[MUSIC PLAYING]
SPEAKER: As enterprises digitally transform themselves,
networks are at the foundation.
While networks are constantly modified
to support your applications, you need a single pane of glass
that can address all aspects of troubleshooting and monitoring
so you can easily diagnose complex connectivity
and network performance issues.
Network Intelligence Center is Google Cloud's framework
for network monitoring across the cloud and on premise.
It improves user experience, security, and operations
by providing a comprehensive platform
for network monitoring, verification, and optimization
across the cloud and Datacenter.
Firewall Insights is a module in network intelligence center
that helps you optimize firewall rule configuration,
tighten up network security boundaries,
and detect abnormal traffic patterns.
Large enterprises often have thousands, sometimes
tens of thousands, of firewall rules configured
by different groups.
Over time, the large number of rules
becomes unmanageable and introduces
all kinds of security risks and operation overhead.
The Firewall Insights module helps you tackle
these challenging problems.
I'll walk you through a few use cases
where you can leverage these new functionalities to optimize
your VPC firewall configuration.
As firewall rules are added by different people
at different times, new rules can be accidentally shadowed
by existing rules and as a result fail to take effect.
Without automated detection, it's very hard for you
to catch this when managing a large number of firewall rules
configured for the same VPC.
Suppose I
Have added a rule to allow traffic from 10.1.0.0/24subnet
to access web app 2.
When I go to VM1 in the source subnet with IP as 10.1.0.2
and try to reach VM2 tagged with a web app 2, it fails.
To find out why, I'll go to the network detail page for VM2.
Here are two rules applied to this traffic.
The deny rule blocking traffic from 10.1.0.0/16 range is
shadowing the allow rule that allows traffic from a sub range
10.1.0.0/24.
To avoid such incidents in the future,
you want to proactively clean up your firewall configurations
and automatically identify all firewall rules accidentally
overshadowed by other rules.
Firewall Insights in Network Intelligence Center
provides you with a convenient list of rules overshadowed
by other firewall rules.
A rule can be either overshadowed
by a single or a combination of multiple rules.
In this case, the rule allowing traffic
on both port 8080 and 443 is overshadowed
by a combination of two deny rules blocking HTTP and HTTPS
traffic respectively.
You can review each shadowed rule in site detail
and adjust the rule settings to match your application traffic
control needs.
In this second scenario, I'll show you the allow rules
with no hit in sight to help you clean up your
allow rules leftover from past projects
and tighten up your security boundaries.
To find out what these unnecessary allow rules are,
I'll go to the Firewall Insights in the Network Intelligence
Center.
On the allow rules with no hit card,
I see a list of firewall rules that I have not
been hit by any traffic in the last six weeks.
We notice that there is a rule for allowing internet traffic
to an app in a test project, web app 1
that the project owner forgot to clean up.
The firewall insides module automatically
detect such leftover allow rules so that you can get
the opportunity to clean it up.
Using Firewall Insights, you can not only
identify problems in your firewall rule configuration
but also obtain visibility into abnormal traffic patterns
that you want to get alerted to.
Deny rule with hits helps you capture the traffic blocked
by the deny rules and detect external attacks
or misbehaving VMs in your cloud deployment.
From the list, you can easily drill down
to the corresponding firewall logs
to review and find out where the deny traffic came from.
In summary, Firewall Insights automatically
detects overlapping and misconfigured rules
to help you maintain the right set of firewall rules
that protect your cloud deployment
and brings real-time visibility to your firewall utilization
statistics.
[MUSIC PLAYING]