Set up intrusion prevention service in your network

Intrusion prevention service monitors your Google Cloud workload traffic for any malicious activity and takes preemptive actions to prevent it. To enable this service on your network, you must set up multiple Cloud Next Generation Firewall components. This tutorial describes the end-to-end workflow to configure intrusion prevention service in your network.

Objectives

This tutorial shows you how to complete the following tasks:

  • Create a Virtual Private Cloud (VPC) network with two subnets.
  • Create a server virtual machine (VM) instance in the first subnet of the VPC network and install the Apache server on the VM.
  • Create a client VM instance in the second subnet of the VPC network.
  • Create a security profile and a security profile group.
  • Create a firewall endpoint and associate it with the VPC network.
  • Add a global network firewall policy with the following firewall rules:
    • A firewall rule to enable Identity-Aware Proxy (IAP) access to the VM instances in the VPC network.
    • A firewall rule to direct all ingress traffic for Layer 7 inspection.
  • Verify whether malicious traffic to the server VM instance is blocked.
  • Clean up the resources.

The following diagram shows the high-level architecture of the deployment setup in this tutorial. The firewall policy fw-policy-ips on VPC vpc-ips , redirects the ingress traffic to the firewall endpoint in zone asia-southeast1-a . The firewall endpoint endpoint-ips inspects the traffic for any threats. If any threat is detected, it applies the preventive actions by using the directions specified in the security profile sec-profile-ips .

Intrusion prevention service in a custom VPC network to identify and prevent any threats.
Intrusion prevention service in a custom VPC network (click to enlarge).

Costs

There is a cost associated with creating the firewall endpoints. For pricing details, see Cloud Next Generation Firewall pricing .

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project .

    Go to project selector

  3. Make sure that billing is enabled for your Google Cloud project .

    4.

  4. In the Google Cloud console, on the project selector page, select or create a Google Cloud project .

    Go to project selector

  5. Make sure that billing is enabled for your Google Cloud project .

    6.
  6. Enable the Compute Engine API for your project.
  7. Enable the Network Security API for your project.
  8. Enable the Identity-Aware Proxy API for your project.
  9. Have the Compute Network Admin ( roles/compute.networkAdmin ) IAM role on your organization.
  10. If you prefer to work from the command line, install the Google Cloud CLI. For conceptual and installation information about the tool, see gcloud CLI overview .

    Note: If you haven't run the gcloud CLI previously, first run gcloud init to initialize your gcloud CLI directory.

Create a custom VPC network with subnets

In this section, you create a custom mode VPC network with two IPv4 subnets.

Console

  1. In the Google Cloud console, go to the VPC networkspage.

    Go to VPC networks

  2. Click Create VPC network.

  3. For Name, enter vpc-ips .

  4. For Description, enter VPC network to set up intrusion prevention service .

  5. For Subnet creation mode, select Custom.

  6. In the New subnetsection, specify the following configuration parameters for a subnet:

    • Name: subnet-ips-server
    • Region: asia-southeast1
    • IPv4 range: 10.0.0.0/24

  7. Click Done.

  8. Click Add subnetand specify the following configuration parameters:

    • Name: subnet-ips-client
    • Region: us-central1
    • IPv4 range: 192.168.10.0/24

  9. Click Done.

  10. Click Create.

gcloud

  1. To create a VPC network, run the following command:

    gcloud compute networks create vpc-ips \
  --subnet-mode custom \
  --description "VPC network to set up intrusion prevention service."

  2. In the Authorize cloud shelldialog, click Authorize.

  3. To create a subnet, run the following command:

    gcloud compute networks subnets create  subnet-server-ips \
  --network vpc-ips \
  --region asia-southeast1 \
  --range 10.0.0.0/24

  4. To create another subnet, run the following command:

    gcloud compute networks subnets create subnet-client-ips \
  --network vpc-ips \
  --region us-central1 \
  --range 192.168.10.0/24

Create VM instances

In this section, you create server and client VM instances.

Create the server VM instance

In this section, you create a VM instance in the subnet subnet-server-ips and install the Apache server on it.

Console

  1. In the Google Cloud console, go to the Create an instancepage.

    Go to Create an instance

  2. For Name, enter vm-server-ips .

  3. For Region, select asia-southeast1 (Singapore) .

  4. For Zone, select asia-southeast1-a .

  5. In the Boot disksection, select Change, and then, for the operating system, select Debian.

  6. Click Select.

  7. Expand Advanced options, and then expand Networking.

  8. In the Network interfacessection, specify the following configuration parameters:

    • Network: vpc-ips
    • Subnetwork: subnet-server-ips IPv4 (10.0.0.0/24)

  9. Click Done.

  10. Expand the Managementsection.

  11. In the Automationsection, add the following startup script:

     #! /bin/bash
  apt update
  apt -y install apache2
  cat <<EOF > /var/www/html/index.html
  <html><body><p>Hello world.</p></body></html>
  EOF

  12. Click Create.

  13. Make a note of the External IPaddress of the server VM after it is created.

gcloud

To create the server VM, run the following command:

gcloud compute instances create vm-server-ips \
    --network vpc-ips \
    --zone asia-southeast1-a \
    --subnet subnet-server-ips \
    --stack-type IPV4_ONLY \
    --image-project debian-cloud \
    --image-family debian-11 \
    --metadata=startup-script='#! /bin/bash
     apt update
     apt -y install apache2
     cat <<EOF > /var/www/html/index.html
     <html><body><p>Hello World.</p></body></html>
     EOF'

Make a note of the external IP address of the VM in the returned status.

Create the client VM instance

In this section, you create a VM instance in the subnet subnet-client-ips .

Console

  1. In the Google Cloud console, go to the Create an instancepage.

    Go to Create an instance

  2. For Name, enter vm-client-ips .

  3. For Region, select us-central1 .

  4. For Zone, select us-central1-a .

  5. Expand Advanced options, and then expand Networking.

  6. In the Network interfacessection, specify the following configuration parameters:

    • Network: vpc-ips
    • Subnetwork: subnet-client-ips IPv4 (192.168.10.0/24)

  7. Click Done.

  8. Click Create.

gcloud

To create the client VM, run the following command:

gcloud compute instances create vm-client-ips \
    --network vpc-ips \
    --zone us-central1-a \
    --subnet subnet-client-ips \
    --stack-type IPV4_ONLY

Create a security profile

In this section, you create a security profile of type threat-prevention in your organization. To view the permissions required to create a security profile, see Permissions required for this task .

Console

  1. In the Google Cloud console, go to the Security profilespage.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profilestab.

  4. Click Create profile.

  5. For Name, enter sec-profile-ips .

  6. For Description, enter Security profile to set up intrusion prevention service .

  7. Click Continue.

  8. Click Create.

gcloud

To create a security profile, run the following command:

gcloud network-security security-profiles \
    threat-prevention \
    create sec-profile-ips \
    --organization ORGANIZATION_ID 
\
    --location global \
    --project PROJECT_ID 
\
    --description "Security profile to set up intrusion prevention service."

Replace the following:

  • ORGANIZATION_ID : the organization where the security profile is created.
  • PROJECT_ID : a project ID to use for quotas and access restrictions on the security profile.

Create a security profile group

In this section, you create a security profile group to include the security profile that you created in the preceding section. To view the permissions required to create a security profile group, see Permissions required for this task .

Console

  1. In the Google Cloud console, go to the Security profilespage.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profile groupstab.

  4. Click Create profile group.

  5. For Name, enter sec-profile-group-ips .

  6. For Description, enter Security profile group to set up intrusion prevention service .

  7. In the Threat prevention profilelist, select sec-profile-ips .

  8. Click Create.

gcloud

To create a security profile group, run the following command:

gcloud network-security security-profile-groups \
    create sec-profile-group-ips \
    --organization ORGANIZATION_ID 
\
    --location global \
    --project PROJECT_ID 
\
    --threat-prevention-profile  \
    organizations/ ORGANIZATION_ID 
/locations/global/securityProfiles/sec-profile-ips \
    --description "Security profile group to set up intrusion prevention service."

Replace the following:

  • ORGANIZATION_ID : the organization where the security profile group is created.
  • PROJECT_ID : a project ID to use for quotas and access restrictions on the security profile group.

Create a firewall endpoint

In this section you create a firewall endpoint in a specific zone. To view the permissions required to create a firewall endpoint, see Permissions required for this task .

Note: When you create a firewall endpoint, the state of the firewall endpoint is set to Creating . After the firewall endpoint is ready, the state changes to Active .

Console

  1. In the Google Cloud console, go to the Firewall endpointspage.

    Go to Firewall endpoints

  2. In the project selector menu, select your organization.

  3. Click Create.

  4. In the Regionlist, select asia-southeast1 (Singapore) .

  5. In the Zonelist, select asia-southeast1-a .

  6. For Name, enter endpoint-ips .

  7. Click Create.

gcloud

To create a firewall endpoint, run the following command:

gcloud network-security firewall-endpoints \
    create endpoint-ips \
    --organization ORGANIZATION_ID 
\
    --zone asia-southeast1-a \
    --billing-project PROJECT_ID

Replace the following:

  • ORGANIZATION_ID : the organization where the firewall endpoint is created.
  • PROJECT_ID : a project ID to use for the billing of the firewall endpoint.

Create a firewall endpoint association

In this section, you associate the firewall endpoint to the VPC network that you created in the preceding step.

Console

  1. In the Google Cloud console, go to the VPC networkspage.

    Go to VPC networks

  2. Click the vpc-ips network to show its VPC network detailspage.

  3. Select the Firewall endpointtab.

  4. Click Add endpoint association.

  5. In the Regionlist, select asia-southeast1 .

  6. In the Zonelist, select asia-southeast1-a .

  7. In the Firewall endpointlist, select endpoint-ips .

  8. Click Create.

gcloud

To create a firewall endpoint association, run the following command:

gcloud network-security firewall-endpoint-associations \
    create endpoint-association-ips \
    --endpoint  organizations/ ORGANIZATION_ID 
/locations/asia-southeast1-a/firewallEndpoints/endpoint-ips \
    --network vpc-ips \
    --zone asia-southeast1-a \
    --project PROJECT_ID

Replace the following:

  • ORGANIZATION_ID : the organization where the firewall endpoint is created.
  • PROJECT_ID : a project ID where the association is created.

Create a global network firewall policy

In this section, you create a global network firewall policy that contains the following two firewall rules:

  1. An ingress firewall rule with priority 100 to allow TCP traffic to ports 3389 and 22 . This rule enables IAP access to the VM instances in the VPC network.
  2. An ingress firewall rule with priority 200 to perform Layer 7 inspection on the incoming traffic to the server VM in a specific zone.

Console

  1. In the Google Cloud console, go to the Firewall policiespage.

    Go to Firewall policies

  2. In the project selector list, select your project within your organization.

  3. Click Create firewall policy.

  4. For Name, enter fw-policy-ips .

  5. For Deployment scope, select Global.

  6. Click Continue, and then click Add rule.

  7. In the Priorityfield, enter 100 .

  8. For Logs, select On.

  9. For Direction of traffic, select Ingress.

  10. For Action on match, select Allow.

  11. For the Sourcefilter, select IPv4, and then in the IP rangefield enter 35.235.240.0/20 .

  12. In the Protocols and portssection, select Specified protocols and ports.

  13. Select TCP, and for Ports, enter 22,3389 .

  14. Click Create.

  15. Click Add rule.

  16. In the Priorityfield, enter 200 .

  17. For Logs, select On.

  18. For Direction of traffic, select Ingress.

  19. For Action on match, select Proceed to L7 inspection.

  20. In the Security profile grouplist, select sec-profile-group-ips .

  21. In the Destinationfilter, select IPv4, and then in the IP rangefield enter the external IP address of the server VM that you created in the Create the server VM instances section.

  22. Click Create.

  23. Click Continue.

  24. Click Associate policy with VPC networks.

  25. Select vpc-ips network.

  26. Click Associate.

  27. Click Create.

gcloud

  1. To create a global network firewall policy, run the following command:

    gcloud compute network-firewall-policies \
  create fw-policy-ips \
  --global \
  --project PROJECT_ID

    Replace the following:

    • PROJECT_ID : a project ID where the global network firewall policy is created.

