How to Configure Google Workspace BeyondCorp Enterprise App Connectors

The Death of the Legacy VPN

In traditional enterprise architecture, if a remote employee needs to access an internal web application (e.g., an HR portal hosted on a physical server in your corporate datacenter), they must launch a legacy VPN client (like Cisco AnyConnect) to tunnel into the network. This is fundamentally insecure. Once the VPN tunnel is established, the employee’s potentially malware-infected laptop has lateral routing access to the entire internal subnet.

Google Workspace replaces this with BeyondCorp Enterprise, a Zero Trust architecture. Using an App Connector, you can publish internal, on-premise applications directly to the public internet securely. The App Connector acts as a reverse proxy. When an employee attempts to access the HR portal from a coffee shop, they hit Google’s massive global Edge network first. Google forces them to authenticate (checking their password, 2FA, and device health). Only if they pass these checks does Google forward the HTTP request down through the Connector to the internal server. The employee gets access to the web app without a VPN, and they possess zero lateral network access.

Step 1: Deploying the Connector VM

To securely bridge the gap between your datacenter and Google’s cloud, you must deploy the BeyondCorp App Connector inside your internal network.

The Connector is a lightweight Linux virtual machine provided by Google. It does not require any inbound firewall ports to be opened. It makes a persistent outbound TLS connection to Google’s Edge.

1. Log into the Google Cloud Console (GCP) (which integrates with your Workspace tenant).
2. Navigate to Security > Identity-Aware Proxy (IAP).
3. Select the App Connectors tab.
4. Click Create Connector. Name it datacenter-connector-01.
5. Google will generate a provisioning script. You must now deploy a standard Debian or Ubuntu VM in your VMWare/Hyper-V environment and execute the provided script as root.

The script installs a Docker container that dials out to Google and registers the VM as an active bridgehead.

Step 2: Defining the Internal Application

Now that the bridgehead is established, you must tell Google exactly which internal IP address it is allowed to route traffic to.

1. In the Google Cloud Console, navigate back to the IAP dashboard.
2. Click the Applications tab, then Add Application > On-Premises App.
3. Name: Internal HR Portal
4. Internal hostname/IP: http://192.168.10.55:8080 (The physical IP of the server on your LAN).
5. Connector: Select the datacenter-connector-01 you just built.

Step 3: Creating the Public Endpoint (The Magic)

The internal routing is complete. Now you must generate the public-facing URL that the remote employees will actually type into their browser.

1. On the next screen of the wizard, Google asks for the External hostname.
2. Enter hr-portal.yourcorp.com.
3. Google will provide you with an external CNAME record (e.g., ghs.googlehosted.com).
4. Log into your DNS provider (Cloudflare, Route53, GoDaddy) and create a CNAME record pointing hr-portal to the Google Edge server.
5. Google will automatically generate and provision a free SSL certificate for the domain.

Step 4: Enforcing Zero Trust Policies

The final step is to lock the front door using Identity-Aware Proxy (IAP) policies.

1. In the IAP dashboard, select the Internal HR Portal application.
2. In the right-hand information panel, click Add Principal.
3. Add your corporate Google Workspace Groups (e.g., [email protected]).
4. Assign them the role of IAP-secured Web App User.
5. (Crucial) You can now apply Context-Aware Access levels here. For example, mandate that only members of the HR team who are using company-owned, encrypted laptops are allowed through.

The End-User Experience

The configuration is complete. An employee sitting in a coffee shop without a VPN opens Chrome and types https://hr-portal.yourcorp.com.

Their request hits Google’s Edge servers. Google intercepts the request, forces the user to log in via their Workspace account, and aggressively checks their laptop’s health (Is the firewall on? Is the disk encrypted?). Because they pass the policy, Google takes their HTTP GET request, shoves it down the encrypted App Connector tunnel into your datacenter, and serves the internal webpage. You have achieved true Zero Trust network access.