Create and manage mirroring endpoint group associations

Create a mirroring endpoint group association to attach a mirroring endpoint group to a Virtual Private Cloud (VPC) network. You can create a mirroring endpoint group globally and associate it with one or more VPC networks to monitor workloads.

This page explains how to create and manage mirroring endpoint group associations.

Before you begin

Roles

To get the permissions that you need to create, view, or delete mirroring endpoint group associations, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

To check the progress of the operations listed on this page, make sure that your user role has the following Mirroring Endpoint Admin role (roles/networksecurity.mirroringEndpointAdmin) and Mirroring Endpoint User (roles/networksecurity.mirroringEndpointUser) role permissions:

  • networksecurity.mirroringEndpointGroupAssociations.create
  • networksecurity.mirroringEndpointGroupAssociations.delete
  • networksecurity.mirroringEndpointGroupAssociations.update
  • networksecurity.mirroringEndpointGroupAssociations.get
  • networksecurity.mirroringEndpointGroupAssociations.list

Quotas

To view quotas associated with mirroring endpoint group associations, see Quotas and limits.

Create mirroring endpoint group associations

You can associate one or more VPC networks to a specific mirroring endpoint group in the same zone.

On the Create and manage mirroring endpoint groups page, you created a mirroring endpoint group where the network traffic inspection can happen for the mirrored traffic. However, you still need to specify which VPCs' traffic can be inspected. To do this, you create a project-level mirroring endpoint group association.

Console

  1. In the Google Cloud console, go to the Endpoint groups page.

    Go to Endpoint groups

  2. Click the name of the endpoint group.

  3. In the Associations section, click Create.

  4. In the Create associations pane, click Add endpoint group association.

  5. For Project and Network, select the project and the VPC network that hosts the mirroring endpoint group.

  6. Click Done.

  7. Click Create.

gcloud

To create a mirroring endpoint group association, use the gcloud network-security mirroring-endpoint-group-associations create command:

 gcloud network-security mirroring-endpoint-group-associations \ create ENDPOINT_GROUP_ASSOCIATION \ --location global \ --project PROJECT_NAME \ --network NETWORK \ --mirroring-endpoint-group ENDPOINT_GROUP \ --no-async

Replace the following:

  • ENDPOINT_GROUP_ASSOCIATION: the name of the mirroring endpoint group association

  • PROJECT_NAME: the Google Cloud project name of the network

  • NETWORK: the name of the network

  • ENDPOINT_GROUP: the name of the mirroring endpoint group

Terraform

To create a mirroring endpoint group association, you can use a google_network_security_mirroring_endpoint_group_association resource.

resource "google_network_security_mirroring_endpoint_group_association" "default" { mirroring_endpoint_group_association_id = "mirroring-endpoint-group-association" location = "global" network = google_compute_network.consumer_network.id mirroring_endpoint_group = google_network_security_mirroring_endpoint_group.default.id }

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

View mirroring endpoint associations

You can view the details of a specific mirroring endpoint group association in a zone.

Console

  1. In the Google Cloud console, go to the Endpoint groups page.

    Go to Endpoint groups

  2. Click the name of the mirroring endpoint group. The Associations section lists the details of the mirroring endpoint associations.

gcloud

To view a mirroring endpoint group association, use the gcloud network-security mirroring-endpoint-group-associations describe command:

 gcloud network-security mirroring-endpoint-group-associations \ describe ENDPOINT_GROUP_ASSOCIATION \ --location global \ --project PROJECT_NAME

Replace the following:

  • ENDPOINT_GROUP_ASSOCIATION: the name of the mirroring endpoint group association

  • PROJECT_NAME: the project name of the mirroring endpoint group association

List mirroring endpoint group associations

You can list the mirroring endpoint group associations for a network, a project, or a mirroring endpoint group.

Console

  1. In the Google Cloud console, go to the Endpoint groups page.

    Go to Endpoint groups

  2. Click the name of the mirroring endpoint group. The Associations section lists all mirroring endpoint associations of the mirroring endpoint group.

gcloud

To list a mirroring endpoint group association in a project, use the gcloud network-security mirroring-endpoint-group-associations list command:

 gcloud network-security mirroring-endpoint-group-associations list \ --project PROJECT_NAME \ --network NETWORK

Replace the following:

  • PROJECT_NAME: the project name of the mirroring endpoint group association

  • NETWORK: the name of the VPC network

Delete a mirroring endpoint group association

You can delete a mirroring endpoint group association for a specific VPC network.

Console

  1. In the Google Cloud console, go to the Endpoint groups page.

    Go to Endpoint groups

  2. Click the name of the mirroring endpoint group.

  3. In the Associations section, select the mirroring endpoint association to delete.

  4. Click Delete.

  5. Click Delete again to confirm.

gcloud

To delete a mirroring endpoint group association, use the gcloud network-security mirroring-endpoint-group-associations delete command:

 gcloud network-security mirroring-endpoint-group-associations \ delete ENDPOINT_GROUP_ASSOCIATION \ --location global \ --project PROJECT_NAME \ --no-async

Replace the following:

  • ENDPOINT_GROUP_ASSOCIATION: the name of the mirroring endpoint group association

  • PROJECT_NAME: the project name of the mirroring endpoint group association

What's next