Views:

Launch a Service Gateway virtual appliance from Google Cloud using a deployment package.

If your environment does not have a local hypervisor or VM host machine, you can deploy the Service Gateway virtual appliance to your Google Cloud environment using a deployment package. Before you begin, review the Service Gateway appliance system requirements to ensure your virtual appliance has the settings needed to deploy the services you want to use.
Note
Note
The steps contained in these instructions are valid as of July 2026.
Before you being, ensure you have downloaded and installed the Google Cloud CLI on the local machine you are using to deploy and access the Service Gateway. For more information, refer to the Google Cloud document Install the Google Cloud CLI.

Procedure

  1. Obtain the Service Gateway registration token.
    1. In the TrendAI Vision One™ console, go to Workflow and Automation → Service Gateway Management.
    2. Click Download Virtual Appliance.
    3. Copy the Registration Token.
      Note
      Note
      The registration token is used to register the Service Gateway virtual appliance to Service Gateway Inventory after installation and setup are complete. The registration token expires after 24 hours if not used.
  2. To initiate the instance launch, sign in to the Google Cloud portal.
  3. Create a firewall policy for the Service Gateway virtual appliance you want to deploy.
    1. In the Google Cloud portal, open the navigation menu at the upper left of the screen. Go to VPC Network → Firewall.
      Note
      Note
      If you don't see the service, use the search bar at the top of the screen to search for Firewall. Find Firewall under Search results.
    2. Click Create firewall policy.
      sg_gcp_step4=6023ef79-f36c-47f2-b89b-9d2af493860c.png
    3. In the 1 Configure policy step, specify a Policy name, select the deployment scope of the firewall policy, and click Continue.
    4. In the 2 Add rules step, click Create firewall rule to create a new firewall rule for the Service Gateway virtual appliance.
      sg_gcp_step7=b8aee372-fcdf-49ca-9f00-a796736a278b.png
    5. On the Create a firewall rule panel on the right, configure the firewall rule settings.
      1. For Priority, specify a positive integer.
        For more information on priority, refer to the Google Cloud documentation.
      2. For Direction of traffic, select Ingress.
      3. For Action on match, select Allow.
      4. For Target, select the instance where you would like to apply this firewall rule.
      5. For Source network type, select the network type that matches the source where the ingress traffic comes.
      6. For Source filters, specify the IP type and IP ranges of the source.
        Note
        Note
        TrendAI™ recommends specifying the source IP addresses/CIDR ranges that are within your network.
      7. For Protocols and ports, select Specified protocols and ports, select TCP, and add the ports according to the following table.
        Service
        Destination port ranges
        Protocol
        Action
        Description
        SSH
        22
        TCP
        Allow
        For accessing Service Gateway virtual appliance CLISH command
        HTTP
        80
        TCP
        Allow
        Service enabled queries for on-premises Active Directory servers, connected TrendAI™ products (such as endpoint agents), Predictive Machine Learning, File Reputation Services, or Third-Party Integration
        HTTPS
        443
        TCP
        Allow
        Service enabled queries for on-premises Active Directory servers, connected TrendAI™ products (such as endpoint agents), Predictive Machine Learning, File Reputation Services, or Third-Party Integration
        Custom TCP
        5274
        TCP
        Allow
        Web Reputation Services or Web Inspection Service queries
        Custom TCP
        5275
        TCP
        Allow
        Web Reputation Services or Web Inspection Service queries
        Custom TCP
        8080
        TCP
        Allow
        Forward Proxy Service listening port for connection
        Custom TCP
        8088
        TCP
        Allow
        Zero Trust Secure Access On-Premises Gateway listening port for connection
      8. For Enforcement, select Enabled.
      9. Review the configuration of this firewall rule, then click Create.
      10. Select the firewall just created, and click Continue.
    6. In the 3 Associate policy with VPC networks (optional) step, click Associate to associate this firewall policy with existing VPC networks.
      Note
      Note
      If you do not have any VPC networks, refer to Google Cloud documentation to create one.
    7. Review the configuration of this firewall policy, then click Create.
  4. Create a VM instance.
    1. Go to Compute Engine → VM instances.
    2. In the Virtual instances screen, click Create instance.
      sg_gcp_step22=5364686e-a5dd-44c8-adb9-a688271343e7.png
    3. In the Create an instance screen, choose Create VM from… → Marketplace.
      sg_gcp_step23=58c1131a-cd26-4be4-b5aa-0678b7934dce.png
    4. In the Marketplace screen, select TrendAI Vison One™ Service Gateway to deploy.
      1. In the Marketplace screen, search for the product TrendAI Vison One™ Service Gateway.
        sg_gcp_step24a=f3f0c152-75c3-4e49-945f-76ef3f2cb8f0.png
      2. Select TrendAI Vison One™ Service Gateway in the results.
      3. Click Get Started and agree to the terms and agreements before the deployment.
      4. A dialog for successfully agreeing to terms will pop up. Click Deploy to proceed.
      5. Click Launch to proceed with the deployment.
        sg_gcp_step24e=b3b3a668-5bd1-46bd-8935-408ab8caa882.png
      6. Choose one of the following ways to deploy TrendAI Vison One™ Service Gateway.
        Deployment method
        Steps
        Terraform
        1. Specify a Deployment name.
        2. In the Deployment Service Account section:
          1. Select an Existing account which has the roles/config.agent, roles/compute.admin, and roles/iam.serviceAccountUser roles, or create a new account for the deployment.
          2. Select a Zone for the location where TrendAI Vison One™ Service Gateway will be deployed.
        3. In the Machine type section, select a machine type that meets the specifications for your deployment.
          Note
          Note
          The default machine type is e2-highcpu-16 with 16 vCPU and 16 GB memory. For more information, see Service Gateway appliance system requirements.
        4. In the Boot Disk section:
          • Select the disk type that meet the specifications for your deployment in Boot disk type.
          • Specify a disk size for Boot disk size in GB.
          Note
          Note
          The default disk size and disk type is 500 GB and Balanced Persistent Disk respectively. For more information, see Service Gateway appliance system requirements.
        5. In the Network interfaces section, edit the following settings of the network interface:
          • Select the VPC where the firewall policy created in previous steps is applied for Network.
          • Select the desired subnetwork for Subnetwork.
            Note
            Note
            Refer to the Google Cloud documentation on how to set up a VPC network and subnets.
          • Select None for External IP.
        6. Review the VM instance settings, and click Deploy to deploy TrendAI Vison One™ Service Gateway.
        Command-line deployment
        Important
        Important
        Commands included in this step require installing certain Google Cloud tools before using this installation method:
        1. Agree to the terms of service and click Next.
        2. In the Configure a service account (Optional) section, click Configure to select an existing account which has the roles/compute.admin and roles/iam.serviceAccountUser roles, or create a new account for the deployment.
        3. In the Configure gcloud section, run all the mentioned commands to configure the gcloud environment.
        4. In the Review VM images section, click Download to download the zipped file, which includes the Terraform scripts of deploying TrendAI Vison One™ Service Gateway, to your local environment.
        5. Unzip the downloaded file.
        6. Click SHOW COMMAND to display all the required Terraform commands for the deployment.
        7. Open a terminal, change the current directory to the unzipped folder, and run all the Terraform commands mentioned in step 6 for deploying a TrendAI Vison One™ Service Gateway VM instance to the specified Google Cloud project.
           
