Creating an unmanaged instance group and load balancer

To create an unmanaged instance group:

1. Go to Compute Engine > Instance groups > New unmanaged instance group.
2. From the Region and Zone dropdown lists, select the same region and zone that the mirrored recipient, in this case the FortiGate-VM, is in.
3. From the Network dropdown list, select the FortiGate-VM external VPC network.
4. From the Subnetwork dropdown list, select the subnet in the external VPC where the FortiGate-VM interface is.
5. From the VM instances dropdown list, select the FortiGate-VM.
6. Click Create.

To create a health check:

1. Go to Compute Engine > Instance groups > Health checks.
2. From the Protocol dropdown list, select TCP.
3. In the Port field, enter 22.
4. In the Check interval and Timeout fields, enter 5.

The health check fails unless you add a firewall rule to allow the following IP address ranges: 130.211.0.0/22 and 35.191.0.0/16.

To create an internal load balancer for the packet mirroring policy:

1. Go to NETWORKING > Network services > Load balancing > Create load balancer.
2. Under TCP Load Balancing, click Start configuration.
3. Under Internet facing or internal only, select Only between my VMs.
4. Under Multiple regions or single region, select Single region only.
5. Click Continue.
6. Complete backend configuration:
   1. From the Region dropdown list, select the same region as the FortiGate-VM and instance group.
   2. From the Network dropdown list, select the mirror VPC.
   3. From the Health check dropdown list, select the health check that you created.
7. Complete frontend configuration:
   1. From the Subnetwork dropdown list, select the mirror subnet.
   2. Under Advanced options, select Enable this load balancer for packet mirroring.
   3. Click Done.
8. Click Create.