gcp external load balancer port blocking

Question

I have GCP setup with external https load balancer and backend services with server less NEG. in front of the load balancer that has another cloud WAF. my requirement is when we blocking all IP ranges (except cloud WAF) from cloud armor security policy that will be apply only for layer 7. when we scan port in load balancer IP, port 80 and 443 are open for everyone in layer 3 and 4 is there any security rule for layer3 and layer 4?

I have config cloud armor IP blocking security policy.

Answer 1

The GCLB will have open ports enabled by default: https://cloud.google.com/load-balancing/docs/https#open_ports

How are you instituting the IP allow/deny rule? Are you inspecting a header with the contained IPs, which would imply L7 rules? Generally with an IP ACL rule, Cloud Armor will look at the connecting IP and issue a block at the lower layer and not use L7 rules.

Taking a step back, what is the concern you are trying to mitigate?