I85PREP
⌘ K
GCP Network Engineer study materials
GCP Network Engineer study resources

GCP Network Engineer: Configure and implement hybrid and multi-cloud network interconnectivity

GCP Network Engineer · Work through your exam, one topic at a time.

All guide sections

Configure and implement hybrid and multi-cloud network interconnectivity

This domain tests connectivity between Google Cloud and on-premises or other clouds. Questions ask you to choose Dedicated Interconnect, Partner Interconnect, HA VPN, or Cross-Cloud Interconnect, and to configure BGP and high availability correctly.

Core rules

  • Dedicated Interconnect provides direct physical connections at a colocation facility. Partner Interconnect uses a supported partner and is useful when you cannot meet Google at a colocation site.
  • HA VPN uses two interfaces, two public IP addresses, two tunnels, and two BGP sessions. It provides a 99.99% SLA when configured with two tunnels in different interfaces and two BGP sessions.
  • Classic VPN is legacy and supports policy-based or route-based routing with lower availability; prefer HA VPN for new designs.
  • Cloud Router runs BGP. Use private ASNs and avoid ASN conflicts. Regional routing advertises only regional subnets; global routing advertises all subnets in the VPC.
  • IPsec MTU is typically 1460 bytes; Cloud Interconnect supports 1500-byte MTU. Plan for fragmentation and MSS clamping.
  • Cross-Cloud Interconnect connects Google Cloud to AWS, Azure, or other clouds through a supported provider.

Worked example

Connect a VPC to on-premises with HA VPN. Create a Cloud Router with ASN 64512 in us-central1. Create an HA VPN gateway with two interfaces. On-premises uses ASN 65001. Create two tunnels, one per interface, and two BGP sessions. Advertise the VPC subnet 10.0.0.0/20 with global routing if on-premises needs all regions. Allow IKE and ESP in firewall rules if a firewall sits between peers. Verify BGP session state and route exchange before testing workloads.

Traps

  • Building HA VPN with one tunnel and expecting 99.99%.
  • Overlapping subnet ranges between VPC and on-premises.
  • Using the same ASN on both sides of a BGP session.
  • Forgetting that VPC peering is not transitive across hybrid links.
  • Assuming Cloud VPN supports multicast.
  • Ignoring MTU and MSS on IPsec tunnels.