Standard VPC Firewall rules operate at Layer 3 and Layer 4—they allow or deny traffic based on IP addresses, ports, and protocols. This is sufficient for most use cases, but it cannot distinguish between a legitimate HTTPS request and an SQL injection payload hiding inside the same TCP 443 stream. For organizations that need deep packet inspection, TLS interception, and application-aware filtering, Google Cloud offers two enterprise-grade security services: Cloud NGFW Enterprise and Secure Web Proxy.
These are not upgrades to VPC Firewall rules—they are fundamentally different products with different architectures, different pricing, and different capabilities. Understanding when to use each one is a critical skill for the PCNE exam.
Cloud NGFW Enterprise: Inline Deep Packet Inspection
Cloud NGFW Enterprise brings Layer 7 intelligence to your firewall. It does not just check the IP and port—it decrypts the payload, inspects the content, and makes an allow/deny decision based on what it finds.
Key Features
- Intrusion Prevention System (IPS): Detects and blocks malware, spyware, and command-and-control traffic in real time. Powered by Palo Alto Networks’ threat signatures.
- TLS Inspection: The firewall decrypts TLS traffic, inspects the payload for threats, re-encrypts it, and forwards it to the destination. This is essential for DLP (Data Loss Prevention) policies—without TLS inspection, encrypted traffic is a blind spot.
- Application Identification (App-ID): Identify traffic by application, not just port. Allow “Slack” but deny “TikTok,” even though both use TCP 443.
Architecture
- Firewall Endpoint: A zonal resource that processes traffic. Think of it like a load balancer—it is a regional compute resource managed by Google.
- Firewall Policy: The rules that define what the endpoint inspects and how it responds.
- The key distinction from Cloud IDS: Cloud IDS is passive—it mirrors traffic and generates alerts. Cloud NGFW is inline—it sits in the packet path and blocks threats before they reach your workloads.
If the exam says “detect AND block threats in real time,” the answer is Cloud NGFW Enterprise. If it says “detect and alert without blocking,” the answer is Cloud IDS.
Secure Web Proxy (SWP): Managed Outbound Filtering
We discussed the Secure Web Proxy pattern in Article 19. Now, let us examine its detailed configuration.
SWP is a fully managed, serverless proxy for controlling outbound internet access from your VMs. It replaces the traditional self-managed Squid proxy farm.
The Components
- Web Gateway: The regional proxy resource. It receives traffic and evaluates it against your policies.
- URL Lists: Reusable lists of allowed or denied domains (e.g.,
*.github.com,pypi.org). - Gateway Security Policy: The ruleset.
- Rule 1: Allow traffic to
UrlList: Approved-Repos. - Rule 2: Deny All.
- Rule 1: Allow traffic to
Client Configuration
SWP operates as an explicit proxy. Your VMs must be configured to use it:
export HTTP_PROXY=http://10.0.0.5:443
export HTTPS_PROXY=http://10.0.0.5:443
SWP does not transparently intercept traffic. The client must be aware of the proxy.
Why SWP Matters
- Compliance: You can prove to auditors exactly which external domains your VMs can access.
- Security: Prevents compromised VMs from contacting command-and-control servers.
- No VM management: Unlike a Squid proxy, SWP is serverless—you do not manage compute, patches, or scaling.
The Clean Distinction
| Service | Direction | Layer | Action |
|---|---|---|---|
| Cloud Armor | Inbound | L7 (WAF) | Protect web apps |
| Secure Web Proxy | Outbound | L7 (Proxy) | Control VM web access |
| Cloud NGFW Enterprise | Both | L7 (DPI) | Deep inspect all traffic |
| Cloud IDS | N/A (passive) | L7 | Detect & alert |
| VPC Firewall | Both | L3/L4 | IP/Port allow/deny |
Putting it Together: A Pro-Engineer View
Imagine you are building the security architecture for a defense contractor. All internal traffic must be inspected for data exfiltration. All outbound internet access must be restricted to approved domains only. You deploy Cloud NGFW Enterprise with TLS Inspection enabled on all east-west traffic—every internal request is decrypted, scanned for threats, and re-encrypted before delivery. You deploy Secure Web Proxy for all outbound internet access—VMs can reach apt.ubuntu.com for updates and github.com for code, but nothing else. Cloud Armor protects your public-facing portal with WAF rules and bot management. Cloud IDS mirrors traffic from your most sensitive subnet to detect threats that might bypass inline inspection. Four security products, four different roles, one cohesive defense-in-depth strategy.
