Smarter Google Cloud Filtering in FortiGate with External Resources

🤔 The Problem

So you’re using FortiGate and need to allow traffic to Google Cloud Platform (GCP)? Easy, right? FortiGate has a built-in Google Cloud Internet Service that contains all the IP addresses!

Not so fast. 🛑

While FortiGate’s Google Cloud Internet Service seems convenient, it comes with some serious limitations that make it difficult to follow firewall best practices.

🚧 The Limitations

Here’s what frustrated me about the built-in Google Cloud Internet Service:

💼 Real-World Scenario

I recently needed to configure FortiGate for a telephony application (article coming soon!) that required:

• ✅ Access to Google Cloud europe-west3 only
• ✅ Restricted to specific ports
• ✅ Nothing more, nothing less

The built-in Internet Service couldn’t do this. And that’s the whole point of a firewall - precise control! 😤

💡 The Solution: Custom External Resource

Instead of fighting with FortiGate’s limitations, I built a lightweight solution using Cloudflare Workers that gives me exactly what I need:

✨ What It Does

I created a simple application that:

• 🌍 Fetches Google’s official IP ranges from their public JSON file
• 🎯 Filters by specific GCP regions (europe-west1, us-central1, asia-southeast1, etc.)
• 🔢 Returns IPv4, IPv6, or both based on your needs
• ☁️ Runs on Cloudflare’s free tier (Workers are amazing!)
• 🔄 Updates automatically whenever Google changes their ranges
• 🚀 Integrates seamlessly with FortiGate’s External Resource feature

🎯 Key Benefits

🎉 The Best Part:
Now I can use these filtered IP ranges in FortiGate firewall policies and restrict them to specific ports - exactly what the built-in Internet Service couldn’t do!

This means:

• ✅ Only allow necessary GCP regions
• ✅ Restrict to required ports/services
• ✅ Follow security best practices
• ✅ Maintain full control
• ✅ Automatic updates from Google’s official data

🔧 How to Use It

📡 The API Endpoint

The Cloudflare Worker is live and ready to use! Here’s how it works:

Base URL:

https://unifyphonefirewallconnector.networks-b60.workers.dev/ <--- the cloudflare worker link u recuive this when u create a cloudflare worker

Parameters:

• scope - The GCP region you want (e.g., europe-west3, us-central1, all)
• type - IP version: ipv4, ipv6, or all

🌟 Example Requests

Get all IPv4 and IPv6 for europe-west3:

https://unifyphonefirewallconnector.networks-b60.workers.dev/?scope=europe-west3&type=all

Get only IPv4 for us-central1:

https://unifyphonefirewallconnector.networks-b60.workers.dev/?scope=us-central1&type=ipv4

Get all Google Cloud IPs (all regions):

https://unifyphonefirewallconnector.networks-b60.workers.dev/?scope=all&type=all

🔥 Implementing in FortiGate

Now for the magic - integrating this into your FortiGate firewall!

Step 1: Create the External Resource

Connect to your FortiGate CLI and add the external resource:

config system external-resource
edit “gcp-europe-west3-ipv4&ipv6”
set type address
set resource “https://unifyphonefirewallconnector.networks-b60.workers.dev/?scope=europe-west3&type=all”
set refresh-rate 300
next
end

What this does:

• 📝 Creates an external resource named gcp-europe-west3-ipv4&ipv6
• 🔗 Points to the Cloudflare Worker URL with your desired scope and type
• ⏱️ Updates every 300 minutes (5 hours) to stay current with Google’s IP ranges

💡 Customize the Refresh Rate
The refresh-rate is in minutes. I use 300 (5 hours), but you can adjust based on your needs. Google doesn’t change their IP ranges that frequently, so 300-1440 minutes is reasonable.

Step 2: Use in Firewall Policies

Once the external resource is created, it appears in your FortiGate GUI as an address object!

You can now use it in firewall policies just like any other address object:

Example policy configuration:

🎯 This is the Magic!
Unlike the built-in Internet Service, you can now restrict this to only the ports you need. Want to allow only HTTPS (443)? Done. Need custom ports like 5060-5061? Easy!

Step 3: Verify the Resource

Check that your external resource is working:

diagnose external-resource address-list gcp-europe-west3-ipv4&ipv6

You should see the list of IP ranges. In my case, there are 27 entries (at the time of writing) that automatically update from Google’s official source.

