Deploy Secure Web Proxy as next hop

This page provides an overview of how to create a Secure Web Proxy policy and then explains how to configure next hop routing for your Secure Web Proxy instance. In addition, this page describes how to configure either static routing or policy-based routing for your next hop.

By default, SecureWebProxy instances have a RoutingMode value of EXPLICIT_ROUTING_MODE, which means that you must configure your workloads to explicitly send HTTP(S) traffic to Secure Web Proxy. Instead of configuring individual clients to point to your Secure Web Proxy instance, you can set your Secure Web Proxy instance's RoutingMode as NEXT_HOP_ROUTING_MODE, which lets you define routes that direct traffic to your Secure Web Proxy instance.

When deploying your Secure Web Proxy instance as next hop, you can enable the gateway to listen on all ports (from 1 to 65535), simplifying the configuration for dynamic environments or services that use multiple ports.

Configure next hop routing for Secure Web Proxy

This section describes the steps to create a Secure Web Proxy policy and the procedure to deploy your Secure Web Proxy instance as next hop.

Create a Secure Web Proxy policy

  1. Complete all the required prerequisite steps.
  2. Create a Secure Web Proxy policy.
  3. Create Secure Web Proxy rules.

Deploy your Secure Web Proxy instance as next hop

Console

  1. In the Google Cloud console, go to the Web Proxies page.

    Go to Web Proxies

  2. Click Create a secure web proxy.

  3. Enter a name for the web proxy that you want to create, such as myswp.

  4. Enter a description of the web proxy, such as My new swp.

  5. For Routing mode, select the Next hop option.

  6. In the Regions list, select the region where you want to create the web proxy.

  7. In the Network list, select the network where you want to create the web proxy.

  8. In the Subnetwork list, select the subnetwork where you want to create the web proxy.

  9. Optional: Enter the Secure Web Proxy IP address. You can enter an IP address from the range of Secure Web Proxy IP addresses that reside in the subnetwork you created in the previous step. If you don't enter the IP address, then your Secure Web Proxy instance automatically chooses an IP address from the selected subnetwork.

  10. In the Certificate list, select the certificate that you want to use to create the web proxy.

  11. In the Policy list, select the policy that you created to associate the web proxy with.

  12. Click Create.

Cloud Shell

  1. Use a text editor to create a gateway.yaml file.

  2. Add the following code to the gateway.yaml file:

    name: projects/PROJECT_ID/locations/REGION/gateways/swp1
type: SECURE_WEB_GATEWAY
addresses: ["IP_ADDRESS"]
ports: [443, 80]
gatewaySecurityPolicy: projects/PROJECT_ID/locations/REGION/gatewaySecurityPolicies/policy1
network: projects/PROJECT_ID/global/networks/NETWORK
subnetwork: projects/PROJECT_ID/regions/REGION/subnetworks/SUBNETWORK
routingMode: NEXT_HOP_ROUTING_MODE

    Optional: To configure the gateway to listen on all ports (from 1 to 65535), add the all_ports field in the gateway.yaml file and set it to true. This feature is supported in Preview.

    For information about the limitations related to using the all_ports feature, see Limitations.

    name: projects/PROJECT_ID/locations/REGION/gateways/swp1
type: