This document lists the quotas and system limits that apply to Cloud Next Generation Firewall.
- Quotas have default values, but you can typically request adjustments.
- System limits are fixed values that can't be changed.
Google Cloud uses quotas to help ensure fairness and reduce spikes in resource use and availability. A quota restricts how much of a Google Cloud resource your Google Cloud project can use. Quotas apply to a range of resource types, including hardware, software, and network components. For example, quotas can restrict the number of API calls to a service, the number of load balancers used concurrently by your project, or the number of projects that you can create. Quotas protect the community of Google Cloud users by preventing the overloading of services. Quotas also help you to manage your own Google Cloud resources.
The Cloud Quotas system does the following:
- Monitors your consumption of Google Cloud products and services
- Restricts your consumption of those resources
- Provides a way to request changes to the quota value and automate quota adjustments
In most cases, when you attempt to consume more of a resource than its quota allows, the system blocks access to the resource, and the task that you're trying to perform fails.
Quotas generally apply at the Google Cloud project level. Your use of a resource in one project doesn't affect your available quota in another project. Within a Google Cloud project, quotas are shared across all applications and IP addresses.
For more information, see the Cloud Quotas overview.
There are also system limits on Cloud NGFW resources. System limits can't be changed.
Quotas
This section lists the quotas that apply to Cloud Next Generation Firewall.
To monitor per-project quotas that use Cloud Monitoring, set up monitoring
for the metric serviceruntime.googleapis.com/quota/allocation/usage on the
Consumer Quota resource type. Set additional label filters (service,
quota_metric) to get to the quota type. For information about monitoring quota
metrics, see Chart and monitor quota metrics.
Each quota has a limit and a usage value.
Unless noted otherwise, to change a quota, see Request a quota adjustment.
Per project
The following table highlights Cloud NGFW quotas that are per project:
| Quota | Description |
|---|---|
| Virtual Private Cloud (VPC) firewall rules | The number of VPC firewall rules that you can create in a project, regardless of the VPC network to which each firewall rule applies. |
| Global network firewall policies | The number of Global network firewall policies in a project, regardless of how many VPC networks are associated with each policy. |
| Regional network firewall policies | The number of Regional network firewall policies in each region of a project, regardless of how many VPC networks are associated with each policy. |
| Global address groups per project | The number of global, project-scoped address groups that you can define in a project. |
| Regional address groups per project per region | The number of regional, project-scoped address groups that you can define in each region of a project. |
Per organization
The following table highlights Cloud NGFW quotas that are per organization. To change an organization-level quota, file a Support case.
| Quota | Description |
|---|---|
| Unassociated Hierarchical firewall policies in an organization | The number of Hierarchical firewall policies in an organization that are not associated with any folder or organization resource. There is no limit on the number of Hierarchical firewall policies in an organization that are associated with a resource. |
| Global address groups per organization | The number of global, organization-scoped address groups that you can define in an organization. |
| Regional address groups per organization per region | The number of regional, organization-scoped address groups that you can define in each region in an organization. |
Per network
The following quotas apply to VPC networks:
| Quota | Description |
|---|---|
| Regional network firewall policy associations per region per VPC network | The maximum number of regional network firewall policies that you can associate with a region of a VPC network. |
| Firewall rule attributes per region per VPC network | The maximum number of rule attributes from rules of all associated regional network firewall policies in a VPC network's region. For details about computation of rule attributes, see Computation of rule attribute count. |
| Firewall rule FQDNs per region per VPC network | The maximum number of FQDNs from rules in all associated regional network firewall policies in a VPC network's region. |
Per firewall policy
The following table highlights Cloud NGFW quotas that are per firewall policy resource:
| Quota | Description |
|---|---|
| Hierarchical firewall policies | |
| Rule attributes per hierarchical firewall policy | This quota is the sum of rule attributes from all rules in a hierarchical
firewall policy. For more information, see Rule attribute count for a firewall policy and Computation of rule attribute count. |
| Domain names (FQDNs) per hierarchical firewall policy | The number of domain names that you can include in all rules of a hierarchical firewall policy. This quota is the sum of all source domain names from all ingress rules in the policy plus the sum of all destination domain names from all egress rules in the policy. |
| Global network firewall policies | |
| Rule attributes per global network firewall policy | The sum of rule attributes from all rules in a global network firewall
policy. For more information, see Rule attribute count for a firewall policy and Computation of rule attribute count. |
| Domain names (FQDNs) per global network firewall policy | The number of domain names that you can include in all rules of a global network firewall policy. This quota is the sum of all source domain names from all ingress rules in the policy plus the sum of all destination domain names from all egress rules in the policy. |
| Regional network firewall policies | |
| Rule attributes per regional network firewall policy | The sum of rule attributes from all rules in a regional network firewall
policy. For more information, see Rule attribute count for a firewall policy and Computation of rule attribute count. |
| Domain names (FQDNs) per regional network firewall policy | The number of domain names (FQDNs) that you can include in all rules of a regional network firewall policy: This quota is the sum of all source domain names from all ingress rules in the policy plus the sum of all destination domain names from all egress rules in the policy. |
Rule attribute count for a firewall policy
Each firewall policy supports a maximum total number of attributes from all rules in the policy. To determine the rule attribute count for a given firewall policy, describe the policy. For directions, see the following:
- Describe a hierarchical firewall policy
- Describe a global network firewall policy
- Describe a regional network firewall policy
For details about computation of rule attributes, see Computation of rule attribute count.
