GCP SDN connector using service account

FortiOS automatically updates dynamic addresses for GCP using a GCP SDN connector, including mapping attributes from GCP instances to dynamic address groups in FortiOS.

This topic describes one of multiple configuration methods available with this SDN connector type. See the More Links section on the right sidebar for other methods.

To configure a GCP connector using the GUI:

1. In FortiOS, go to Security Fabric > External Connectors.
2. Click Create New, and select Google Cloud Platform (GCP).

   Note you can create only one SDN Connector per connector type. For example, you can create one entry for GCP.

3. Configure the connector as follows:
   1. Projects: Select Simple.
   2. Name: Enter the name of the GCP project. The VMs whose IP addresses you want to populate should be running within this project.
   3. Service account email: Enter the email address associated with the service account that calls APIs to the GCP project specified.
   4. Private key: Enter the private key statement as shown in the text box. For details, see Creating a GCP service account.
   5. Click OK.

   

   Once the connector is successfully configured, a green indicator appears at the bottom right corner. If the indicator is red, the connector is not working. See Troubleshooting GCP SDN Connector.

4. Create a dynamic firewall address for the configured GCP SDN connector:
   1. Go to Policy & Objects > Addresses. Click Create New, then select Address.
   2. Configure the address:
      1. Name: Enter the desired name.
      2. Type: Select Dynamic.
      3. Fabric Connector Type: Select Google Cloud Platform (GCP).
      4. Filter: The SDN connector automatically populates and updates only instances that match this filtering condition. Currently GCP supports the following filters:
         • id=<instance id> : This matches an VM instance ID.
         • name=<instance name> : This matches a VM instance name.
         • zone=<gcp zones> : This matches a zone name.
         • network=<gcp network name> : This matches a network name.
         • subnet=<gcp subnet name> : This matches a subnet name.
         • tag=<gcp network tags> : This matches a network tag.
         • label.<gcp label key>=<gcp label value> : This matches a free form GCP label key and its value.

         In the example, the filter is set as 'network=default & zone=us-central-1f’. This configuration populates all IP addresses that belong to the default network in the zone us-central-1f.

         You can set filtering conditions using multiple entries with AND ("&") or OR ("|"). When both AND and OR are specified, AND is interpreted first, then OR.

         Note that wildcards (such as the asterisk) are not allowed in filter values.

      

      5. Click OK.

      The address has been created. Wait for a few minutes before the setting takes effect. You will know that the address is in effect when the exclamation mark disappears from the address entry. When you hover over the address, you can see the list of populated IP addresses.

      

      If the exclamation mark does not disappear, check the address settings.