          # Configure the current gcloud environment for Terraform
gcloud config set project <project_name>
gcloud auth application-default login

# Deploy TrendAI Vision One™™ Service Gateway VM instance on Google Cloud Platform
cd path/to/unzipped/folder
terraform init
terraform apply

# There are two parameters to be input during the deployment:
# var.goog_cm_deployment_name
#   The name of the deployment and VM instance.

# var.project_id
#   The ID of the project in which to provision resources.
# After providing values for these parameters, type `yes` to proceed.
    5. After the deployment is completed, go to Compute Engine → VM instances screen.
      TrendAI Vison One™ Service Gateway is ready to connect and configure when Status shows the green check icon (sg_gcp_step26=4eafcf23-06b3-4ca6-9107-c0308cbd8941.png).
  5. Connect to the VM instance.
    1. Open a terminal on your local machine.
    2. Use the following command to sign into the Service Gateway appliance with the admin account using gcloud.
      gcloud compute ssh admin@<vm_instance_name> --project=<gcp_project_name> --zone=<zone> --tunnel-through-iap
      Note
      Note
      If direct SSH connections to Google Cloud VM instances are not allowed on your Google Cloud project, the --tunnel-through-iap flag is required when connected to the Service Gateway appliance from your local machine using SSH.
  6. Configure and register the Service Gateway.
    1. Change your password.
    2. After the new password is applied, the Command Line Interface (CLI) appears.
    3. Type enable and press the ENTER key to enable administrative commands.
      The command prompt changes from > to #.
    4. Use the configure command to configure the required network settings, such as the IP address and DNS settings.
    5. Type the following command to register the Service Gateway virtual appliance to TrendAI Vision One™.
      register <registration_token>
      Use the registration token you obtained from Service Gateway Inventory.
  7. Use the CLI to configure other settings, if required.
    For more information on available commands, see Service Gateway CLI commands.
Comments (0)