📊 What You Get

📈 Current Stats

As of the last update:

• 27 IP range entries for europe-west3
• Automatic updates every 5 hours
• Both IPv4 and IPv6 ranges included
• Direct from Google’s official source

🔄 Update Process

The beauty of this solution:

1. Google updates their IP ranges in their official JSON file
2. The Cloudflare Worker fetches the latest data on each request
3. FortiGate refreshes the external resource every 300 minutes
4. Your firewall rules automatically use the latest IPs
5. Zero manual intervention required! 🎉

🎓 Advanced Usage

🌍 Available GCP Regions

The Worker supports all major GCP regions. Here are some common ones:

Europe:

• europe-west1 - Belgium
• europe-west3 - Frankfurt
• europe-west4 - Netherlands
• europe-north1 - Finland

Americas:

• us-central1 - Iowa
• us-east1 - South Carolina
• us-west1 - Oregon

Asia Pacific:

• asia-southeast1 - Singapore
• asia-northeast1 - Tokyo
• australia-southeast1 - Sydney

Special:

• all - All GCP regions (use with caution!)

🔐 Security Best Practices

When using this solution:

1. Be Specific 🎯

   • Only include regions you actually need
   • Don’t use scope=all unless necessary

2. Limit Ports 🔒

   • Take advantage of the ability to restrict services
   • Only allow required ports in your firewall policy

3. Monitor Usage 📊

   • Enable logging on your firewall rules
   • Review logs periodically to ensure expected traffic

4. Test First 🧪

   • Test in a non-production environment
   • Verify connectivity before deploying to production

5. Document 📝

   • Document which regions you’re using and why
   • Keep track of refresh rates and any customizations

🛠️ Troubleshooting

Common Issues and Solutions

❓ External resource not updating?

• Check your FortiGate can reach the internet
• Verify the URL is correct (copy/paste to avoid typos)
• Check FortiGate logs: diagnose debug application urlfilter -1

❓ Too many IP ranges?

• Use a more specific region instead of all
• Consider multiple external resources for different regions

❓ Connection issues after setup?

• Verify your firewall policy order
• Check that the external resource has actually populated
• Enable logging to see if traffic is hitting the rule

❓ Want to see what’s in the external resource?

diagnose external-resource address-list gcp-europe-west3-ipv4&ipv6

🤓 Want to Know More?

I deliberately kept this article focused on how to use the solution rather than the technical implementation details.

However, if you’re interested in:

• 🔍 How the Cloudflare Worker is built
• 💻 The source code
• 🏗️ Technical architecture
• 🔧 How to modify or self-host it

Check out the GitHub repository:

🔗 Rednas1992/google-europe-west3

The code is open source and well-documented. Feel free to:

• ⭐ Star the repo if you find it useful
• 🐛 Report issues or bugs
• 💡 Suggest improvements
• 🔀 Fork it and customize for your needs

🎯 Real-World Applications

This solution is perfect for:

📞 Telephony Systems

• Unify Phone applications (article coming soon!)
• VoIP services hosted on GCP

🏢 Business Applications

• Workspace integrations
• G Suite services
• Custom applications hosted on specific GCP regions

🎉 Conclusion

FortiGate’s built-in Google Cloud Internet Service is convenient but inflexible. By using an external resource powered by a simple Cloudflare Worker, you get:

• ✅ Region-specific filtering - Only allow the GCP regions you need
• ✅ Port restrictions - Control exactly which services are allowed
• ✅ Automatic updates - Always use Google’s latest IP ranges
• ✅ Zero cost - Runs on Cloudflare’s free tier
• ✅ Best practices - Follow the principle of least privilege
• ✅ Full control - Customize everything to your needs

This is how firewall rules should work: precise, automated, and secure. 🔒

📚 Related Articles

Coming soon:

• 📞 Configuring Unify Phone with FortiGate (where this solution shines!)
• 🔧 Advanced FortiGate external resource techniques
• 🌐 Multi-cloud firewall strategies

Stay tuned! 🎬

💬 Feedback & Questions

Found this helpful? Have questions or suggestions?

• 💬 Leave a comment below
• 🐛 Open an issue on GitHub
• ⭐ Star the repository if you found it useful!

Built with ☕ and frustration with inflexible Internet Services. Made with ❤️ for the network security community.