Getting Started with DNS Armor's Advanced Threat Detection

1. Introduction and Overview

DNS Armor, powered by Infoblox, is a fully-managed service that provides DNS-layer security for your Google Cloud workloads. Its advanced threat detector is designed to detect malicious activity at the earliest point in the attack chain—the DNS query—without adding operational complexity or performance overhead.

This codelab provides step-by-step instructions to configure and test the DNS Armor service. You will set up the necessary network infrastructure, create the threat detector, test the service by simulating DNS threats, and finally, analyze the threat logs using Logs Explorer.

What You'll build

In this codelab, you will provision the following resources:

  • Two VPC networks: network-a and network-b
  • network-a will include subnets and virtual machines in us-east4 and us-central1 regions.
  • network-b will include a subnet and virtual machine solely in us-east4.
  • A DNS Armor advanced threat detector configured to inspect DNS queries.

75d6eeb807735645.png

What you'll learn

  • How to provision the necessary networking resources, including VPCs and virtual machines.
  • How to deploy an advanced threat detector and exclude specific networks.
  • How to validate the threat detection configuration using a threat simulation script.
  • How to analyze threat logs in Logs Explorer.

What you'll need

  • A Google Cloud project.
  • Access to the gcloud command-line tool.

2. Prerequisites

In this section, you will perform the following tasks:

  • Verify that your Google Cloud project meets the necessary Organization Policy constraints.
  • Confirm that your user account has the required IAM roles and permissions.
  • Enable the Google Cloud APIs essential for this codelab.
  • Assign the roles/logging.viewer IAM role to the Compute Engine Service Account.

Organization Policy Constraints

To successfully complete this codelab, please verify the Organization Policy constraints applied to your project. Certain policies might hinder the provisioning of necessary resources. The following constraints, could impact the configuration of this codelab:

  • constraints/gcp.resourceLocations: Restricts the regions where you can create resources; the codelab requires us-east4 and us-central1.
  • constraints/compute.vmExternalIpAccess: Prevents the creation of virtual machines with public IP addresses, which could interfere with the setup if you don't follow the codelab's use of the --no-address flag .
  • constraints/compute.shieldedVm: Enforces the creation of Shielded VMs, which the codelab's VM creation commands do not specify, potentially causing an error.
  • constraints/gcp.restrictServiceUsage: Limits which Google Cloud APIs can be enabled, and could block the codelab if it doesn't allow compute.googleapis.com, networksecurity.googleapis.com, logging.googleapis.com, and monitoring.googleapis.com.

IAM Roles and Permissions

To successfully complete this codelab, please verify the IAM roles and permissions granted to your user. The following IAM roles and permissions are required to complete this Codelab.

  • Service Usage Admin (roles/serviceusage.serviceUsageAdmin): To enable the required Google Cloud APIs for the codelab.
  • Compute Network Admin (roles/compute.networkAdmin): To create and manage VPC networks, subnets, and Cloud NAT.
  • Compute Security Admin (roles/compute.securityAdmin): To configure the firewall rules for SSH access to the virtual machines.
  • Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1): To create and manage the virtual machines required for the lab.
  • IAP-secured Tunnel User (roles/iap.tunnelResourceAccessor): To connect to the virtual machines using SSH through Identity-Aware Proxy (IAP).
  • Network Security Admin (roles/networksecurity.admin): To create and manage the DNS Armor threat detector.
  • Logs Viewer (roles/logging.viewer): To view and analyze the threat logs in Logs Explorer.

Google Cloud APIs

Please make sure that the required Google Cloud APIs are enabled in your project.

1. Enable the necessary APIs, run the following gcloud commands within Cloud Shell.

gcloud services enable compute.googleapis.com \
networksecurity.googleapis.com \
logging.googleapis.com \
monitoring.googleapis.com

2. Verify the APIs are Enabled, run the following gcloud commands within Cloud Shell.

gcloud services list --enabled

Compute Engine Service Account

The test script requires permissions to read threat logs from Cloud Logging. Since the script will be executed from a VM utilizing the default Compute Engine Service Account, the roles/logging.viewer IAM role must be assigned to this service account.