Limits
Limits cannot be increased unless specifically noted.
Per organization
The following limits apply to organizations:
| Item | limit | Notes |
|---|---|---|
| Maximum secure tag keys per organization | 1,000 | The maximum number of secure tag keys that have a parent organization. For more information, see Tag limits. |
Maximum secure tag values used by all tag keys whose purpose
is GCE_FIREWALL and purpose-data is an organization
|
16384 | This limit is enforced against all tag values used by tag keys created in the organization matching the purpose data, including tag keys whose parent is either the organization or a project therein. |
| URL filtering security profiles per organization | 40 | The maximum number of URL filtering security profiles that you can create per organization. |
| Threat prevention security profiles per organization | 40 | The maximum number of security profiles of type threat prevention that you can create per organization. |
| Security profile groups with threat prevention per organization | 40 | The maximum number of security profile groups that use a threat prevention security profile that you can create per organization. |
| Security profile groups with URL filtering per organization | 40 | The maximum number of security profile groups that use a URL filtering security profile that you can create per organization. |
| Advanced malware sandbox security profiles per organization | 40 | The maximum number of WILDFIRE_ANALYSIS security profiles
that you can create per organization. |
| Firewall endpoints per zone per organization | 50 | The maximum number of firewall endpoints that you can create per zone per organization. |
Per project
The following limits apply to project:
| Item | limit | Notes |
|---|---|---|
| Maximum secure tag keys per project | 1,000 | The maximum number of secure tag keys that have a parent project. For more information, see Tag limits. |
| URL filtering security profiles per project | 40 | The maximum number of URL filtering security profiles that you can create per project. |
| Threat prevention security profiles per project | 40 | The maximum number of security profiles of type threat prevention that you can create per project. |
| Security profile groups with threat prevention per project | 35 | The maximum number of security profile groups that use a threat prevention security profile that you can create per project. |
| Security profile groups with URL filtering per project | 35 | The maximum number of security profile groups that use a URL filtering security profile that you can create per project. |
| Firewall endpoints per zone per project | 50 | The maximum number of firewall endpoints that you can create per zone per project. |
Per network
The following limits apply to VPC networks:
| Item | Limit | Notes |
|---|---|---|
| Maximum global network firewall policies per network | 1 | The maximum number of global network firewall policies that you can associate with a VPC network. |
| Maximum number of domain names (FQDNs) per network | 1,000 | The maximum total number of domain names that can be used in firewall rules that come from hierarchical firewall policies, global network firewall policies, and regional network firewall policies associated with a VPC network. |
Maximum secure tag values used by all tag keys whose purpose
is GCE_FIREWALL and purpose-data is a
VPC network
|
16383 | This limit is enforced against all tag values used by tag keys whose
purpose-data matches the specified VPC network,
including tag keys whose parent is either the organization or a project.
|
| Firewall endpoints per zone per network | 1 | The maximum number of firewall endpoints that you can assign per zone per network. |
Per firewall rule
The following limits apply to firewall rules:
| Item | Limit | Notes |
|---|---|---|
| Maximum number of source secure tags per ingress firewall policy rule | 256 | Applicable only to ingress firewall policy rule—the maximum number of secure tags that you can use as source tags in the firewall rule. This limit cannot be increased. |
| Maximum number of target secure tags per firewall policy rule | 256 | Applicable only to firewall policy rule—the maximum number of secure tags that you can use as target tags in the firewall rule. This limit cannot be increased. |
| Maximum number of source network tags per ingress VPC firewall rule | 30 | Applicable only to ingress VPC firewall rules—the maximum number of network tags that you can use as source tags in the firewall rule. This limit cannot be increased. |
| Maximum number of target network tags per VPC firewall rule | 70 |