Disabling Apigee X Internet Egress With VPC Service Controls

[chrishannah]

Hello,

I have a client requirement that all Apigee southbound traffic must go through a network appliance deployed in GCP. We have northbound traffic making it to Apigee through the network appliance. We have an API proxy using https://mocktarget.apigee.net as the target endpoint. We are trying to use the approach documented here for disabling Apigee's default internet egress route so that it will follow the routes we've exported in the Apigee peering connection.

We ran the command for the NETWORK that is peered with Apigee. The gcloud CLI reported that the operation was successful.

gcloud services vpc-peerings enable-vpc-service-controls \
  --network=$NETWORK --project $PROJECT_ID \
  --service servicenetworking.googleapis.com

When we ran a test to verify that the traffic is no longer reaching the internet from Apigee, but the calls are still succeeding. We had a network security engineer running a sniffer to verify the Apigee southbound traffic is not reaching network appliance.

Are there any additional steps that we can try to troubleshoot this?

We have also tried using the new forward proxy functionality. It seems we can get that to work for internet bound traffic. However, we are having trouble getting it to work for internal traffic. We're not sure what to change on the firewall settings to get it working at this point. So, we're trying to get our original plan working by deleting Apigee's default route using the command above.

Thanks in advance for any help or guidance.

[iambaskar]

Hi,

At the high level, running the command you mentioned `gcloud services vpc-peerings enable-vpc-service-controls ...` should block the egress traffic to internet as the command removes the default route. 

Unfortunately, I won't be able to help much without looking into the org & proxy configurations. Please provide more details on the org & proxy if possible or feel free to create a support ticket with those informations. We can take a look at it. 

References:

• https://cloud.google.com/apigee/docs/api-platform/integration/vpcsc-integration
• https://cloud.google.com/sdk/gcloud/reference/services/vpc-peerings/enable-vpc-service-controls

Thanks,
Baskar.

[chrishannah · Accepted solution]

We got this working by removing our default route (0.0.0.0/0) and adding two new routes: 0.0.0.0/1 & 128.0.0.0/1

If I'm being honest, I'm not entirely sure why the default route 0.0.0.0/0 wasn't doing the trick, but changing the routes exported in the VPC peering connection seems to have resolved our issue.