Deploy AI Runtime Security: Network Intercept in GCP

Deploy AI Runtime Security: Network Intercept in GCP

Where Can I Use This?	What Do I Need?
AI Runtime Security: Network intercept deployment in GCP	Onboard Cloud Account in GCP

This page guides you through deploying a Terraform plan to add AI Runtime Security: Network intercept protection for GCP cloud resources.

On this page, you will configure an AI Runtime Security: Network intercept in Strata Cloud Manager, download the corresponding Terraform template, and deploy it in your cloud environment. This setup will integrate the firewall in your cloud network architecture, enabling comprehensive monitoring and protection of your assets.

After onboarding the cloud account, the Strata Cloud Manager command center dashboard will show asset discovery with no AI Runtime Security protection deployed. Unprotected traffic paths to and from applications, AI models, and the internet are marked in red until you add firewall protection. For more details, see Discover Your Cloud Resources.

1. Log in to Strata Cloud Manager.
2. Select Insights → AI Runtime Security.
3. Select Network from the AI Runtime Security drop-down list at the top.
4. Select Add Protections ("+" icon).
5. Select Cloud Service Provider as Google Cloud and select Next.

   
6. In Firewall Placement, select one or more traffic flows to inspect.

   

   The following table shows the network traffic type the AI Runtime Security: Network intercept or the VM-Series firewall can support:

   Traffic Type	AI Runtime Security: Network intercept	VM-Series
   AI Traffic - Traffic between your applications and AI Models	✅
   Non-AI Traffic and namespaces (example, kube-system)	✅
   Cluster Traffic	✅
   Non-AI and non-cluster traffic	✅	✅

   If you select the `kube-system` namespace, the VM-Series firewall option will be grayed out, as only an AI Runtime Security: Network intercept can protect these namespaces.
7. Select Next.
8. In Region & Applications:

   1. Select your cloud account to secure from the onboarded cloud accounts list.
   2. Select a region in which you want to protect the applications.
   3. In Selected applications:

      

   4. Select the applications to secure from the drop-down list. This list includes application workloads such as namespaces, or VPCs.
   5. Set the Public IP address on the External Load Balancer (ELB) for each application by selecting:

      • Auto generate: Automatically assigns an ephemeral (temporary) IP address to your application.
      • Input manually: Create and assign a static IP address to your application.
        For more details, refer to the Google Cloud documentation on configuring static external IP addresses.

      Each application is mapped to one public ELB IP address.
   6. Protect the Undiscovered VPC(s) or add a new VPC by selecting Add VPC and enter the VPC Name, VPC CIDRs IP address ranges, K8s pod CIDRs (Optional) IP address ranges, and K8s service CIDRs (Optional).

      

   7. Select Submit.
   8. Select Next.
9. In Protection Settings:

   

   1. Select AI Runtime Security or VM-Series firewall type based on the type of traffic you decided to protect under Firewall Placement in step 5.
   2. Enter the Service account attached to security VM.
   3. Number of firewalls to deploy.
   4. Select zones to deploy firewalls.
   5. Choose the instance type for the security VM. (See Machine families resource and comparison guide for details).
10. Configure the following:

    IP addressing scheme	Licensing	SCM management parameters
    CIDR value for untrust VPC. CIDR value for trust VPC. CIDR value for management VPC.	Software version for your image. Flex authentication code (Copy AUTH CODE for the deployment profile you created for AI Runtime Security: Network intercept in Customer Support Portal). Device Certificate PIN ID. Device Certificate PIN value.	List CIDR ranges to be allowed access to the management interface. Enter the SSH key to be used for login (see how to Create SSH keys). Select Manage by SCM and select the SCM folder to group the AI Runtime Security: Network intercept. Refer to Workflows: Folders - Strata Cloud Manager.

    Refer to the Deploy AI Runtime Security: Network Intercept for Panorama Managed Firewall for the Manage by Panorama configurations.
11. Select Next.
12. In Review Architecture screen:

    

    • Enter a unique Terraform template name. (Use only lowercase letters, numbers, and hyphens. Don't use a hyphen at the beginning or end, and limit the name under 19 characters).
    • Create terraform template.
    • Save and Download Terraform Template.
    • Close the deployment workflow to exit.
13. Unzip the downloaded file. Navigate to <unzipped-folder> with 2 directories: `architecture` and `modules`. Deploy the Terraform templates in your cloud environment following the `README.md` file in the `architecture` folder.
14. Initialize and apply the Terraform for the security_project.

    The `security_project` contains the Terraform plan to create an AI network intercept (AI firewall) architecture. The Terraform plan creates the required resources to deploy AI network intercept with in-line prevention mode, including the managed instance groups, load balancers, and health checks.

    cd architecture //Change directory to architecture/security_project
    
    cd security_project
    terraform init
    terraform plan
    terraform apply
    

    The security Terraform generates the following output, record the IP addresses within the lbs_external_ips & lbs_internal_ips outputs.

      Apply complete! Resources: 36 added, 0 changed, 0 destroyed.
    
      Outputs:
    
      lbs_external_ips = {
        "external-lb" = {
          "airs001-all-ports" = "34.xx.xxx.xx"
        }
      }
      lbs_internal_ips = {
        "internal-lb" = "10.0.2.xxx"
      }
      pubsub_subscription_id = {
        "fw-autoscale-common" = "projects/$PROJECT_ID/subscriptions/airs001-fw-autoscale-common-mig"
      }
      pubsub_topic_id = {
        "fw-autoscale-common" = "projects/$PROJECT_ID/topics/airs001-fw-autoscale-common-mig"
      }
     

    The `security_project` Terraform also creates an IP-tag collector service, enabling you to retrieve IP-tag information from clusters. These tags are used to populate dynamic address groups (DAGs) for automated security enforcement. Refer Harvest IP-Tags from Public and Hybrid Kubernetes Clusters to Enforce Security Policy Rules for details.
15. Run the application Terraform to peer the application VPCs.

    cd ../application_project
    terraform init
    terraform plan
    terraform apply

    The application_security Terraform generates the following output:

    Apply complete! Resources: 12 added, 0 changed, 0 destroyed.
16. Configure Strata Cloud Manager or Panorama to secure VM workloads and Kubernetes clusters and deploy pods. Configure interfaces, zones, NAT policy, routers, and security policy rules.
17. Select Workflows → NGFW Setup → Device Management. The AI Runtime Security: Network intercept appears under Cloud Managed Devices.
18. Switch to the Cloud Managed Devices tab to view and manage the connected state, the configuration sync state, and the licenses of the deployed AI network intercept (AI firewall).

    

    It takes a while before the Device Status shows as connected.

    The AI network intercept deployment Terraform also creates an IP-tag collector service, enabling you to retrieve IP-tag information from clusters. These tags are used to populate dynamic address groups (DAGs) for automated security enforcement. Refer harvesting IP-tags for details.

    Next, view the threat logs and AI security logs for traffic inspection details.