You applied hierarchical firewall policy at org level, a global network firewall policy (IPS), and VPC firewall rules. A newly created VPC shows no logs and external traffic is blocked while internal RFC1918 traffic works. How do you fix connectivity and logging?

The correct answer addresses the core issue of firewall rule evaluation order. In Google Cloud, VPC firewall rules are evaluated before hierarchical firewall policies by default. This means if a VPC firewall rule blocks traffic, the hierarchical policy (like the IPS) will never see it, leading to blocked external traffic and no logs from the policy. Changing the evaluation order to prioritize hierarchical policies ensures they are applied first, allowing the IPS to inspect traffic and log accordingly, while still permitting internal RFC1918 traffic if allowed by subsequent VPC rules. Creating a new VPC is an overly drastic and time-consuming solution that doesn't address the underlying policy conflict. Adjusting priority numbers without understanding the evaluation order is ineffective; if VPC rules are evaluated first, their priority relative to policies is irrelevant. Lowering policy priorities and raising VPC priorities would exacerbate the problem, making it even more likely for VPC rules to block traffic before policies are considered.