Evaluation order for firewall policies and rules

The firewall policy rule evaluation order determines the priority and The firewall policy rule evaluation order determines the priority and sequence in which Google Cloud evaluates rules across your network policies. Understanding the rule evaluation order helps you configure effective security boundaries, prevent unintended access, and troubleshoot traffic flows. This document explains how Google Cloud evaluates firewall rules across your Virtual Private Cloud (VPC) network.

This document is intended for network administrators, security engineers, and security architects who configure and troubleshoot network security and firewall policies.

Google Cloud supports two network firewall policy enforcement orders that control how rules are evaluated relative to classic VPC firewall rules:

  • AFTER_CLASSIC_FIREWALL (default): Evaluates classic VPC firewall rules before evaluating global and regional network firewall policies.

  • BEFORE_CLASSIC_FIREWALL: Evaluates global and regional network firewall policies before evaluating classic VPC firewall rules.

Before reading this document, you should be familiar with hierarchical firewall policies, regional network firewall policies, global network firewall policies, and Virtual Private Cloud (VPC) firewall rules.

Network firewall policy enforcement order

A VPC network can use one of these network firewall policy enforcement orders:

  • AFTER_CLASSIC_FIREWALL (default): Cloud NGFW evaluates firewall policies and rules in the following order:

    1. Hierarchical firewall policies
    2. Regional system firewall policies
    3. VPC firewall rules
    4. Global network firewall policies
    5. Regional network firewall policies
    6. Implied actions

  • BEFORE_CLASSIC_FIREWALL: Cloud NGFW evaluates firewall policies and rules in the following order:

    1. Hierarchical firewall policies
    2. Regional system firewall policies
    3. Global network firewall policies
    4. Regional network firewall policies
    5. VPC firewall rules
    6. Implied actions

To change the network firewall policy enforcement order, do any one of the following:

  • Use the networks.patch method and set the networkFirewallPolicyEnforcementOrder attribute of the VPC network.

  • Use the gcloud compute networks update command with the --network-firewall-policy-enforcement-order flag.

    For example:

    gcloud compute networks update VPC_NETWORK_NAME \
    --network-firewall-policy-enforcement-order=ENFORCEMENT_ORDER

Firewall rule evaluation process

This section describes the order in which Cloud NGFW evaluates rules that apply to target resources in regular VPC networks.

Each firewall rule is either an ingress rule or an egress rule, based on the direction of traffic:

  • Ingress rules apply to packets for a new connection that a target resource receives. Supported target resources for ingress rules are as follows:

    • Network interfaces of virtual machine (VM) instances.

    • Managed Envoy proxies used by internal Application Load Balancers and internal proxy Network Load Balancers.

  • Egress rules apply to packets for a new connection that a target VM network interface sends.

Cloud NGFW always evaluates rules in hierarchical firewall policies and regional system firewall policies before it evaluates any other firewall rules. You control the order in which Cloud NGFW evaluates other firewall rules by choosing a network firewall policy enforcement order. The network firewall policy enforcement order can be either AFTER_CLASSIC_FIREWALL or BEFORE_CLASSIC_FIREWALL.

AFTER_CLASSIC_FIREWALL network firewall policy enforcement order

When the network firewall policy enforcement order is AFTER_CLASSIC_FIREWALL, Cloud NGFW evaluates rules in global and regional network firewall policies after evaluating VPC firewall rules. This is the default evaluation order.

In a regular VPC network that uses the AFTER_CLASSIC_FIREWALL enforcement order, the complete firewall rule evaluation order is the following:

  1. Hierarchical firewall policies.

    Cloud NGFW evaluates hierarchical firewall policies in the following order:

    1. The hierarchical firewall policy associated with the organization that contains the target resource.
    2. Hierarchical firewall policies associated with folder ancestors, from the top-level folder down to the folder that contains the target resource's project.

    When evaluating rules in each hierarchical firewall policy, Cloud NGFW performs the following steps:

    1. Disregard all rules whose targets don't match the target resource.
    2. Disregard all rules that don't match the packet's direction.
    3. Evaluate the remaining rules from the highest to the lowest priority.

      Evaluation stops when either one of the following conditions is met:

      • A rule that applies to the target resource matches the traffic.
      • No rules that apply to the target resource match the traffic.

    In a hierarchical firewall policy, at most, one rule can match traffic. The firewall rule's action on match can be one of the following:

    • allow: the rule allows the traffic, and all rule evaluation stops.
    • deny: the rule denies the traffic, and all rule evaluation stops.
    • apply_security_profile_group: the rule forwards the traffic to a configured firewall endpoint, and all rule evaluation stops. The decision to allow or drop the packet depends on the configured security profile of the security profile group.
    • goto_next: the rule evaluation continues to one of the following:
      • A hierarchical firewall policy associated with a folder ancestor closer to the target resource, if it exists.
      • The next step in the evaluation order, if all hierarchical firewall policies have been evaluated.

    If no rule in a hierarchical firewall policy matches the traffic, Cloud NGFW uses an implied goto_next action. This action continues the evaluation to one of the following:

    • A hierarchical firewall policy associated with a folder ancestor closer to the target resource, if it exists.
    • The next step in the evaluation order, if all hierarchical firewall policies have been evaluated.

  2. Regional system firewall policies.

    When evaluating regional system firewall policy rules, Cloud NGFW performs the following steps:

    1. Disregard all rules whose targets don't match the target resource.
    2. Disregard all rules that don't match the packet's direction.
    3. Evaluate the remaining rules from the highest to the lowest priority.

      Evaluation stops when either one of the following conditions is met:

      • A rule that applies to the target resource matches the traffic.
      • No rules that apply to the target resource match the traffic.

    In a regional system firewall policy, at most, one rule can match traffic. The firewall rule's action on match can be one of the following:

    • allow: the rule allows the traffic, and all rule evaluation stops.
    • deny: the rule denies the traffic, and all rule evaluation stops.
    • goto_next: the rule evaluation continues to
      • A regional system firewall policy with the next highest association priority, if it exists.
      • The next step in the evaluation order, if all regional system firewall policies have been evaluated.

    If no rule in a regional system firewall policy matches the traffic, Cloud NGFW uses an implied goto_next action. This action continues the evaluation to one of the following:

    • A regional system firewall policy with the next highest association priority, if it exists.
    • The next step in the evaluation order, if all regional system firewall policies have been evaluated.

  3. VPC firewall rules.

    When evaluating VPC firewall rules, Cloud NGFW performs the following steps:

    1. Disregard all rules whose targets don't match the target resource.
    2. Disregard all rules that don't match the packet's direction.
    3. Evaluate the remaining rules from the highest to the lowest priority.

      Evaluation stops when either one of the following conditions is met:

      • A rule that applies to the target resource matches the traffic.
      • No rules that apply to the target resource match the traffic.

    When one or two VPC firewall rules match traffic, the firewall rule's action on match can be one of the following:

    • allow: the rule allows the traffic, and all rule evaluation stops.
    • deny: the rule denies the traffic, and all rule evaluation stops.

    If two rules match, they must have the same priority but different actions. In this case, Cloud NGFW enforces the deny VPC firewall rule, and ignores the allow VPC firewall rule.

    If no VPC firewall rules match the traffic, Cloud NGFW uses an implied goto_next action to continue to the next step in the evaluation order.

  4. Global network firewall policy.