Focus

VM-Series Deployment Guide

Multiple Network Interface Architecture

Table of Contents

Multiple Network Interface Architecture

In the multiple interface architecture, additional dataplane interfaces are attached to workload VPC networks, with each interface set as a backend service of an internal pass-through load balancer. In the autoscale model, these load balancers distribute traffic to the firewalls. In the active/passive model, they manage stateful traffic failover between the firewall HA pair. Custom or policy-based routes in each workload VPC direct traffic to the respective load balancer within the same VPC.

In Google Cloud, a maximum of 8 interfaces can be allocated on a per virtual machine basis.
In Google Cloud, you cannot attach or detach network interfaces after a virtual machine is created. Therefore, it is important to plan your network interface allocation prior to firewall deployment.

The following diagram is an example of the multiple interface architecture:

The following examples show the different traffic patterns that run through the VM-Series firewalls in this configuration:

An inbound request is made to an application hosted in VPC C. The external load balancer (External LB) distributes the request to the VM-Series untrust interfaces. The VM-Series firewall inspects and forwards the request through the NIC4 in VPC C and to the destination application.
The route table of VPC B routes traffic that is destined to the internet to the IP address of Internal LB B (10.2.0.10). The load balancer distributes the traffic to NIC3 on the VM-Series firewalls. The VM-Series inspects and forwards the traffic through its untrust interface (NIC0) to the internet.
A resource in VPC A makes a request to a resource in VPC B. The route table of VPC A routes the request to the Internal LB A . The load balancer distributes the request to NIC2 on the VM-Series. The VM-Series inspects and forwards the request through NIC3 to the resource in VPC B. VPC B routes its return traffic to Internal LB B using the route table of VPC B. .
A resource in VPC A makes a request within VPC A. A policy based route within VPC A steers the intra-VPC traffic to the forwarding rule of Internal LB A. The VM-Series inspects and forwards the traffic through NIC2 to the destination in VPC A. The return traffic uses the same routing path as the request traffic.

Securing VPC Networks with VM-Series Firewall on GCP

VPC network peering model