Question

SecureCorp runs a fleet of web servers in a managed instance group (MIG) that autoscales between 5 and 40 instances. The security team deployed a self-managed IDS appliance behind an internal passthrough load balancer as a collector. They need to mirror traffic from ALL current and future web server instances to the IDS, without editing the packet mirroring policy each time the MIG scales. How should they configure the mirrored source in the packet mirroring policy?

Accepted Answer

Select the entire subnet(s) containing the MIG, or use a shared network tag applied to the instance template, as the mirrored source

Answer

Specify each instance individually as a mirrored source and add a Cloud Function to update the policy on scale events

Answer

Set the internal load balancer fronting the IDS as both the mirrored source and the collector destination

Answer

Enable VPC Flow Logs on the subnet, which automatically forwards mirrored packets to the collector ILB