Background

This document will guide you through the Virtru Gateway installation from Google Marketplace

Specific steps for this section include:

Sync your Google Workspace domain with Virtru

Login into marketplace

Configure Gateway

Deploying Virtru Private Keystore (for Google Workspace CSE)

Default configuration

Ingress

Egress (Options)

Other Delivery Options

Virtru Pricing Chart

Sync your Google Workspace domain with Virtru

If you have not already done so, please follow this guide to sync your Google Workspace domain with Virtru, this is a prerequisite for provisioning your Virtru Gateway in GKE.

https://support.virtru.com/hc/en-us/articles/360006721433-Install-Virtru-for-Google-Workspace-Domains-to-Perform-a-Sync-Admin-Guide-

Log into marketplace

Direct link

• • Direct link
    • https://console.cloud.google.com/marketplace/product/virtru-public/gateway?project=virtru-public

Or Search the marketplace

• • https://cloud.google.com/marketplace
  • Search for “Virtru”
  • Click “Configure”
    
    

Configure gateway 

• • Either create cluster or use existing 
  • Pick a zone
  • Namespace 
    • <Gateway mode>
    • Example "Virtru-oe”
  • App instance Name
    • “<Leave Default Value>”
  • Gateway Hostname
    • The FQDN that your application will run as.
  • Gateway Token Name and Token Secret
    • Token ID  <Provided by Virtru>
    • Token <Provided by Virtru>
  • Primary Mailing Domain
    • The primary email domain of your Google Workspace tenant 
  • Amplitude Token
    • Provided by Virtru
  • Gateway Usage
    • Select gateway mode/topology
      • Outbound - Data Loss Prevention (Using rules set in the Virtru control center)
      • Outbound - Encrypt Everything
      • Outbound - Decrypt Everything
      • Inbound - Encrypt Everything
      • Inbound - Decrypt Everything
  • Virtru Pricing Plan
    • Select the option that applies to your price plan. 
      • Reference link for Pricing
      • See Chart for Config map to Price breakdown
  • Click “Deploy”
    
    

Example of a non gateway configuration:

Deploying CSE

At this step if you are deploying a CSE configuration in addition to your gateway pods follow the next steps here:

https://support.virtru.com/hc/en-us/articles/4407770903703-Marketplace-Installation-Gateway-Google-Client-Side-Encryption-Key-Management-Server

Default configuration

The default configuration can be modified once your application is installed.

Once you click "Deploy" you will be set up with the following.

• 2 Nodes in a new cluster (optional)
• 2 Pods
  • Each pod represents 1 Virtru gateway application running in outbound encrypt mode
  • 1 pod per node in the cluster for build in redundancy 
• 1 External load balancer service with an external IP listening on port 2525 ingress
• 1 configmap yaml file with your gateway environment variables. 

Ingress

You will need to get your public IP that your External load balancer is using for your new service.

• Navigate to Compute Engine> Services & Ingress
• Copy your static IP of your “External load balancer”
• Create an A record for gw.customer.com that points to this new IP
  
  

Egress (Options)

The Virtru gateway is set by default to relay through Google workspace, you will need to follow these instructions to get your IPs for the VM instances that your cluster is installed on before relaying through your Google Workspace tenant. 

• Relay through Google workspace
  • Navigate to Compute Engine> VM instances
    
  • Copy the static IPs from your cluster and add them to the SMTP relay service in your Google Workspace tennant as an Allowed IP to relay through your tennant before final delivery.
  • https://support.google.com/a/answer/2956491?hl=en
• Send to your existing relay
  • Navigate to Applications>Gateway>Config Map 
  • Click "gateway"
  • Edit the YAML file 
  • Change the value next to the "GATEWAY_TRANSPORT_MAPS" variable to use your relay 
    • [next-hop-relay.customer.com]:587 (Example)
  • Click "Save"

Other delivery options

• Follow Google’s Documentations for other recommended methods of Sending mail from your GCP Application
  • https://cloud.google.com/compute/docs/tutorials/sending-mail
  • https://cloud.google.com/nat/docs/gke-example

Virtru Pricing Chart

gateway___gmail_encryption__per_user_per_day_

gateway___gdrive_encryption__per_user_per_day_

gateway___gmail___gdrive_encryption__per_user_per_day_

gateway_network_level_encryption_per_day_

gateway__gmail_encryption_with_customer_hosted_keys___per_user_per_day_

gateway__gdrive_encryption_with_customer_hosted_keys___per_user_per_day_

gateway__gmail___gdrive_encryption_with_customer_hosted_keys__per_user_per_day_

gateway_network_level_encryption_with_customer_hosted_keys__per_user_per_day_

Next Step

Marketplace Gateway - Outbound Encrypt Rules for Gmail