Use Dynamic Address Groups to Secure Instances Within the VPC

Table of Contents

Enable VM Monitoring to Track VM Changes on Google Cloud Platform (GCP)

Use Custom Templates or the gcloud CLI to Deploy the VM-Series Firewall

Use Dynamic Address Groups to Secure Instances Within the VPC

Learn how to configure the VM-Series firewall to monitor VMs in your project’s VPC.

Where Can I Use This?	What Do I Need?
Google Cloud Platform (GCP)	VM-Series License (PAYG or BYOL) VM-Series plugin Panorama Panorama plugin for GCP

In a dynamic environment such as the Google® Cloud Platform (GCP™), where you launch new instances on-demand, the administrative overhead in managing Security policy can be cumbersome. Using use dynamic address groups in policy enables agility and prevents disruption in services or gaps in protection.

This workflow assumes that you have deployed the VM-Series firewall, configured some applications on instances, and enabled Google Stackdriver monitoring. Follow the below steps to configure the firewall to monitor the VPC.

Label instances in the VPC.
A label is a name-value pair. You can label resources from the Google Cloud Console, from Google API calls, or from the Google Cloud Shell. In this task, we are labeling instances; however, labels can be applied to many resources, as described in Labeling Resources.
You can also add labels from the Instance browser.

The labels you create support your strategy for differentiating your resources in ways that are useful to your Security policy.
Create a Dynamic Address Group on the firewall.
1. Select ObjectsAddress Groups.
2. Add a Dynamic Address Group and specify a Name and a Description.
3. Set Type to Dynamic.
4. Define the match criteria.
  Add Match Criteria and select the And operator.
  Select the attributes to filter for or to match against.
5. Click OK.
6. Click Commit.
Use the Dynamic Address Group in a Security policy rule.

Create a rule to allow internet access to any web server that belongs to the Dynamic Address Group called my-data.
1. Select PoliciesSecurity.
2. Add a rule and a Name for the rule and verify that the Rule Type is universal.
3. In the Source tab, add trust as the Source Zone.
4. In the Source Address section, Add your new my-data group.
5. In the Destination tab, add untrust as the Destination Zone.
6. In the Service/URL Category tab, verify that the service is set to application-default.
7. In the Actions tab, set the Action to Allow.
8. In the Profile Settings, set the Profile Type to Profiles and then attach the default profiles for antivirus, antispyware, and vulnerability protection.
9. Click OK.
10. Click Commit.
Verify that members of the Dynamic Address Group are populated on the firewall.

The policy will be enforced for all IP addresses that belong to this address group and that are displayed here.
1. Select PoliciesSecurity and select the rule.
2. Select Inspect from the drop-down. You can also verify that the match criteria are accurate.
3. Click more to verify that the list of registered IP addresses is displayed.