Manage global network firewall policies

To control network traffic across your Google Cloud environment, manage global network firewall policies and their rules. This page describes how to list, describe, and update policies and their individual rules. You learn to clone rules between policies and manage policy associations with your Virtual Private Cloud (VPC) networks.

Before you read this page, ensure you are familiar with the concepts described in the Global network firewall policies overview.

Firewall policy tasks

This section describes how to manage global network firewall policies.

Describe a global network firewall policy

You can view details about a global network firewall policy, including the policy rules and the associated rule attributes. All these rule attributes are counted as part of the rule attribute quota. For more information, see "Rule attributes per global network firewall policy" in the Per firewall policy table.

gcloud compute network-firewall-policies describe POLICY_NAME \
    --global

Update a global network firewall policy description

The only policy field that can be updated is the Description field.

gcloud compute network-firewall-policies update POLICY_NAME \
    --description DESCRIPTION \
    --global

List global network firewall policies

You can view a list of the policies available in your project.

gcloud compute network-firewall-policies list --global

Remove the network association

If you need to change the global network firewall policy that's associated with a VPC network, we recommend that you first associate a new policy instead of deleting an existing associated policy. You can associate a new policy in one step, which helps to ensure that a global network firewall policy is always associated with the VPC network.

To delete an association between a global network firewall policy and a VPC network, follow the steps mentioned in this section. Rules in the global network firewall policy don't apply to new connections after its association is deleted.

gcloud compute network-firewall-policies associations delete \
    --firewall-policy FIREWALL_POLICY \
    --name ASSOCIATION_NAME \
    --firewall-policy-region FIREWALL_POLICY_REGION \
    --global-firewall-policy

Delete a global network firewall policy

Before you can delete a global network firewall policy, you must delete all of its associations.