  2. To add the firewall rule to enable IAP access, run the following command:

    gcloud compute network-firewall-policies rules create 100 \
  --firewall-policy fw-policy-ips \
  --direction INGRESS \
  --action ALLOW \
  --src-ip-ranges 35.235.240.0/20 \
  --layer4-configs tcp:22, tcp:3389 \
  --global-firewall-policy \
  --enable-logging

  3. To add the firewall rule to enable Layer 7 inspection for threat prevention and detection, run the following command:

    gcloud compute network-firewall-policies rules create 200 \
  --direction INGRESS \
  --firewall-policy fw-policy-ips \
  --action apply_security_profile_group \
  --dest-ip-ranges SERVER_VM_IP 
\
  --layer4-configs tcp:0-65535 \
  --global-firewall-policy \
  --security-profile-group \
  //networksecurity.googleapis.com/organizations/ ORGANIZATION_ID 
\
  /locations/global/securityProfileGroups/sec-profile-group-ips \
  --enable-logging

    Replace the following:

    • SERVER_VM_IP : the external IP address of the server VM that you created in the Create the server VM instances section.

    • ORGANIZATION_ID : the organization where the secure profile group is created.

  4. To associate the firewall policy with the VPC network, run the following command:

    gcloud compute network-firewall-policies associations create \
 --firewall-policy fw-policy-ips \
 --network vpc-ips \
 --name fw-pol-association-ips \
 --global-firewall-policy \
 --project PROJECT_ID

    Replace the following:

    • PROJECT_ID : the project ID where the VPC association is created.

Test the setup

In this section, you generate the traffic that is intercepted by the endpoint, and the global network firewall policy is applied to perform Layer 7 inspection.

Console

  1. In the Google Cloud console, go to the VM instancespage.

    Go to VM instances

  2. From the External IPcolumn of the vm-server-ips VM, copy the external IP address of the VM.

  3. In the Connectcolumn of the vm-client-ips VM, click SSH.

  4. In the SSH-in-browserdialog, click Authorizeand wait for the connection to establish.

  5. To verify whether a non-threat request isn't blocked, run the following command:

    curl EXTERNAL_IP 
-m 2

    Replace EXTERNAL_IP with the external IP of the vm-server-ips VM.

    The expected response message is as follows:

    <!doctype html><html><body><h1>Hello World!</h1></body></html>

  6. To verify that a malicious request is blocked, run the following command. This command sends a request to access the password file, which is forbidden.

    curl -m 2 EXTERNAL_IP 
:80/cgi-bin/../../../../bin/cat%20/etc/passwd/

    Replace EXTERNAL_IP with the external IP of vm-server-ips VM.

    A Connection timed out message is expected because the firewall endpoint detects the threat in the request and blocks the packet.

  7. Close the SSH-in-browserdialog.

gcloud

  1. To connect to the vm-client-ips VM, run the following command:

    gcloud compute ssh vm-client-ips \
   --zone=us-central1-a \
   --tunnel-through-iap

    When prompted, press Y to confirm, and then press Enter .

  2. To verify whether a non-threat request isn't blocked, run the following command:

    curl EXTERNAL_IP 
-m 2

    Replace EXTERNAL_IP with the external IP of the vm-server-ips VM.

    The expected response message is as follows:

    <!doctype html><html><body><h1>Hello World!</h1></body></html>

  3. To verify that a malicious request is blocked, run the following command:

    curl -m 2 EXTERNAL_IP 
:80/cgi-bin/../../../../bin/cat%20/etc/passwd/

    Replace EXTERNAL_IP with the external IP of the vm-server-ips VM.

    A Connection timed out message is expected because the firewall endpoint detects the threat in the request and blocks the packet.

  4. To close the SSH-in-browser, enter exit .

View the threat logs

  1. In the Google Cloud console, go to the Threatspage.

    Go to Threats

  2. If necessary, select your Google Cloud project.

  3. In the Threatsection, you can see the logs entry for the threat detected on your vpc-ips network.

Clean up

To avoid incurring charges to your Google Cloud account for the resources used in this tutorial, either delete the project that contains the resources, or keep the project and delete the individual resources.

In this section, you delete the resources created in this tutorial.

