Question

A security engineer reports that traffic from a partner subnet (192.168.50.0/24) to a set of internal application VMs is being unexpectedly denied. You suspect a specific egress or ingress firewall rule is responsible, but you cannot confirm which rule is matching the denied packets. You need to see, per-connection, exactly which firewall rule is evaluating this traffic and whether it is allowing or denying it, with minimal changes to the environment. What should you do?

Accepted Answer

Enable Firewall Rules Logging on the relevant firewall rules, then inspect the resulting log entries in Cloud Logging for the connection's disposition and matching rule reference.

Answer

Enable VPC Flow Logs on the target subnet and filter the logs by source range 192.168.50.0/24 to identify the denying firewall rule.

Answer

Run a Connectivity Test from the partner subnet to the VMs and rely on its output to display packet-level hit counts for each firewall rule.

Answer

Increase the VPC Flow Logs sampling rate to 100% and add metadata annotations to reveal which firewall rule denied each packet.