Google Cloud VPC Packet Mirroring

Overview

Google Cloud's VPC Packet Mirroring provides continuous mirroring of virtual machine network traffic to a packet collector without using agents.

This guide describes a basic setup where your Flowmon Collector and monitored instances share the same VPC. For other deployment options, refer to the packet mirroring topology guide.

Prerequisites

Before your start enabling VPC Packet Mirroring in your infrastructure, ensure you:

• have considered budgetary implications of running packet mirroring,
• have a Flowmon Collector instance running with two or more network interfaces and an appropriate license (with at least one monitoring port),
• have instances you want to monitor in the same Virtual Private Cloud (VPC) as one of the monitoring interfaces of your Flowmon instance.

Deployment

Follow these steps to deploy:

1. Log in to the Google Cloud Console. In all of the following steps, always select the Region and/or Zone that hosts your instances.

2. Create an unmanaged instance group for your Flowmon instance (or instances). Select the Network that contains the primary interface of your instances.

3. Create a regional health check rule. You should select TCP as the Protocol and 22 as the Port.

4. Create an internal TCP network load balancer that is associated with your unmanaged instance group.

5. In the backend configuration, select the Network that contains the monitoring interface of your Flowmon instance. Select the Instance group and Health check created in previous steps.

6. In the frontend configuration, select the Subnetwork that contains the monitoring interface of your Flowmon instance. Enable the load balancer for Packet Mirroring.

7. Create a packet mirroring policy. Select the Network containing your Flowmon and mirrored instances, provide a tag marking the virtual machine instances you want to mirror. In the Collector destination drop-down list, select the load balancer (its frontend) that you created in a previous step.

For Google Cloud Console or API guides, please refer to the official VPC Packet Mirroring documentation.

Flowmon Configuration

To accept and correctly respond to TCP health-checks, you must enable and configure an IP address on Flowmon's monitoring port. This also includes adjustments in local routing for the monitoring port in question. Refer to the official documentation for further details.

No other configuration specific for VPC Packet Mirroring is necessary. Refer to the Flowmon User Guide for instructions on how to enable a monitoring port.