Migrate VPC Firewall Policies to Cloud NGFW: Free Written Course

Moving firewall rules is only part of a migration. You also need to understand which policy is enforced, how workloads are identified, and how to verify that traffic behaves as intended. Google’s Migrate your VPC Firewall Policies to Cloud NGFW explores those decisions through two detailed written tutorials.

Both complete walkthroughs are freely readable through the direct links below. They cover migration without network tags and migration involving network tags. This is an intermediate lab-based learning sequence rather than a video course. Reading the teaching material requires no payment or sign-in; executing the hosted exercises and earning recognition are separate.

Course at a glance

What you’ll learn

• Identify the VPC firewall rules and network configuration used in a migration scenario.
• Follow the conversion of existing rules into a global network firewall policy.
• Understand how associating a policy with a VPC network affects enforcement.
• Explore the mapping of network tags and service accounts to IAM-governed Tags.
• Follow evaluation-order changes, logging, and connectivity checks before the old rules are removed.

Skills you’ll gain

• Firewall policy migration
• Cloud NGFW
• VPC security
• IAM-governed Tags
• Rule evaluation
• Migration validation

Follow the complete free reading route

Open each official walkthrough directly to read the teaching material before deciding whether to use the separate hosted practice environment.

1. Cloud NGFW: Migrate VPC Firewall Rules – No Network Tags — Follow assessment, migration, policy association, logging, testing, and removal of the previous rules.
2. Cloud NGFW: Migrate VPC Firewall Rules that use Network Tags — Extend the workflow with tag mapping, VM bindings, and verification of the new policy.

Two migration scenarios that build on each other

The first tutorial establishes the core sequence without network tags. It starts by assessing the environment, then follows the creation and migration of firewall rules into a global policy. Policy association and evaluation order become part of the exercise before logging and testing are used to examine the result.

The second tutorial introduces the additional work required when rules use network tags. It covers saving the existing details, creating secure Tags, mapping tags and service accounts, and binding Tags to virtual machines. That extra preparation helps explain why a tagged migration needs more than copying the same allow and deny settings.

Understand the checks, not just the commands

A useful way to study these walkthroughs is to draw a small before-and-after inventory. Record the original rule, the new policy rule, the network association, and the workload identity. Then note which test would show that the intended connection is allowed or denied. This gives each migration step a clear purpose.

Logging and evaluation order deserve particular attention. A policy can contain the expected rules while the surrounding configuration still determines which rule applies. The tutorials place verification within the workflow; use that structure to understand why the result must be checked before the older rules are deleted.

The commands are written for the provider’s prepared lab scenarios. Study them as training material, not as a ready-made change plan for a production network. If you later choose to execute the exercises, use an authorized disposable lab environment and review its access requirements first.

Who should take this course?

This intermediate material is most useful for learners who already understand how to create a network and apply firewall rules. The first walkthrough explicitly assumes that foundation. If VPCs, firewall targets, and basic connectivity testing are unfamiliar, start with networking foundations in the course library before returning to the migration sequence.

The free reading route includes both complete published tutorials. It does not supply cloud infrastructure, paid credits, or a guaranteed free badge. Hosted practice can require credits, a subscription, or an eligible allowance, while formal recognition depends on the provider’s completion requirements.

Enroll Now

Frequently asked questions