Multiple GCP projects in a single SDN connector

An option is added to specify multiple projects under a single GCP SDN connector. Previously, only one project was allowed per SDN connector, which limits the total projects to the number of SDN connectors (256). This enhancement also allows dynamic firewall address filters to filter on a project. FortiOS 6.4.7 and later versions support this feature.

In this example, a GCP SDN connector (gcp_conn) is configured with two projects. The first project, dev-project-001-166400, is configured using the simple format. The second project, dev-project-002, is configured using the advanced format.

To configure a GCP connector with multiple projects in the GUI:

1. Go to Security Fabric > External Connectors and click Create New.
2. Select Google Cloud Platform (GCP) and enter a name for the connector.
3. Configure the first project:
   1. For Projects, select Simple.
   2. Enter the project name, service account email, and private key.

      

4. Configure the second project:
   1. For Projects, select Advanced (the projects are now displayed in a table) and click Create New.

      

      The Add GCP Project pane opens.

   2. Enter a name.
   3. Optionally, click the + to enter zones. If no zones are selected, the SDN connector will include all zones. The us-central1-a zone is used in this example.

      

   4. Click OK.
5. Click OK to save the SDN connector.
6. Create a dynamic firewall address for the first project:
   1. Go to Policy & Objects > Addresses and click Create New > Address.
   2. Enter the following:

      Name	project1_addresses
      Type	Dynamic
      Sub Type	Fabric Connector Address
      SDN Connector	gcp_conn
      Filter	Add a filter for the project, Project=dev-project-001-166400. In this example, there are several instances for the first project, so add a filter for the ID, Id=6266132824476267466. Change the logic operator to and.

      

   3. Click OK.
7. Create a dynamic firewall address for the second project:
   1. Click Create New > Address.
   2. Enter the following:

      Name	project2_addresses
      Type	Dynamic
      Sub Type	Fabric Connector Address
      SDN Connector	gcp_conn
      Filter	Add a filter for the project, Project=dev-project-002.

   3. Click OK.

      The addresses have been created. Wait for a few minutes before the settings take effect.

8. Verify that the address resolve to the correct addresses. Hover over the address in the table to view the list of populated IP addresses.

To configure a GCP connector with multiple projects in the CLI:

1. Configure the SDN connector:

   config system sdn-connector
       edit "gcp_conn"
           set status enable
           set type gcp
           config gcp-project-list
               edit "dev-project-001-166400"
               next
               edit "dev-project-002"
                   set gcp-zone-list "us-central1-a"
               next
           end
           set service-account "xxxxxxxxxxxx-compute@developer.gserviceaccount.com"
           set private-key **********
           set update-interval 30
       next
   end

2. Create a dynamic firewall address for project one:

   config firewall address
       edit "project1_addresses"
           set type dynamic
           set sdn "gcp_conn"
           set filter "Project=dev-project-001-166400 & Id=6266132824476267466"
       next
   end

   The dynamic firewall address IP is resolved by the SDN connector:

   config firewall address
       edit "project1_addresses"
           show
               config firewall address
                   edit "project1_addresses"
                       set uuid 38efbd88-fb08-51eb-8e6d-9b78a2a9bf49
                       set type dynamic
                       set sdn "gcp_conn"
                       set filter "Project=dev-project-001-166400 & Id=6266132824476267466"
                       config list
                           edit "172.16.16.3"
                           next
                           edit "172.16.24.3"
                           next
                           edit "172.16.8.4"
                           next
                       end
                   next
               end
       next
   end

3. Create a dynamic firewall address for project two:

   config firewall address
       edit "project2_addresses"
           set type dynamic
           set sdn "gcp_conn"
           set filter "Project=dev-project-002"
           set sdn-addr-type all   
       next
   end

   The dynamic firewall address IP is resolved by the SDN connector:

   config firewall address
       edit "project2_addresses"
           show
               config firewall address
                   edit "project2_addresses"
                       set uuid 5ca9b2ba-fb08-51eb-57c0-12701b3d33c1
                       set type dynamic
                       set sdn "gcp_conn"
                       set filter "Project=dev-project-002"
                       set sdn-addr-type all
                       config list
                           edit "10.128.0.2"
                           next
                           edit "34.66.35.241"
                           next
                       end
                   next
               end
       next
   end