Deploy a Secure Web Proxy instance

In the Google Cloud console, go to the SWP Policiespage.

Go to SWP Policies

Click add_box Create a policy.

Enter a name for the policy that you want to create, such as policy1 .

Enter a description of the policy, such as My new swp policy .

In the Regionslist, select the region where you want to create the web proxy policy.

If you want to create rules for your policy, then click Add rule. For more information, see the Create Secure Web Proxy rules section.

Click Create.

Create the policy.yaml file.

   
 description 
 : 
  
 basic Secure Web Proxy policy 
  
 name 
 : 
  
 projects/ PROJECT_ID 
/locations/ REGION 
/gatewaySecurityPolicies/policy1 
 

Replace the following:

• PROJECT_ID : the project ID of your project
• REGION : the region of your policy

Create the Secure Web Proxy policy.

 gcloud network-security gateway-security-policies import policy1 \
    --source=policy.yaml \
    --location= REGION 
 

In the Google Cloud console, go to the SWP Policiespage.

Go to SWP Policies

Click the name of your policy.

Click add_box Add rule.

Populate the following rule fields:

1. Name
2. Description
3. Status
4. Priority: numeric evaluation order of the rule. The rules are evaluated from highest to lowest priority, where 0 is the highest priority.
5. In the Actionsection, specify whether connections that match the rule are allowed ( Allow) or denied ( Deny).
6. In the Session Matchsection, specify the criteria for matching the session. For more information about the syntax for SessionMatcher , see CEL matcher language reference .
7. Optional: If you want to enable TLS inspection, then select Enable TLS inspection.

8. In the Application Matchsection, specify the criteria for matching the request. If you don't enable the rule for TLS inspection, then the request can only match HTTP traffic.

   For information about matching TPC traffic, see Configure TCP proxy rules for your application .

9. Click Create.

Click Add ruleto add another rule.

Create the rule.yaml file as shown here. For more information about the syntax for SessionMatcher , see CEL matcher language reference .

  name 
 : 
  
 projects/ PROJECT_ID 
/locations/ REGION 
/gatewaySecurityPolicies/policy1/rules/allow-wikipedia-org 
 description 
 : 
  
 Allow wikipedia.org 
 enabled 
 : 
  
 true 
 priority 
 : 
  
 1 
 basicProfile 
 : 
  
 ALLOW 
 sessionMatcher 
 : 
  
 host() == 'www.wikipedia.org' 
 

• Optional: Alternatively, if you want to create a rule with the TLS inspection configuration, then create the rule.yaml file as shown here.

  For information about matching TPC traffic, see Configure TCP proxy rules for your application .

    name 
   : 
    
   projects/ PROJECT_ID 
  /locations/ REGION 
  /gatewaySecurityPolicies/policy1/rules/allow-wikipedia-org 
   description 
   : 
    
   Allow wikipedia.org 
   enabled 
   : 
    
   true 
   priority 
   : 
    
   1 
   basicProfile 
   : 
    
   ALLOW 
   sessionMatcher 
   : 
    
   host() == 'www.wikipedia.org' 
   applicationMatcher 
   : 
    
   request.path.contains('index.html') 
   tlsInspectionEnabled 
   : 
    
   true 
   
  

  Replace the following:

  • PROJECT_ID : the ID of your project
  • REGION : the region of your policy

Create the security policy rule.

  gcloud 
 network 
 - 
 security 
 gateway 
 - 
 security 
 - 
 policies 
 rules 
 import 
  
 allow 
 - 
 wikipedia 
 - 
 org 
\ -- 
 source 
 = 
 rule 
 . 
 yaml 
\ -- 
 location 
 = 
  REGION 
 
\ -- 
 gateway 
 - 
 security 
 - 
 policy 
 = 
 policy1 
 

In the Google Cloud console, go to the Web Proxiespage.

Go to Web Proxies

Click add_box Create a secure web proxy.

Enter a name for the web proxy that you want to create, such as myswp .

Enter a description of the web proxy, such as My new swp .

For Routing mode, select the Explicitoption.

In the Regionslist, select the region where you want to create the web proxy.

In the Networklist, select the network where you want to create the web proxy.

In the Subnetworklist, select the subnetwork where you want to create the web proxy.

Optional: Enter the Secure Web Proxy IP address. You can enter an IP address from the range of Secure Web Proxy IP addresses that reside in the subnetwork you created in the previous step. If you don't enter the IP address, then your Secure Web Proxy instance automatically chooses an IP address from the selected subnetwork.

In the Certificatelist, select the certificate that you want to use to create the web proxy.

In the Policylist, select the policy that you created to associate the web proxy with.

Click Create.

Create the gateway.yaml file.

  name 
 : 
  
 projects/ PROJECT_ID 
/locations/ REGION 
/gateways/swp1 
 type 
 : 
  
 SECURE_WEB_GATEWAY 
 addresses 
 : 
  
 [ 
 " IP_ADDRESS 
" 
 ] 
 ports 
 : 
  
 [ 
 443 
 ] 
 gatewaySecurityPolicy 
 : 
  
 projects/ PROJECT_ID 
/locations/ REGION 
/gatewaySecurityPolicies/policy1 
 network 
 : 
  
 projects/ PROJECT_ID 
/global/networks/ NETWORK 
 
 subnetwork 
 : 
  
 projects/ PROJECT_ID 
/regions/ REGION 
/subnetworks/ SUBNETWORK 
 
 routingMode 
 : 
  
 EXPLICIT_ROUTING_MODE 
 

Replace the following:

• PROJECT_ID : the project ID of your project
• REGION : the region of your Secure Web Proxy instance
• IP_ADDRESS : the IP address of your Secure Web Proxy instance
• NETWORK : the network of your Secure Web Proxy instance
• SUBNETWORK : the subnetwork of your Secure Web Proxy instance

Create a Secure Web Proxy instance based on gateway.yaml .

 gcloud network-services gateways import swp1 \
    --source=gateway.yaml \
    --location= REGION 
 

A Secure Web Proxy instance can take several minutes to deploy.