---
id: "google-cloud-ngfw"
type: "component"
kind: "firewall"
provider: "gcp"
category: "security"
docs: "https://cloud.google.com/firewall/docs/about-firewalls"
url: "https://localhost:3000/catalogue/components/google-cloud-ngfw"
---

# Cloud NGFW

Distributed stateful firewall policies for VPC networks.

| | |
|---|---|
| Provider | [gcp](https://localhost:3000/catalogue?provider=gcp) |
| Kind | [Firewall](https://localhost:3000/catalogue/kinds/firewall) |
| Category | Security |
| Official docs | [https://cloud.google.com/firewall/docs/about-firewalls](https://cloud.google.com/firewall/docs/about-firewalls) |

## Properties

| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| `defaultAction` | enum | `allow`, `deny` | no | — | **"deny"** |
| `intrusionPrevention` | boolean | — | no | — | **false** |
| `logging` | boolean | — | no | — | **false** |
| `managed` | boolean | — | no | false | **true** |
| `newRulePriority` | integer | — | no | 1000 | inherited |
| `policyType` | enum | `hierarchical`, `global-network`, `regional-network` | no | — | inherited |
| `ruleCount` | integer | — | no | — | inherited |
| `stateful` | boolean | — | no | — | **true** |
| `tier` | enum | `essentials`, `standard`, `enterprise` | no | "essentials" | inherited |

Bold values are the ones this component pins.

## Rules that apply · 0

No rule selects this kind or its category.

## Other products of the same kind · 35

- [Cloud Firewall](https://localhost:3000/catalogue/components/alibaba-cloud-firewall.md) `alibaba-cloud-firewall` — alibabacloud
- [Network ACL](https://localhost:3000/catalogue/components/alibaba-network-acl.md) `alibaba-network-acl` — alibabacloud
- [ECS Security Group](https://localhost:3000/catalogue/components/alibaba-security-group.md) `alibaba-security-group` — alibabacloud
- [Network ACL](https://localhost:3000/catalogue/components/aws-network-acl.md) `aws-network-acl` — aws
- [AWS Network Firewall](https://localhost:3000/catalogue/components/aws-network-firewall.md) `aws-network-firewall` — aws
- [Amazon Route 53 Resolver DNS Firewall](https://localhost:3000/catalogue/components/aws-route53-dns-firewall.md) `aws-route53-dns-firewall` — aws
- [Security group](https://localhost:3000/catalogue/components/aws-security-group.md) `aws-security-group` — aws
- [Microsoft Entra Internet Access](https://localhost:3000/catalogue/components/azure-entra-internet-access.md) `azure-entra-internet-access` — azure
- [Azure Firewall](https://localhost:3000/catalogue/components/azure-firewall.md) `azure-firewall` — azure
- [Network Security Group](https://localhost:3000/catalogue/components/azure-network-security-group.md) `azure-network-security-group` — azure
- [Network security perimeter](https://localhost:3000/catalogue/components/azure-network-security-perimeter.md) `azure-network-security-perimeter` — azure
- [Cloudflare DNS Firewall](https://localhost:3000/catalogue/components/cloudflare-dns-firewall.md) `cloudflare-dns-firewall` — cloudflare
- [Cloudflare Gateway](https://localhost:3000/catalogue/components/cloudflare-gateway.md) `cloudflare-gateway` — cloudflare
- [Cloudflare Network Firewall](https://localhost:3000/catalogue/components/cloudflare-network-firewall.md) `cloudflare-network-firewall` — cloudflare
- [Generic firewall](https://localhost:3000/catalogue/components/firewall.md) `firewall` — default
- [Firewall appliance](https://localhost:3000/catalogue/components/firewall-appliance.md) `firewall-appliance` — default
- [Fortinet FortiGate](https://localhost:3000/catalogue/components/fortigate.md) `fortigate` — default
- [MikroTik RouterOS](https://localhost:3000/catalogue/components/mikrotik-routeros.md) `mikrotik-routeros` — default
- [nftables](https://localhost:3000/catalogue/components/nftables.md) `nftables` — default
- [OPNsense](https://localhost:3000/catalogue/components/opnsense.md) `opnsense` — default
- [Palo Alto Networks NGFW](https://localhost:3000/catalogue/components/palo-alto-ngfw.md) `palo-alto-ngfw` — default
- [pfSense](https://localhost:3000/catalogue/components/pfsense.md) `pfsense` — default
- [Snort](https://localhost:3000/catalogue/components/snort.md) `snort` — default
- [Suricata](https://localhost:3000/catalogue/components/suricata.md) `suricata` — default
- [VyOS](https://localhost:3000/catalogue/components/vyos.md) `vyos` — default
- [DigitalOcean Cloud Firewalls](https://localhost:3000/catalogue/components/digitalocean-cloud-firewall.md) `digitalocean-cloud-firewall` — digitalocean
- [Cloud IDS](https://localhost:3000/catalogue/components/google-cloud-ids.md) `google-cloud-ids` — gcp
- [Secure Web Proxy](https://localhost:3000/catalogue/components/google-secure-web-proxy.md) `google-secure-web-proxy` — gcp
- [IBM Cloud Hardware Firewall](https://localhost:3000/catalogue/components/ibm-firewall.md) `ibm-firewall` — ibm
- [VPC Security Group](https://localhost:3000/catalogue/components/ibm-security-group.md) `ibm-security-group` — ibm
- [NetworkPolicy](https://localhost:3000/catalogue/components/k8s-network-policy.md) `k8s-network-policy` — k8s
- [Network Firewall](https://localhost:3000/catalogue/components/oci-network-firewall.md) `oci-network-firewall` — oci
- [Network Security Group](https://localhost:3000/catalogue/components/oci-network-security-group.md) `oci-network-security-group` — oci
- [Security List](https://localhost:3000/catalogue/components/oci-security-list.md) `oci-security-list` — oci
- [Security Group](https://localhost:3000/catalogue/components/outscale-security-group.md) `outscale-security-group` — outscale

## Use it in a design

```yaml
nodes:
  - { id: "google-cloud-ngfw", component: "google-cloud-ngfw" }
```

## Source (`component` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../../schema/component.schema.json
# Cloud NGFW (Cloud Firewall): distributed stateful firewall policies attached to VPC networks.
# Defaults from "VPC firewall rules" (implied deny ingress and implied allow egress, stateful connection tracking, rule logging disabled, new rules at priority 1000) and "About Cloud NGFW" (Essentials tier at no cost, Enterprise adds layer-7 intrusion prevention).
schemaVersion: "1"
type: "component"
id: "google-cloud-ngfw"
kind: "firewall"
provider: "gcp"
docs: "https://cloud.google.com/firewall/docs/about-firewalls"
defaults:
  managed: true
  defaultAction: "deny"
  stateful: true
  logging: false
  intrusionPrevention: false
properties:
  tier:
    type: "enum"
    values: ["essentials", "standard", "enterprise"]
    default: "essentials"
  policyType:
    type: "enum"
    values: ["hierarchical", "global-network", "regional-network"]
  newRulePriority:
    type: "integer"
    default: 1000
```

Human page: https://localhost:3000/catalogue/components/google-cloud-ngfw