPECIFIED
. UNSPECIFIED
is set if disposition is INTERCEPTED
. |
Metadata |
rule_details.direction
|
The direction that the firewall policy rule applies to. It can be set to ingress
or egress
. |
Base |
rule_details.ip_port_info[ ]
|
List of IP protocols and applicable port ranges. The ip_protocol
sub-field can't be set to ALL
for firewall policy rules. |
Base |
rule_details.source_range[ ]
rule_details.destination_range[ ]
|
List of source or destination IP ranges that the firewall policy rule applies to. | Metadata |
rule_details.source_secure_tag[ ]
rule_details.target_secure_tag[ ]
|
List of all source or target secure tags that the firewall policy rule applies to. | Metadata |
rule_details.target_resource[ ]
|
Target resource string. For example, projects/{project ID}/global/networks/{network name}
. It's
applicable for the hierarchical firewall policies. |
Metadata |
rule_details.source_region_code[ ]
rule_details.destination_region_code[ ]
|
List of all source or destination country codes the firewall policy rule applies to. | Metadata |
rule_details.source_fqdn[ ]
rule_details.destination_fqdn[ ]
|
List of all source or destination domain names the firewall policy rule applies to. | Metadata |
rule_details.source_threat_intelligence[ ]
rule_details.destination_threat_intelligence[ ]
|
List of all source or destination Google Threat Intelligence names the firewall policy rule applies to. | Metadata |
rule_details.source_address_groups[ ]
rule_details.destination_address_groups[ ]
|
List of all source or destination address groups the firewall policy rule applies to. | Metadata |
instance
|
InstanceDetails
VM instance details. In a Shared VPC configuration, project_id
corresponds to that of the service project. |
Metadata |
load_balancer_details
|
LoadBalancingDetails
Details of the internal Application Load Balancer or internal proxy Network Load Balancer to which the firewall policy rule applies. When the target of a firewall rule is one of these load balancers, the instance
field is omitted. |
Metadata |
vpc
|
VpcDetails
VPC network details. In a Shared VPC configuration, project_id
corresponds to that of the host project. |
Metadata |
remote_instance
|
InstanceDetails
If the remote endpoint of the connection was a VM located in the Compute Engine, this field is populated with VM instance details. |
Metadata |
remote_vpc
|
VpcDetails
If the remote endpoint of the connection was a VM that is located in a VPC network, this field is populated with the network details. |
Metadata |
remote_location
|
GeographicDetails
If the remote endpoint of the connection was external to the VPC network, this field is populated with available location metadata. |
Metadata |
IpConnection
| Field | Type | Description |
|---|---|---|
src_ip
|
string | Source IP address. If the source is a Compute Engine VM, src_ip
is either the primary internal IP address or an address
in an alias IP range of the VM's network interface. The external IP
address is not shown. Logging shows the IP address of the VM as
the VM sees it on the packet header, the same as if you ran tcpdump
on the VM. |
src_port
|
integer | Source port |
dest_ip
|
string | Destination IP address. If the destination is a Google Cloud VM, dest_ip
is either the primary internal IP address or an address
in an alias IP range of the VM's network interface. The external IP
address is not shown even if it was used in making the connection. |
dest_port
|
integer | The destination port. |
protocol
|
integer | IP protocol of the connection. |
RuleDetails
Field
Type
Description
reference
string
Reference to the firewall policy rule. The format for firewall policy rules is:
- Hierarchical firewall policy:
{folder tier index}/firewallPolicy:{id} - Global firewall policy:
network:{network name}/firewallPolicy:{id} - Regional firewall policy:
network:{network name}/region:{region name}/firewallPolicy:{id}
priority
integer
The priority for the firewall policy rule.
action
string
The action of the firewall policy rule. Can be
ALLOW
, DENY
, or APPLY_SECURITY_PROFILE_GROUP
.apply_security_profile_fallback_action
string
Applicable if the action is
APPLY_SECURITY_PROFILE_GROUP
.
Values are ALLOW
or UNSPECIFIED
Set if the connection disposition is INTERCEPTED
.direction
string
The direction that the firewall policy rule applies to
(
ingress
or egress
).source_range[ ]
string
List of source ranges that the firewall policy rule applies to.
destination_range[ ]
string
List of destination ranges that the firewall policy rule applies to.
target_resource[ ]
string
Target resource strings formatted as
projects/{project ID}/global/networks/{network name}
.
It is available in hierarchical firewall policies.source_secure_tag[ ]
string
List of all the source secure tags that the firewall policy rule applies to.
target_secure_tag[ ]
string
List of all the target secure tags that the firewall policy rule applies to.
source_region_code[ ]
string
List of all the source country codes that the firewall policy rule applies to.
destination_region_code[ ]
string
List of all the destination country codes that the firewall policy rule applies to.
source_fqdn[ ]
string
List of all the source domain names that the firewall policy rule applies to.
destination_fqdn[ ]
string
List of all the destination domain names that the firewall policy rule applies to.
source_threat_intelligence[ ]
string
List of all the source Google Threat Intelligence list names that the firewall policy rule
applies to.
destination_threat_intelligence[ ]
string
List of all the destination Google Threat Intelligence list names that the firewall policy rule
applies to.
source_address_groups[ ]
string
List of all the source address groups that the firewall policy rule applies to.
destination_address_groups[ ]
string
List of all the destination address groups that the firewall policy rule applies to.
IpPortDetails
| Field | Type | Description |
|---|---|---|
ip_protocol
|
string | IP protocol that the firewall policy rule applies to. It can't be set to ALL
for firewall policy rules. |
port_range[ ]
|
string | List of applicable port ranges for firewall policy rules.
For example, 8080-9090
. |
InstanceDetails
| Field | Type | Description |
|---|---|---|
project_id
|
string | ID of the project containing the Compute Engine VM. |
vm_name
|
string | Instance name of the Compute Engine VM. |
region
|
string | Region of the Compute Engine VM. |
zone
|
string | Zone of the Compute Engine VM. |
LoadBalancingDetails
| Field | Type | Description |
|---|---|---|
forwarding_rule_project_id
|
string | Google Cloud project ID that contains the forwarding rule. |
type
|
string | Load balancer type: APPLICATION_LOAD_BALANCER
indicates
an internal Application Load Balancer. PROXY_NETWORK_LOAD_BALANCER
indicates an
internal proxy Network Load Balancer. |
scheme
|
string | Load balancer scheme, INTERNAL_MANAGED
. |
url_map_name
|
string | Name of the URL map. Only populated if the type
is APPLICATION_LOAD_BALANCER
. |
forwarding_rule_name
|
string | Name of the forwarding rule. |
VpcDetails
| Field | Type | Description |
|---|---|---|
project_id
|
string | ID of the project containing the network. |
vpc_name
|
string | Network on which the VM is operating. |
subnetwork_name
|
string | Subnet on which the VM is operating. |
GeographicDetails
| Field | Type | Description |
|---|---|---|
continent
|
string | Continent name for external endpoints. |
country
|
string | Country name for external endpoints. |
region
|
string | Region name for external endpoints. |
city
|
string | City name for external endpoints. |
