Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 7199
Evaluates GCP Compute Engine firewall rules to confirm that they prohibit ingress from the `0.0.0.0/0` source range to `TCP` port `7199`. Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources.
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. It is recommended that no security group allows unrestricted ingress access to TCP port 7199.
What this control checks
Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 7199
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_tcp_port_7199.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 137-139
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 61620 or 61621
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP or UDP ports 2483-2484
- Firewall rules should prohibit ingress from 0.0.0.0/0 to any port
- Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_tcp_port_7199 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_tcp_port_7199
Last reviewed: 2026-10-09