Welcome — CCoE STAR Topology Design
NCC STAR + in-band NSI / Palo Alto · greenfield (hanuraIQ proof)
📊 Open the Cloud Armor scenarios diagram (Global vs Regional vs PA-only) ↗
How your request reached this page North-South · via Cloud Armor edge
Internet client
↓ (DNS: public name → anycast VIP)
Global External ALB + Cloud Armor (Google Front End edge)
↓ WAF: OWASP / rate-limit evaluated here (SQLi/XSS → 403)
Consumer VPC ingress firewall policy → NSI intercept
↓ GENEVE 6081
Palo Alto VM-Series (deep inspection, fail-closed)
↓
THIS VM 10.133.150.6 :443 ✅
Live evidence from THIS request
| Entry path (from Host header) | e2e-web.gcp.public.hanuraiq.com North-South · via Cloud Armor edge |
|---|
| Via header [live] | 1.1 google |
|---|
| X-Forwarded-For [live] | 216.73.217.138,34.36.38.77 |
|---|
| X-Forwarded-Proto [live] | https |
|---|
| Reached VM (internal IP) [live] | 10.133.150.6 (consumer VPC, sn-nonprod-workload) |
|---|
| Palo Alto inspection [described] | This request entered the consumer VPC and was steered to the Palo Alto fleet by the NSI ingress rule (apply_security_profile_group) before reaching this VM. Confirm in the firewall log: rule nsi-inspect-lb-ingress. |
|---|
What this proves: the [live] rows are
read directly from the request. Via: 1.1 google + an
X-Forwarded-For ending in the load-balancer IP means the request came
through the Global External ALB + Cloud Armor edge (North-South). If those are
empty, you reached the VM directly inside the VPC (East-West / private DNS) —
same workload, two DNS names, two paths (split-horizon). The Palo Alto hop is marked
[described] because the VM can't see it in the HTTP request;
it is proven separately from the firewall + PA logs (demo-01-ingress-ns.sh).