It's worth reading the original "BeyondCorp" paper that discusses this: http://static.googleusercontent.com/media/research.google.com/en/us/pubs/archive/43231.

It's worth reading the original "BeyondCorp" paper that discusses this: http://static.googleusercontent.com/media/research.google.com/en/us/pubs/archive/43231.pdf http://static.googleusercontent.com/media/research.google.co... As some other folks have pointed out (and contrary to what the headline implies), there's isn't just setting your firewall to allow 0.0.0.0/0. In particular, pay attention to the Device Identity (client cert) and the Access Proxy parts.