Global network firewall policies

To simplify rule management across your Virtual Private Cloud (VPC) networks, use global network firewall policies to consolidate multiple rules into a single object. Review the specifications and enforcement methods of global network policies to maintain micro-segmentation and control traffic flow.

For more information, see the Firewall policies overview.

Note: You can use either global or regional network firewall policies to configure your network security requirements. When the associated VPC networks are limited to a single region, both firewall policy types offer comparable features.

Specifications

• Global network firewall policies are container resources for firewall rules. Each global network firewall policy resource is defined within a project.
  • After you create a global network firewall policy, you can add, update, and delete firewall rules in the policy.
  • For specification information about the rules in global network firewall policies, see Firewall policy rule components.
• To apply global network firewall policy rules to a VPC network, you must associate the firewall policy with that VPC network.
  • You can associate a global network firewall policy with multiple VPC networks. Make sure that the firewall policy and the associated networks belong to the same project.
  • Each VPC network can be associated with only one global network firewall policy.
  • If the firewall policy isn't associated with any VPC network, the rules in that policy have no effect. A firewall policy that is not associated with any network is an unassociated global network firewall policy.
• When a global network firewall policy is associated with one or more VPC networks, the firewall policy rules are enforced in the following ways:
  • Existing rules are enforced against applicable resources in the associated VPC networks.
  • Any changes made to the rules are enforced against applicable resources in the associated VPC networks.
• Rules in global network firewall policies are enforced along with other firewall rules as described in Policy and rule evaluation order.

Global network firewall policy rule details

For more information about the components and parameters of rules in a global network firewall policy, see Firewall policy rule components.

The following table summarizes key differences between global network firewall policy rules and VPC firewall rules:

	Global network firewall policy rules	VPC firewall rules
Priority number	Must be unique within a policy	Duplicate priorities allowed
Service accounts as targets	Yes	Yes
Service accounts as sources (ingress rules only)	No	Yes
Tag type	Secure tag	Network tag
Name and description	Policy name, policy and rule description	Rule name and description
Batch update	Yes—for policy clone, edit, and replace functions	No
Reuse	Yes	No
Quota	Attribute count—based on a total complexity of each rule in the policy	Rule count—complex and simple firewall rules have the same quota impact

Predefined rules

When you create a global network firewall policy, Cloud Next Generation Firewall (Cloud NGFW) adds predefined rules with the lowest priority to the policy. These rules are applied to any connections that don't match an explicitly defined rule in the policy, causing such connections to be passed down to lower-level policies or network rules.

To learn about the various types of predefined rules and their characteristics, see Predefined rules for firewall policies.