1. Set the environment variables, run following commands within Cloud Shell.

export PROJECT_ID=$(gcloud config get-value project)

export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)')

2. Grant the logging viewer role to the Compute Engine SA. Run the following gcloud commands within Cloud Shell

gcloud projects add-iam-policy-binding $PROJECT_ID \
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
--role="roles/logging.viewer"

3. Basic Environment Setup

In this section, you will perform the following tasks:

  • Create VPC networks (network-a and network-b) with custom subnets.
  • Configure Cloud Routers and Cloud NAT for internet egress in both network-a and network-b.
  • Create firewall rules to allow SSH access to VMs from IAP's IP range for both network-a and network-b.
  • Provision Linux virtual machines in both network-a and network-b without public IP addresses.

Create VPCs and Subnets

1. Create network-a and its subnets in the us-east4 and us-central1 regions. Run the following gcloud commands within Cloud Shell.

gcloud compute networks create network-a --subnet-mode=custom

gcloud compute networks subnets create subnet-a-use4 \
--network=network-a \
--range=10.10.0.0/24 \
--region=us-east4

gcloud compute networks subnets create subnet-a-usc1 \
--network=network-a \
--range=10.10.1.0/24 \
--region=us-central1

2. Create network-b and its subnet in the us-east4 region. Run the following gcloud commands within Cloud Shell.

gcloud compute networks create network-b --subnet-mode=custom

gcloud compute networks subnets create subnet-b-use4 \
--network=network-b \
--range=10.20.0.0/24 \
--region=us-east4

Configure Internet Egress

1. Create Cloud Router and Cloud NAT for network-a to allow internet egress for VMs without public IPs.

gcloud compute routers create router-a-use4 \
--network=network-a \
--region=us-east4

gcloud compute routers nats create nat-a-use4 \
--router=router-a-use4 \
--auto-allocate-nat-external-ips \
--nat-all-subnet-ip-ranges \
--region=us-east4

gcloud compute routers create router-a-usc1 \
--network=network-a \
--region=us-central1

gcloud compute routers nats create nat-a-usc1 \
--router=router-a-usc1 \
--auto-allocate-nat-external-ips \
--nat-all-subnet-ip-ranges \
--region=us-central1

2. Create Cloud Router and Cloud NAT for network-b to allow internet egress for VMs without public IPs.

gcloud compute routers create router-b-use4 \
--network=network-b \
--region=us-east4

gcloud compute routers nats create nat-b-use4 \
--router=router-b-use4 \
--auto-allocate-nat-external-ips \
--nat-all-subnet-ip-ranges \
--region=us-east4

Configure Firewall Rules

1. Create firewall rules for network-a to allow SSH access from IAP's IP range. Run the following gcloud commands within Cloud Shell.

gcloud compute firewall-rules create allow-ssh-iap-a \
--network=network-a \
--allow=tcp:22 \
--source-ranges=35.235.240.0/20

2. Create firewall rules for network-b to allow SSH access from IAP's IP range. Run the following gcloud commands within Cloud Shell.

gcloud compute firewall-rules create allow-ssh-iap-b \
--network=network-b \
--allow=tcp:22 \
--source-ranges=35.235.240.0/20

Create Virtual Machines

1. Create Linux VMs in network-a

gcloud compute instances create vm-a-use4 \
--zone=us-east4-c \
--network=network-a \
--subnet=subnet-a-use4 \
--no-address \
--scopes=cloud-platform

gcloud compute instances create vm-a-usc1 \
--zone=us-central1-a \
--network=network-a \
--subnet=subnet-a-usc1 \
--no-address \
--scopes=cloud-platform

2. Create Linux VM in network-b

gcloud compute instances create vm-b-use4 \
--zone=us-