Create address groups for firewall policies

To create address groups, you must first identify the scope of the address group relevant to your requirement. The scope identifies the level at which the address group is applicable in the resource hierarchy.

If you want to use an address group in a firewall policy rule that applies to an individual project, use a project-scoped address group.

If you want to use an address group in a firewall policy rule that is applicable throughout the hierarchy on all resources in an organization or network, use an organization-scoped address group.

Project-scoped address groups

This section provides detailed information about how to create project-scoped address groups.

Project-scoped address groups are defined at the project level, and only apply to the project where they are created. To use an address group, you must associate it to a firewall rule in a global network firewall policy or regional network firewall policy. The location of the address group must be the same as the location of the firewall policy where it is used.

Create an address group

The container type of the project-scoped address group is always set to projects.

When you create an address group, you can specify the name of the address group as a string or as a unique URL identifier. The unique URL for a project-scoped address group can be constructed in the following format:

projects/PROJECT_ID/locations/location/addressGroups/ADDRESS_GROUP_NAME

If you use a unique URL identifier for the address group name, the location of the address group is already included in the URL identifier. However, if you use only the address group name, you must specify the location separately. For more information about unique URL identifiers, see Address group specifications.

An address group can have IPv4 or IPv6 item types, but not both. You must also specify the maximum item capacity for an address group. After the address group is created, you cannot change the name, item type, or item capacity of the address group.

Console

  1. In the Cloud de Confiance console, go to the Address groups page.

    Go to Address groups

  2. In the project selector menu, select your project.

  3. Click Create Address Group.

  4. In the Name field, enter a name.

  5. Optional: In the Description field, enter a description.

  6. For Scope, choose Global or Regional.

    If you choose Regional, specify the region where the address group is created.

  7. For Type, select IPv4 or IPv6.

  8. For Purpose, select Firewall.

    If you want to use the address group in both Cloud Next Generation Firewall policies and Google Cloud Armor security policies, choose Cloud NGFW and Cloud Armor.

    For more information about this field , see address group specification.

  9. In the Capacity field, enter the capacity of the address group.

  10. In the IP Addresses field, list the IP addresses or IP ranges that you want to include in the address group. For example, 1.1.1.0/24,1.2.0.0.

  11. Click Create.

gcloud

To create an address group, use the gcloud network-security address-groups create command:

gcloud network-security address-groups create NAME \
   --type TYPE \
   --capacity CAPACITY \
   --location LOCATION \
   --description DESCRIPTION

Replace the following:

  • NAME: the name of the address group; you can specify the name as a string or as a unique URL identifier

  • TYPE: the type of address group—IPv4 or IPv6

  • CAPACITY: the capacity of the address group

  • LOCATION: the location of the address group

    This can be set to global or a region code (such as europe-west). If you use a unique URL identifier for the name parameter, you can omit the location parameter.

  • DESCRIPTION: an optional description for the address group

Clone items from another address group

You can clone items from one address group to another.

Console

  1. In the Cloud de Confiance console, go to the Address groups page.

    Go to Address groups

  2. In the project selector menu, select your project.

  3. The address groups are listed in the Address groups section.

  4. Click the name of your address group that you want to clone.

  5. Click Clone.

  6. In the Clone address group pane, for Name, enter a name.

  7. Optional: In the Description field, enter a description.

  8. For Scope, select Global or Regional.

    If you choose Regional, specify the region where the address group is created.

  9. For Type, select IPv4 or IPv6.

  10. For Purpose, select Firewall.

  11. In the Capacity field, enter the capacity of the address group.

  12. In the IP Addresses field, update the IP addresses or IP ranges that are cloned from the address group.

  13. Click Clone.

gcloud

To clone an address group by using Google Cloud CLI, follow these guidelines:

  • Both address groups must be of the same type.
  • Both address groups must be in the same region.
  • Make sure that the new address group has sufficient capacity to fit the items of the source address group that are being cloned.

  • To specify the source address group, use the following unique URL identifier format:

    projects/PROJECT_ID/locations/location/addressGroups/ADDRESS_GROUP_NAME

    For more information about unique URL identifiers for address groups, see Address group specifications.

To clone items from an address group, use the gcloud network-security address-groups clone-items command:

gcloud network-security address-groups clone-items NAME \
    --source SOURCE_NAMED_LIST \
    --location LOCATION

Replace the following:

  • NAME: the name of the address group; you can specify the name as a string or as a unique URL identifier

  • SOURCE_NAMED_LIST: a unique URL identifier of the source address group from where the items are cloned

  • LOCATION: the location of the destination address group

    This can be set to global or a region code (such as europe-west). If you use a unique URL identifier for the name parameter, you can omit the location parameter.

Organization-scoped address groups

This section provides detailed information about how to create organization-scoped address groups.

Organization-scoped address groups are defined at the organization level and apply to all the resources in the organization as specified in the resource hierarchy. To use an address group, you must associate it to a firewall rule in a hierarchical firewall policy, a global network firewall policy, or a regional network firewall policy.

Create an address group

The container type of the organization-scoped address group is always set to organization.

When you create an address group, you can specify the name of the address group as a string or as a unique URL identifier. The unique URL for an organization-scoped address group can be constructed in the following format:

organizations/ORGANIZATION_ID/locations/LOCATION/addressGroups/ADDRESS_GROUP_NAME

If you use a unique URL identifier for the address group name, the organization ID or location for the address group is already included in the URL identifier. However, if you use only the address group name, you must specify the ID of the organization and the location where you are defining the address group. For more information about unique URL identifiers, see Address group specifications.

An address group can have IPv4 or IPv6 item types, but not both. You must also specify the maximum item capacity for an address group. After the address group is created, you cannot change the name, item type, or item capacity of the address group.

Console

  1. In the Cloud de Confiance console, go to the Address groups page.

    Go to Address groups

  2. In the project selector menu, select your organization.

  3. Click Create Address Group.

  4. In the Name field, enter a name.

  5. Optional: In the Description field, enter a description.

  6. For Scope, select Global or Regional.

    If you choose Regional, specify the region where the address group is created.

  7. For Type, select IPv4 or IPv6.

  8. For Purpose, select Firewall.

  9. In the Capacity field, enter the capacity of the address group.

  10. In the IP Addresses field, list the IP addresses or IP ranges that you want to include in the address group. For example, 1.1.1.0/24,1.2.0.0.

  11. Click Create.

gcloud

To create an organization-scoped address group, use the gcloud network-security org-address-groups create command:

gcloud network-security org-address-groups create NAME \
   --organization ORGANIZATION \
   --type TYPE \
   --capacity CAPACITY \
   --location LOCATION \
   --description DESCRIPTION

Replace the following:

  • NAME: the name of the address group; you can specify the name as a string or as a unique URL identifier

  • ORGANIZATION: the organization ID where the address group is created

    If you use a unique URL identifier for the name parameter, you can omit the organization parameter.

  • TYPE: the type of address group—IPv4 or IPv6

  • CAPACITY: the capacity of the address group

  • LOCATION: the location of the address group

    This can be set to global or a region code (such as europe-west). If you use a unique URL identifier for the name parameter, you can omit the location parameter.

  • DESCRIPTION: an optional description for the address group

Clone items from another address group

You can clone items from one address group to another.

Console

  1. In the Cloud de Confiance console, go to the Address groups page.

    Go to Address groups

  2. In the project selector menu, select your organization.

  3. The address groups are listed in the Address groups section.

  4. Click the name of your address group that you want to clone.

  5. Click Clone.

  6. In the Clone address group pane, for Name, enter a name.

  7. Optional: In the Description field, enter a description.

  8. For Scope, select Global or Regional.

    If you choose Regional, specify the region where the address group is created.

  9. For Type, select IPv4 or IPv6.

  10. For Purpose, select Firewall.

  11. In the Capacity field, enter the capacity of the address group.

  12. In the IP Addresses field, update the IP addresses or IP ranges that are cloned from the address group.

  13. Click Clone.

gcloud

To clone an address group by using gcloud CLI, follow these guidelines:

  • Both address groups must be of the same type.
  • Both address groups must be in the same location.
  • Make sure that the new address group has sufficient capacity to fit the items of the source address group that are being cloned.

  • To specify the source address group, you must use the following unique URL identifier:

    organizations/ORGANIZATION_ID/locations/LOCATION/addressGroups/ADDRESS_GROUP_NAME

For more information about unique URL identifiers for address groups, see Address group specifications.

To clone items from an organization-scoped address group, use the gcloud network-security org-address-groups clone-items command:

gcloud network-security org-address-groups clone-items NAME \
    --organization ORGANIZATION \
    --source SOURCE_NAMED_LIST \
    --location LOCATION

Replace the following:

  • NAME: the name of the address group; you can specify the name as a string or as a unique URL identifier

  • ORGANIZATION: the organization ID where the address group is created

    If you use a unique URL identifier for the name parameter, you can omit the organization parameter.

  • SOURCE_NAMED_LIST: a unique URL identifier of the source address group from where the items are cloned

  • LOCATION: the location of the destination address group

    This can be set to global or a region code (such as europe-west). If you use a unique URL identifier for the name parameter, you can omit the location parameter.

What's next