What's changed: Created Professional Cloud Network Engineer Chapter 6 (Domain 6 "Network security": Google Cloud Armor = edge/backend policies/WAF (SQLi/XSS/RFI)/advanced DDoS and Adaptive Protection/rate limiting/bot management/Threat Intelligence; Cloud NGFW/VPC firewall = strategy/hierarchical/effective policy/L7 inspection (Enterprise)/migration/rule criteria (priority/protocol/direction/source-destination)/logging/micro-segmentation (secure tags/SA/network tags)/tiers (Essentials/Standard/Enterprise); public Cloud NAT (auto-manual IP/static-dynamic ports); Secure Web Proxy; self-managed NVA (multi-NIC/internal LB next hop/policy-based routes)/out-of-band Network Security Integration/Packet Mirroring).
6.2Cloud NAT, Secure Web Proxy, and NVA / Packet Mirroring
Understand public Cloud NAT IP addressing (automatic/manual allocation) and static/dynamic port allocation, controlling egress with Secure Web Proxy, self-managed network virtual appliances (multi-NIC VMs/NGFW appliances) with an internal LB as next hop for HA routing, policy-based routes for HA multi-NIC VMs, out-of-band Network Security Integration, and Packet Mirroring to self-managed collectors.
This covers controlling egress and inserting third-party appliances/visibility. Govern egress with NAT and Secure Web Proxy, and insert inspection with NVAs and Packet Mirroring.
6.2.1Cloud NAT and Secure Web Proxy
For internet egress from VMs without external IPs, use public Cloud NAT. Choose NAT IPs by automatic allocation or manual allocation (when a fixed egress IP is required), and configure static port allocation and dynamic port allocation to avoid port exhaustion. To allowlist egress destinations by URL/SNI at the application layer, use Secure Web Proxy (SWP), governing "where egress is allowed" by policy. Map "egress without external IP = Cloud NAT" and "control egress destinations by URL/SNI = Secure Web Proxy."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.