Delete the firewall endpoint association

Console

  1. In the Google Cloud console, go to the VPC networkspage.

    Go to VPC networks

  2. Click the vpc-ips network to show its VPC network detailspage.

  3. Select the Firewall endpointtab. The tab shows a list of configured firewall endpoint associations.

  4. Select the checkbox next to endpoint-ips , and then click Delete.

  5. Click Deleteagain to confirm.

gcloud

To delete the firewall endpoint association, run the following command: yes,

gcloud network-security firewall-endpoint-association
delete endpoint-ips
--zone asia-southeast1-a

Delete the firewall endpoint

Console

  1. In the Google Cloud console, go to the Firewall endpointspage.

    Go to Firewall endpoints

  2. Select endpoint-ips , and then click Delete.

  3. Click Deleteagain to confirm.

gcloud

To delete the firewall endpoint, run the following commands:

gcloud network-security firewall-endpoints delete endpoint-ips \
    --organization ORGANIZATION_ID 
\
    --zone asia-southeast1-a

Replace the following:

  • ORGANIZATION_ID : the organization where the endpoint is created.

Delete the global network firewall endpoint policy

Console

  1. In the Google Cloud console, go to the Firewall policiespage.

    Go to Firewall policies

  2. In the project selector menu, select your project that contains the policy.

  3. Click fw-policy-ips .

  4. Click the Associationstab.

  5. Select all associations.

  6. Click Remove Associations.

  7. After all associations are removed, click Delete.

gcloud

  1. To remove the association between firewall policy and VPC network, run the following command:

    gcloud compute network-firewall-policies associations delete \
  --name fw-pol-association-ips \
  --firewall-policy fw-policy-ips \
  --global-firewall-policy

  2. Delete the firewall policy.

    gcloud compute network-firewall-policies delete fw-policy-ips --global

    When prompted, press Y to confirm, and then press Enter .

Delete the security profile group

Console

  1. In the Google Cloud console, go to the Security profilespage.

    Go to Security profiles

  2. Select the Security profile groupstab.

  3. Select sec-profile-group-ips , and then click Delete.

  4. Click Deleteagain to confirm.

gcloud

To delete the security profile group, run the following command:

gcloud network-security security-profile-groups \
    delete sec-profile-group-ips \
    --organization ORGANIZATION_ID 
\
    --location global

Replace the following:

  • ORGANIZATION_ID : the organization where the security profile group is created.

Delete the security profile

Console

  1. In the Google Cloud console, go to the Security profilespage.

    Go to Security profiles

  2. Select the Security profilestab. The tab shows a list of configured security profiles.

  3. Select sec-profile-ips , and then click Delete.

  4. Click Deleteagain to confirm.

gcloud

To delete the security profile, run the following command:

gcloud network-security security-profiles threat-prevention \
    delete sec-profile-ips \
    --organization ORGANIZATION_ID 
\
    --location global

Replace the following:

  • ORGANIZATION_ID : the organization where the security profile is created.

Delete the VMs

Console

  1. In the Google Cloud console, go to the VM instancespage.

    Go to VM instances

  2. Select the checkboxes of both the vm-client-ips and vm-server-ips VMs.

  3. Click Delete.

  4. In the Delete 2 instances?dialog, click Delete.

gcloud

  1. To delete the vm-client-ips VM, run the following command:

    gcloud compute instances delete vm-client-ips \
  --zone us-central1-a

    When prompted, press Y to confirm, and then press Enter .

  2. To delete the vm-server-ips VM, run the following command:

    gcloud compute instances delete vm-server-ips \
  --zone asia-southeast1-a

    When prompted, press Y to confirm, and then press Enter .

Delete the VPC network and its subnets

Console

  1. In the Google Cloud console, go to the VPC networkspage.

    Go to VM instances

  2. In the Namecolumn, click vpc-ips .

  3. Click Delete VPC network.

  4. In the Delete a networkdialog, click Delete.

When you delete a VPC, its subnets are also deleted.

gcloud

  1. To delete the subnet subnet-ips-client of the vpc-ips VPC network, run the following command:

    gcloud compute networks subnets delete subnet-ips-client \
    --region us-central1

    When prompted, press Y to confirm, and then press Enter .

  2. To delete the subnet subnet-ips-server of the vpc-ips VPC network, run the following command:

    gcloud compute networks subnets delete subnet-ips-server \
    --region=asia-southeast1

    When prompted, press Y to confirm, and then press Enter .

  3. To delete the vpc-ips VPC network, run the following command:

    gcloud compute networks delete vpc-ips

What's next