GCP Network Engineer cheat sheet

VPC networks are global resources; subnets are regional. One VPC can span all regions, and a resource's region is determined by the subnet it uses.

Subnet primary ranges must come from RFC 1918 private space; secondary ranges are used for alias IPs (GKE pods/services, Cloud SQL private access).

Automatic mode creates one /20 subnet per region with preset ranges; custom mode gives full control and is required for predictable IPAM and hybrid addressing.

Shared VPC: the host project owns the network and subnets; service projects attach via VPC network peering-like association and consume subnets without owning them.

Peering is non-transitive: if A peers with B and B peers with C, A cannot reach C. Design hub-and-spoke or use Network Connectivity Center for transit.

Overlapping CIDR blocks break peering, VPN, and Interconnect attachment design; plan a global IPAM scheme before creating subnets.

Private services access requires an allocated range (prefix length /24 or larger per service) peered to the service producer network.

A subnet's range can be expanded (never shrunk) without recreating it; plan growth headroom in the smallest subnets first.

Choose Private Google Access or Private Service Connect endpoints when workloads need Google APIs without external IPs.

Routes: system routes are created automatically for each subnet; custom static routes can target an instance, VPN tunnel, or next-hop gateway.

A route's priority (0-65535, lower wins) breaks ties; the most specific prefix wins before priority is considered.

Firewall rules are stateful and evaluated by direction: ingress rules match source, egress rules match destination; implied deny-all ingress and allow-all egress exist.

Firewall rule components: priority, direction, action, targets (tags, service accounts, or all instances), source/destination ranges, protocols/ports.

VPC firewall policies (hierarchical) apply at organization, folder, or project level and are evaluated before VPC firewall rules.

Alias IP ranges let a VM host multiple container/pod ranges; they are not separate NICs and do not consume additional quotas.

Cloud NAT provides outbound-only internet access for private instances; it requires a Cloud Router in the same region and does not accept inbound connections.

Serverless VPC Access connectors (or Direct VPC egress) let Cloud Run and Cloud Functions reach private VPC addresses.

Cloud Load Balancing families: global external Application LB (HTTP/S), regional external proxy Network LB, passthrough Network LB, and internal variants.

Global external Application LB uses a global anycast VIP and URL maps; backend services can reference MIGs, NEGs, or serverless NEGs.

Cloud CDN attaches to a backend service; cache modes are USE_ORIGIN_HEADERS, CACHE_ALL_STATIC, and FORCE_CACHE_ALL.

Cloud DNS managed zones can be public or private; private zones are visible only to authorized VPC networks via DNS peering or forwarding.

DNS forwarding inbound/outbound policies connect on-premises resolvers to Cloud DNS and Cloud DNS to on-premises.

Cloud Armor security policies attach to backend services and support IP allow/deny lists, geo-based rules, and preconfigured WAF rules.

Cloud Router is required for dynamic BGP routing with VPN and Interconnect; it exchanges routes but does not carry data traffic itself.

Health checks determine backend eligibility; global LB health checks are global, and regional LB health checks are regional.

Cloud VPN: HA VPN uses two interfaces and two tunnels for 99.99% SLA; Classic VPN is single-tunnel and legacy.

HA VPN requires a Cloud Router with a regional BGP ASN (private or public) and a peer ASN on the on-premises device.

Dedicated Interconnect provides 10 Gbps or 100 Gbps links at a colocation facility; Partner Interconnect uses a partner for lower bandwidth needs.

Interconnect attachments use VLAN attachments with a Cloud Router for BGP; redundant attachments (two links in different metros) are needed for the 99.99% SLA.

Network Connectivity Center hubs connect VPC spokes, VPN spokes, and Interconnect spokes for transitive routing.

Cross-Cloud Interconnect provides dedicated connectivity to AWS, Azure, and other clouds via supported partner locations.

BGP best-path selection considers local preference, AS path length, and MED; Google Cloud uses MED for active/passive failover.

MTU: Interconnect and VPN support up to 1460 bytes for HA VPN; jumbo frames (8896) are available on Interconnect and some VPC paths.

VPC Flow Logs capture sampled flows at the subnet level; fields include source/destination IP and port, protocol, bytes, and RTT.

Flow log sampling rate and aggregation interval are configurable; logs go to Cloud Logging and can be exported to BigQuery or Pub/Sub.

Firewall Rules Logging records allow/deny decisions per rule and is enabled per firewall rule, not per subnet.

Network Intelligence Center provides Connectivity Tests, Network Topology, Performance Dashboard, and Firewall Insights.

Connectivity Tests simulate a packet path and report where traffic is dropped, including firewall, route, and configuration issues.

Cloud Monitoring network metrics include dropped packets, latency, and VPN tunnel status; uptime checks probe external endpoints.

Cloud Router BGP session status and learned/advertised route counts are key indicators for hybrid connectivity health.

Packet Mirroring copies traffic from instances to a collector for deep inspection; it requires a load balancer frontend and a mirroring policy.

VPC Service Controls create a service perimeter that restricts data access to Google APIs from authorized networks and identities.

Identity-Aware Proxy (IAP) enforces identity and context checks before granting access to web apps and SSH/RDP via TCP forwarding.

Private Service Connect lets consumers reach producer services via private endpoints without peering, avoiding CIDR overlap.

Cloud Armor policies attach to backend services and support rate limiting, adaptive protection, and bot management.

Hierarchical firewall policies at org/folder level take precedence over project-level VPC firewall rules with the same or lower priority.

Firewall rules with target service accounts are preferred over network tags for identity-based, tamper-resistant targeting.

Cloud NAT and Private Google Access remove the need for external IPs, reducing the attack surface.

VPC Flow Logs and Firewall Rules Logging support security analytics; export to BigQuery or SIEM for detection.

SSL/TLS policies on load balancers control minimum TLS version and cipher suites; use modern policies for compliance.