--- title: "Prerequisites for Deploying vNIOS for Google Cloud Instances" canonical: "https://docs.infoblox.com/space/vniosgcp/35786159/Prerequisites%20for%20Deploying%20vNIOS%20for%20Google%20Cloud%20Instances" format: markdown --- Before deploying vNIOS for Google Cloud, ensure that your environment meets the requirements described in this topic. Complete the common prerequisites for every deployment. Then, complete the section that applies to your deployment type. If your deployment involves both Marketplace and HA, complete the requirements in all three prerequisite sections. This topic contains the following sections: > Macro (toc) # > Macro (anchor) Common Prerequisites - Set up a Google Cloud account and create a project, if none already exists. - If you want to join the vNIOS for Google Cloud instance to the on-prem Grid, configure an on-premise Infoblox Grid or Grid Master. For more information, refer to the *[Infoblox NIOS Documentation](https://docs.infoblox.com/space/NIOS/35400616/NIOS)*. - Install the Google Cloud CLI utility to perform CLI based operations. For more information, see *[https://cloud.google.com/sdk/gcloud/](https://cloud.google.com/sdk/gcloud/)*. - Create the required VPCs, subnets, and firewall settings by referring to the Google Cloud documentation. - You can use vNIOS for Google Cloud to control, provision, and manage IP addresses in your Google Cloud VPCs. For more information about VPCs, see [https://cloud.google.com/vpc/.](https://cloud.google.com/vpc/.). - Configure cloud NAT in Google Cloud to allow the instances that you create on VPCs to access the internet. For more information, see *[Cloud NAT Overview](https://cloud.google.com/nat/docs/overview)*. - For information about ports needed to create firewall rules, see the *[Ports to Configure Firewall Rules](https://infoblox-docs.atlassian.net/wiki/spaces/vniosgcpdraft/pages/32374911)* section. - For internal communication between VPCs, configure firewall egress rules. This is specifically required when setting up HA to ensure the two nodes of the HA pair communicate with each other. - To deploy a single network interface instance in a shared VPC network on Google Cloud, ensure that the VPC of your host project is shared with the service projects. - If you want to use shared VPC feature, ensure to attach service projects to host projects. # > Macro (anchor) Prerequisites for HA Deployment To deploy a vNIOS for Google Cloud instance in an HA (high availability) setup, a capability introduced in NIOS 9.0.4: - In the Google Cloud console, set up a service account that is linked to both nodes in the HA pair, with the role permissions required to form an HA pair. For more information, see the *[Configuring a Google Cloud Service Account](https://infoblox-docs.atlassian.net/wiki/spaces/vniosgcpdraft/pages/32374911)* section. - vNIOS for Google Cloud HA currently supports only custom IAM roles containing the required HA permissions. Predefined Google IAM roles are not supported for HA formation. - In NIOS, configure a DNS resolver in the *Grid Properties Editor*. For more information about DNS resolvers, refer to the *Enabling DNS Resolution* topic in the *[Infoblox NIOS Documentation](https://docs.infoblox.com/space/NIOS/35400616/NIOS)*. - The resolver must be able to reach the following cloud APIs: - compute.addresses.use - compute.instances.get - compute.instances.list - compute.instances.updateNetworkInterface - compute.subnetworks.use - iam.roles.get - resourcemanager.projects.getIamPolicy - If the configured DNS resolver fails to resolve the Google API metadata.google.internal, Infoblox recommends that you use 169.254.169.254 as the resolver. - Ensure that the subnets you are using in the HA setup have necessary mechanism to access the NIOS UI. NIOS supports the use of both private and public subnets, however, they must be able to reach the NIOS UI. # > Macro (anchor) Prerequisites for MarketPlace Deployment When deploying a vNIOS instance from the Marketplace, ensure that your setup meets the requirements listed in the *Common Prerequisites* section and those listed in this section. - Install Terraform in a Linux system in which you will deploy the vNIOS instance. - In the Google Cloud console, set up a service account with the role permissions listed in the *Configuring a Google Cloud Service Account* section. > Macro (anchor) # Configuring a Google Cloud Service Account Create a Google Cloud service account that is attached to a role assigned with permissions defined in this section. These permissions, segregated according to the deployment type, are a minimum requirement to allow the vNIOS instance to manage resources in the Google Cloud cloud. For more information about Google service accounts, see the *[Create a Service Account](https://cloud.google.com/iam/docs/service-accounts-create)* section. Note that to create a Google Cloud service account, you must have the admin permissions required for the creation of service accounts. ## For Setting up High Availability The list of permissions that you must assign to a role that enables a vNIOS instance to form an HA pair are: `compute.addresses.use` `compute.instances.get` `compute.instances.list` `compute.instances.updateNetworkInterface` `compute.subnetworks.use` `iam.roles.get` `resourcemanager.projects.getIamPolicy` - Ensure that the **Role launch stage** field in the role that you assign to the service account is set to **General Availability**. - NIOS uses the roles with read permissions to run a check and validate the configuration on the host. - NIOS uses the role with write permission `compute.instances.updateNetworkInterface` to unassign private IP addresses from and assign private IP addresses to network interfaces during an HA failover. ## For Marketplace Deployment The list of permissions that you must assign to a role required for the Marketplace deployment are: - `roles/config.agent` - `roles/service.admin` - `roles/iam/serviceAccountUser` To set up HA with instances deployed from the Marketplace, ensure that the service account is assigned with a role that has permissions to form HA. > Macro (anchor) # Ports to Configure Firewall Rules Use the following points and take appropriate action for creating new inbound rules in Google Cloud at the VPC level: - Permit SSH traffic (TCP/22) from the preferred prefix. - Open the port for DNS (UDP/53). - Permit secure web traffic (HTTPS/443) only from a Custom IP prefix representing the network of hosts that access the vNIOS instance for management and configuration. - Open two ports for NIOS Grid Joining traffic: - UDP/1194 - UDP/2114 - Open the port for the Infoblox API Proxy (TCP/8787). - Open a port for VM VRRP (UDP/802) if the node is a member in an HA pair.