Create and manage mirroring endpoints

A mirroring endpoint acts as a Google-managed intermediary or a broker for mirrored network traffic. After receiving the mirrored traffic, the mirroring endpoint enhances the network packets with additional GENEVE metadata, and mirrors the traffic to multiple producer mirroring deployment groups.

You need a mirroring endpoint only for the broker mode of mirroring, not for the direct mode of mirroring.

Before you begin

Roles

To get the permissions that you need to create, view, or delete mirroring endpoints, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your Google Cloud project. For more information about granting roles, see Manage access to projects, folders, and organizations.

To check the progress of the operations listed on this page, make sure that your user role has the Mirroring Endpoint Admin (roles/networksecurity.mirroringEndpointAdmin) permission.

Quotas

To view quotas associated with mirroring endpoints, see Quotas and limits.

Create a mirroring endpoint

Create a mirroring endpoint in a specific zone.

gcloud

To create a mirroring endpoint, use the gcloud network-security mirroring-endpoint create command:

gcloud beta network-security mirroring-endpoint create ENDPOINT \
    --location ZONE \
    --project PROJECT_NAME \
    --mirroring-endpoint-group ENDPOINT_GROUP \
    --no-async

Replace the following:

  • ENDPOINT: the name of the mirroring endpoint.

  • ZONE: the zone of the mirroring endpoint. You can create only one mirroring endpoint in a zone.

  • PROJECT_NAME: the project name where you want to create the mirroring endpoint.

  • ENDPOINT_GROUP: the name of the mirroring endpoint group.

View the details of a mirroring endpoint

View the details of a specific mirroring endpoint.

gcloud

To view details of a mirroring endpoint, use the gcloud network-security mirroring-endpoint describe command:

gcloud beta network-security mirroring-endpoint describe ENDPOINT \
    --location ZONE \
    --project PROJECT_NAME

Replace the following:

  • ENDPOINT: the name of the mirroring endpoint.

  • ZONE: the zone where the mirroring endpoint is located.

  • PROJECT_NAME: the name of the project where the mirroring endpoint is created.

List mirroring endpoints

List all mirroring endpoints in a project.

gcloud

To list all mirroring endpoints, use the gcloud network-security mirroring-endpoint list command:

gcloud beta network-security mirroring-endpoint list \
    --project PROJECT_NAME \
    --location ZONE

Replace the following:

  • PROJECT_NAME: the name of the project where the mirroring endpoint is created.

  • ZONE: the zone where the mirroring endpoint is located.

Delete a mirroring endpoint

You can delete a mirroring endpoint by specifying its name, location, and project.

gcloud

To delete a mirroring endpoint, use the gcloud network-security mirroring-endpoint delete command:

gcloud beta network-security mirroring-endpoint delete ENDPOINT \
    --project PROJECT_NAME \
    --location ZONE \
    --no-async

Replace the following:

  • ENDPOINT: the name of the mirroring endpoint.

  • PROJECT_NAME: the project name where the mirroring endpoint is created.

  • ZONE: the zone where the mirroring endpoint is located.

What's next