Google Cloud: AI assistant (LLM)¶

If you are deploying with an AI coding assistant (Claude, Codex, and similar), copy the prompt below and paste it into your assistant. It drives the same gcloud CLI flow as the CLI (gcloud) guide, but written for the assistant to follow step by step, pausing for your confirmation and for the values only you can supply.

Before you paste

Give the assistant a session that already has the gcloud CLI installed and authenticated (gcloud auth login) for your project (an agentic tool with shell access, or paste the commands it returns into your own terminal). Have your engagement lead's values ready: the shared image name and image project, plus your project ID, zone/region, network and subnet, and a machine type. The assistant will ask for anything it is missing.

Deployment prompt¶

You are helping me deploy the Sophos Remote Testing Appliance (RTA) as a Compute
Engine instance in my Google Cloud project, using the gcloud CLI. Work through the
steps below in order. Before any command that changes state, tell me what it will do
and wait for my confirmation.

CONTEXT:
- The appliance is a prebuilt Compute Engine image my engagement lead shared with my
  Google identity or project. It is a generic Linux image with no engagement identity
  baked in, so on first boot it shows an "Appliance Registration" screen with a
  one-time activation code that I send back to Sophos. There is no software to install
  and no inbound access.

WHAT I WILL PROVIDE (ask me for any you do not have; never guess these):
- <PROJECT_ID>: my GCP project ID (for example acme-pentest-2025).
- <ZONE>: a zone in my preferred region (for example europe-west1-b).
- <IMAGE_NAME>: the image name my engagement lead shared.
- <IMAGE_PROJECT>: the Sophos-owned image project to launch from, from my engagement lead.
- <USERNAME>: any Linux username I choose for break-glass SSH; GCP creates it from the
  key metadata.
- <SSH_KEY_PATH>: path to my public SSH key file (for example ~/.ssh/your_key.pub).
- <NETWORK> and <SUBNET> (optional): my target VPC network and subnet. If I do not give
  these, use my project's default network.

STEPS:
1. Point gcloud at my project and confirm the shared image is visible:
   gcloud config set project <PROJECT_ID>
   gcloud compute images describe <IMAGE_NAME> --project=<IMAGE_PROJECT> \
     --format='value(name,status)'
   Expect one image with status READY. If it errors with not-found or a permission
   message, stop: the image name or image project is wrong, or access was not granted
   to my identity. Tell me.

2. Create the instance (e2-standard-4 is the recommended size; e2-standard-2 is the
   2 vCPU / 8 GB minimum). --enable-display-device is required, or the RTA console is
   inaccessible and cannot be added later. --no-address gives it no external IP,
   because the appliance only needs outbound access:
   gcloud compute instances create sophos-rta \
     --project=<PROJECT_ID> \
     --zone=<ZONE> \
     --machine-type=e2-standard-4 \
     --image=<IMAGE_NAME> \
     --image-project=<IMAGE_PROJECT> \
     --boot-disk-size=40GB \
     --boot-disk-type=pd-balanced \
     --no-address \
     --enable-display-device \
     --metadata="ssh-keys=<USERNAME>:$(cat <SSH_KEY_PATH>)"
   If I gave you a <NETWORK> and <SUBNET>, add --network=<NETWORK> --subnet=<SUBNET>.
   If my project already has a suitable project-level SSH key, drop the --metadata line.

VERIFY:
3. Confirm the instance is running and note its internal IP:
   gcloud compute instances describe sophos-rta --project=<PROJECT_ID> --zone=<ZONE> \
     --format='get(status,networkInterfaces[0].networkIP)'
   Expect status RUNNING and an internal IP populated; there is no external IP.

4. About a minute after create, read the one-time activation code off the serial
   console:
   gcloud compute instances get-serial-port-output sophos-rta \
     --project=<PROJECT_ID> --zone=<ZONE>
   The output shows an "Appliance Registration" screen with a short code (for example
   "4 5 D C V Y"). Read that code back to me exactly. Do NOT send it anywhere yourself:
   I give it to my Sophos engagement lead, who activates the appliance. After
   activation the console switches to a live status dashboard.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a command fails, returns something unexpected,
  or reality does not match what is written here, STOP and show me the exact output.
  Do not improvise, invent flags, or try alternative commands on your own.
- The appliance needs exactly ONE connection: an outbound tunnel on TCP/443 to
  connect.remotetesting.secureworks.com. Never open, forward, or allow any INBOUND
  port to it. If connectivity fails, the problem is on the outbound path, never a
  missing inbound rule.
- Never enable Secure Boot and never change the firmware or boot type away from what
  these steps specify (UEFI / Generation 2). The appliance will not boot otherwise.
- Do not SSH into, log in to, or reconfigure the appliance. Once it boots it
  provisions itself; there is nothing to set up inside it.
- Every value in angle brackets (<LIKE_THIS>) must come from me. Never guess, invent,
  or reuse one. Ask me for any you do not have before running the step that needs it.
- Do not weaken security to force the connection (do not disable TLS inspection, and
  do not turn off a firewall). If something is blocked, tell me what and let me decide.
- Do only what these steps describe: deploy this one appliance. Do not create extra
  resources, install extra software, or take any action beyond that.

Network access¶

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination


Destination	`connect.remotetesting.secureworks.com`
IP addresses	`3.33.194.251` and `15.197.255.2` (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting¶

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.