​
More Info:

Ensure Cloud Monitoring monitors dropped packets count for firewall.

​
Risk Level

Medium

​
Address

Security, Performance Efficiency, Reliability

​
Compliance Standards

CBP

​
Triage and Remediation

​
Remediation

Using Console

To remediate the misconfiguration of not monitoring dropped packets count for firewall in GCP using GCP console, please follow the below steps:
  1. Login to the GCP console.
  2. Select the project in which the firewall is configured.
  3. Navigate to the VPC Network page from the left-hand side menu.
  4. Click on the Firewall rules tab.
  5. Click on the Edit button (pencil icon) next to the firewall rule you want to modify.
  6. Scroll down to the Logs section and select the checkbox for “Log dropped packets.”
  7. Click on the Save button to save the changes.
By enabling logging for dropped packets, you can monitor and analyze the traffic that is being blocked by your firewall. This can help you identify potential security threats and take appropriate actions to mitigate them.

​

To remediate the misconfiguration of dropped packets count for firewall in GCP using GCP CLI, follow the below steps:
  1. Open the GCP Cloud Shell.
  2. Run the following command to list all the firewall rules in your project: 
    gcloud compute firewall-rules list
  3. Identify the firewall rule that needs to be modified.
  4. Run the following command to update the firewall rule and enable logging for dropped packets: 
    gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --enable-logging --log-config="metadata:include-all-scopes=true"
    Replace [FIREWALL_RULE_NAME] with the name of the firewall rule that needs to be modified.
  5. Verify that the logging is enabled for the firewall rule by running the following command: 
    gcloud compute firewall-rules describe [FIREWALL_RULE_NAME]
    Replace [FIREWALL_RULE_NAME] with the name of the firewall rule that was modified.
  6. Check the logs in the Logging section of the GCP Console to ensure that the dropped packets count is being monitored.
By following these steps, you can remediate the misconfiguration of dropped packets count for firewall in GCP using GCP CLI.
To remediate the misconfiguration of not monitoring the dropped packet count for Firewall in GCP using Python, follow the below steps:
  1. Install the required libraries: 
    pip install google-cloud-monitoring google-auth google-auth-oauthlib google-auth-httplib2
  2. Authenticate with GCP: 
    from google.oauth2 import service_account
credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_file>')
  3. Import the necessary libraries: 
    from google.cloud import monitoring_v3
from google.api_core.exceptions import AlreadyExists
  4. Set the project ID and the client: 
    project_id = '<your_project_id>'
client = monitoring_v3.MetricServiceClient(credentials=credentials)
  5. Define the metric descriptor: 
    descriptor = monitoring_v3.types.MetricDescriptor()
descriptor.type = 'custom.googleapis.com/firewall/dropped_packets'
descriptor.metric_kind = monitoring_v3.enums.MetricDescriptor.MetricKind.GAUGE
descriptor.value_type = monitoring_v3.enums.MetricDescriptor.ValueType.INT64
descriptor.description = 'Dropped Packets Count for Firewall'
descriptor.unit = '1'
  6. Create the metric descriptor: 
    try:
    client.create_metric_descriptor(project_id, descriptor)
except AlreadyExists:
    pass
  7. Define the time series data: 
    series = monitoring_v3.types.TimeSeries()
series.metric.type = 'custom.googleapis.com/firewall/dropped_packets'
series.resource.type = 'global'
series.resource.labels['project_id'] = project_id
series.points.add(value=10)
  8. Write the time series data: 
    client.create_time_series(project_id, [series])
With these steps, the misconfiguration of not monitoring the dropped packet count for Firewall in GCP can be remediated using Python.

​
Additional Reading: