Skip to main content

GCP Cloud Armor - Architecture flow of Cloud Amor with Load Balancer





Google Cloud Armor and Google Load Balancer work together to shield your website from digital villains. We will see how they are connected and how traffic flows using an architecture diagram



Explanation:

  1. Client sends request: The user (client) initiates a request to your website or application.
  2. Request reaches internet: The request travels through the internet and reaches your network.
  3. Router directs traffic: Your router routes the request towards GCP Network.
  4. Load Balancer distributes traffic: The GCP Load Balancer receives the request and distributes it evenly among your backend servers.
  5. Cloud Armor inspects traffic: Before reaching the backend servers, the request passes through Cloud Armor.
  6. Cloud Armor filters and protects: Cloud Armor analyzes the request using your configured security policies. It filters malicious traffic, mitigates DDoS attacks, and blocks web application vulnerabilities.
  7. Clean request to backend servers: If the request passes Cloud Armor's scrutiny, it gets forwarded to the appropriate backend server for processing.
  8. Response to client: The backend server processes the request and sends the response back to the client through the same path.

Key points:

  • Cloud Armor sits between the Load Balancer and backend servers, acting as a security shield.
  • It doesn't modify the Load Balancer's functionality of distributing traffic among servers.
  • It adds an extra layer of security by filtering and protecting incoming traffic.

Benefits of this integration:

  • Enhanced security: Protects your applications from a wide range of threats.
  • Improved uptime: Mitigates DDoS attacks and ensures your applications remain accessible.
  • Reduced complexity: Easy to configure and manage security policies within GCP.
  • Scalability: Cloud Armor automatically scales to handle increased traffic volumes.



Labels:

Comments

Post a Comment

Popular posts from this blog

Ansible script to stop iptables

 Ansible script to stop iptables and disable during boot Step 1. [root@cluster playbooks]# pwd /root/playbooks [root@cluster playbooks]# cat hosts [webservers] 169.254.41.221 169.254.41.222 Step2. [root@cluster playbooks]# cat iptables.yml --- - name: stop ipatbles and disable   hosts: webservers   tasks:   - name: stop iptables     service: name=iptables state=stopped   - name: disbale on iptable on boot     service: name=iptables enabled=no Step3: [root@cluster playbooks]# ansible-playbook iptables.yml PLAY [stop ipatbles and disable] *********************************************** TASK [setup] ******************************************************************* ok: [169.254.41.222] ok: [169.254.41.221] ok: [localhost] TASK [stop iptables] *********************************************************** changed: [localhost] ok: [169.254.41.221] ok: [169.254.41.222] TASK [disbale on iptable on boot] ********************************************** ok: [169.254.41.222] changed: [localhost
Post a Comment
Read more

Get information about remote hosts using Ansible

Get information about remote hosts using Ansible setup command Below command gives all the information of client hosts which includes memory, server architecture, IP adresses etc. [root@ansible mywork]# ansible all -i hosts -m setup If you need just memory information of remote node then for the above command need to add filter as shown below [root@ansible mywork]# ansible all -i hosts -m setup -a "filter=ansible_*_mb" node01 | SUCCESS => {     "ansible_facts": {         "ansible_memfree_mb": 873,         "ansible_memory_mb": {             "nocache": {                 "free": 919,                 "used": 77             },             "real": {                 "free": 873,                 "total": 996,                 "used": 123             },             "swap": {                 "cached": 0,                 "free": 15
Post a Comment
Read more

connect: Network is unreachable

connect: Network is unreachable If you are getting below error, then probably you have not added gateway address or you have incorrect gateway in config file. [root@cluster ~]# ping google.com connect: Network is unreachable Before: [root@cluster ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth3 DEVICE=eth3 TYPE=Ethernet ONBOOT=yes NM_CONTROLLED=yes BOOTPROTO=static IPADDR=192.168.174.130 NETMASK=255.255.255.0 After: [root@cluster ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth3 DEVICE=eth3 TYPE=Ethernet ONBOOT=yes NM_CONTROLLED=yes BOOTPROTO=static IPADDR=192.168.174.130 NETMASK=255.255.255.0 GATEWAY=192.168.174.2 [root@cluster ~]# ifdown eth3 [root@cluster ~]# ifup eth3 Determining if ip address 192.168.174.130 is already in use for device eth3... [root@cluster ~]# ping google.com PING google.com (216.58.218.174) 56(84) bytes of data. 64 bytes from dfw06s46-in-f14.1e100.net (216.58.218.174): icmp_seq=1 ttl=128 time=261 ms 6
Post a Comment
Read more