Stay organized with collectionsSave and categorize content based on your preferences.
This document explains how to create Secure Access Connect attachments. A
Secure Access Connect attachment enablesNCC Gatewayto process traffic with an SSE product.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,["# Create attachments\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis document explains how to create Secure Access Connect attachments. A\nSecure Access Connect attachment enables\n[NCC Gateway](/network-connectivity/docs/network-connectivity-center/concepts/ncc-gateway-overview)\nto process traffic with an SSE product.\n\nBefore you begin\n----------------\n\nBefore you begin, do the following:\n\n- [Create a realm](/secure-access-connect/docs/create-realms)\n- [Create an NCC Gateway spoke](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/create-spoke)\n\n### Required roles\n\n\nTo get the permissions that\nyou need to create attachments,\n\nask your administrator to grant you the\n\n\n[Compute Network Admin](/iam/docs/roles-permissions/compute#compute.networkAdmin) (`roles/compute.networkAdmin`)\nIAM role on the project.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nCreate a Secure Access Connect attachment\n-----------------------------------------\n\nCreate a Secure Access Connect attachment by following the\ninstructions that correspond with your SSE provider.\n\n### Palo Alto Networks Prisma Access\n\n### gcloud\n\nCreate an attachment by running the\n[`gcloud beta network-security secure-access-connect attachments create` command](/sdk/gcloud/reference/beta/network-security/secure-access-connect/attachments/create): \n\n gcloud beta network-security secure-access-connect attachments create \u003cvar translate=\"no\"\u003eATTACHMENT_ID\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --realm=\u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e \\\n --gateway=\u003cvar translate=\"no\"\u003eNCC_GATEWAY_SPOKE_ID\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eATTACHMENT_ID\u003c/var\u003e: the name for the attachment\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: your project ID\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region for the attachment\n- \u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e: the ID of your realm\n- \u003cvar translate=\"no\"\u003eNCC_GATEWAY_SPOKE_ID\u003c/var\u003e: the ID of your NCC Gateway spoke\n\n### API\n\nTo create an attachment in a given project and location, use the\n[`projects.locations.sacAttachments.create` method](/secure-access-connect/docs/reference/network-security/rest/v1beta1/projects.locations.sacAttachments/create). \n\n POST https://networksecurity.googleapis.com/v1beta1/{parent=project/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e}/sacAttachments\n {\n \"sacRealm\": \"\u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e\",\n \"nccGateway\": \"\u003cvar translate=\"no\"\u003eNCC_GATEWAY_SPOKE_ID\u003c/var\u003e\"\n }\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: your project ID\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region for the attachment\n- \u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e: the ID of your realm\n- \u003cvar translate=\"no\"\u003eNCC_GATEWAY_SPOKE_ID\u003c/var\u003e: the ID of your NCC Gateway spoke\n\n### Symantec Cloud SWG\n\n### gcloud\n\nCreate an attachment by doing the following:\n\n1. Identify the Symantec site that you want to connect your attachment to\n by running the\n [`gcloud beta network-security secure-access-connect realms describe` command](/sdk/gcloud/reference/beta/network-security/secure-access-connect/realms/describe):\n\n gcloud beta network-security secure-access-connect realms describe \u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e: the name of your realm\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: your project ID\n\n The output is similar to the following: \n\n name: projects/project-id/locations/global/sacRealms/realm-id\n createTime: '...'\n updateTime: '...'\n securityService: SYMANTEC_CLOUD_SWG\n state: PARTNER_ATTACHED\n symantecOptions:\n availableSymantecSites:\n \u003cvar translate=\"no\"\u003eSYMANTEC_SITE_1\u003c/var\u003e\n \u003cvar translate=\"no\"\u003eSYMANTEC_SITE_2\u003c/var\u003e\n secretPath:\u003cvar translate=\"no\"\u003eSECRET_PATH\u003c/var\u003e\n symantecConnectionState: SUCCEEDED\n\n The `availableSymantecSites` field contains the Symantec Cloud SWG sites\n that are available for you to connect to.\n2. Create an attachment by running the\n [`gcloud beta network-security secure-access-connect attachments create` command](/sdk/gcloud/reference/beta/network-security/secure-access-connect/attachments/create):\n\n gcloud beta network-security secure-access-connect attachments create \u003cvar translate=\"no\"\u003eATTACHMENT_ID\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --realm=\u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e \\\n --gateway=\u003cvar translate=\"no\"\u003eNCC_GATEWAY_SPOKE_ID\u003c/var\u003e \\\n --symantec-site=\u003cvar translate=\"no\"\u003eSYMANTEC_SITE\u003c/var\u003e \\\n --symantec-location-name=\u003cvar translate=\"no\"\u003eSYMANTEC_LOCATION_NAME\u003c/var\u003e\n --country=\u003cvar translate=\"no\"\u003eCOUNTRY\u003c/var\u003e \\\n --timezone=\u003cvar translate=\"no\"\u003eTIMEZONE\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eATTACHMENT_ID\u003c/var\u003e: the name for the attachment\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: your project ID\n - \u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e: the ID of your realm\n - \u003cvar translate=\"no\"\u003eNCC_GATEWAY_SPOKE_ID\u003c/var\u003e: the ID of your NCC Gateway spoke\n - \u003cvar translate=\"no\"\u003eSYMANTEC_SITE\u003c/var\u003e: the Symantec site that you want\n to connect the attachment to\n\n Must be one of the `availableSymantecSites`\n from the previous step.\n - \u003cvar translate=\"no\"\u003eSYMANTEC_LOCATION_NAME\u003c/var\u003e: the name to give to the\n Symantec location\n\n For more information about naming requirements, see\n the `Location schema` in the [Symantec Location Management API\n documentation](https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/cloud-swg/help/cloudswg-api-reference/location-management-api.html).\n - \u003cvar translate=\"no\"\u003eCOUNTRY\u003c/var\u003e: an optional country code\n in the ISO 3166 alpha-2 country code format\n\n - \u003cvar translate=\"no\"\u003eTIMEZONE\u003c/var\u003e: an optional timezone in the IANA\n timezone format\n\n### API\n\nTo create an attachment in a given project and location, use the\n[`projects.locations.sacAttachments.create` method](/secure-access-connect/docs/reference/network-security/rest/v1beta1/projects.locations.sacAttachments/create). \n\n POST https://networksecurity.googleapis.com/v1beta1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e/sacAttachments\n {\n \"name\": \"\u003cvar translate=\"no\"\u003eATTACHMENT_ID\u003c/var\u003e\",\n \"sacRealm\": \"\u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e\",\n \"nccGateway\": \"\u003cvar translate=\"no\"\u003eNCC_GATEWAY_SPOKE_ID\u003c/var\u003e\",\n \"country\": \"\u003cvar translate=\"no\"\u003eCOUNTRY\u003c/var\u003e\",\n \"timeZone\": \"\u003cvar translate=\"no\"\u003eTIMEZONE\u003c/var\u003e\",\n \"symantecOptions\": {\n \"symantecLocationName\": \"\u003cvar translate=\"no\"\u003eSYMANTEC_LOCATION_NAME\u003c/var\u003e\",\n \"symantecSite\": \"\u003cvar translate=\"no\"\u003eSYMANTEC_SITE\u003c/var\u003e\"\n }\n }\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: your project ID\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region for the attachment\n- \u003cvar translate=\"no\"\u003eATTACHMENT_ID\u003c/var\u003e: the name for the attachment\n- \u003cvar translate=\"no\"\u003eREALM_ID\u003c/var\u003e: the ID of your realm\n- \u003cvar translate=\"no\"\u003eNCC_GATEWAY_SPOKE_ID\u003c/var\u003e: the ID of your NCC Gateway spoke\n- \u003cvar translate=\"no\"\u003eCOUNTRY\u003c/var\u003e: an optional country code in the ISO 3166 alpha-2 country code format\n- \u003cvar translate=\"no\"\u003eTIMEZONE\u003c/var\u003e: an optional timezone in the IANA timezone format\n- \u003cvar translate=\"no\"\u003eSYMANTEC_SITE\u003c/var\u003e: the Symantec site that you want\n to connect the attachment to\n\n Must be one of the `availableSymantecSites`\n from the previous step.\n- \u003cvar translate=\"no\"\u003eSYMANTEC_LOCATION_NAME\u003c/var\u003e: the name to give to the\n Symantec location\n\n For more information about naming requirements, see\n the `Location schema` in the [Symantec Location Management API\n documentation](https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/cloud-swg/help/cloudswg-api-reference/location-management-api.html).\n\nWhat's next\n-----------\n\n- [Add hybrid connections to NCC Gateway](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/add-hybrid-connections)"]]
