GCP Cloud : Day 08 - GCP Advanced Networking & Enterprise Connectivity Patterns

In enterprise cloud architectures, networking is the backbone for security, performance, scalability, and hybrid integration. Building upon foundational VPC concepts, this guide dives deep into advanced routing, security policies, private access mechanisms, hybrid interconnectivity, and battle-tested enterprise architectures.

1. Network Security & Firewall Architecture

GCP provides a distributed, software-defined firewall system implemented at the hypervisor level (Andromeda). There is no single appliance bottleneck—every VM packet is filtered before leaving or entering the virtual NIC.

1.1 Firewall Hierarchy & Types

GCP has evolved from legacy VPC firewall rules to a unified Hierarchical Firewall Policy model:

1.2 Target Filtering: Network Tags vs Service Accounts vs Secure Tags

In GCP, security grouping and micro-segmentation are achieved through three primary mechanisms:

[!TIP] Production Best Practice: Never use plain Network Tags for critical security boundaries in production. Use Service Accounts or Secure Tags to prevent privilege escalation by VM administrators.

2. GCP Routing & Route Hierarchy

GCP VPC routing is global, distributed, and software-defined.

2.1 Types of Routes

1. Subnet Routes (System-Generated):
   • Automatically created for every subnet CIDR in the VPC.
   • Highest priority; cannot be overridden by custom static or dynamic routes.
2. Default Route (0.0.0.0/0):
   • Points to the default-internet-gateway. Enables outbound internet access for VMs with public IPs.
3. Custom Static Routes:
   • User-defined next hops: Gateway, VM Instance IP, Internal Load Balancer (ILB), or VPN Tunnel.
4. Policy-Based Routes (PBR):
   • Route traffic based on attributes other than destination IP (e.g., protocol, source IP, destination port). Commonly used to send specific egress traffic to Next-Generation Firewalls (NGFW).
5. Dynamic Routes (BGP):
   • Learned automatically via Cloud Router running BGP over Cloud VPN or Cloud Interconnect.

3. Private Google Access (PGA)

Allows VM instances that only have private internal IP addresses (no external/public IP) to securely access Google APIs and Services (e.g., Cloud Storage, BigQuery, Secret Manager) without crossing the public internet.

3.1 PGA Requirements & DNS Endpoints

• Subnet Level: Enable privateIpGoogleAccess = true on the subnet.
• Route Requirement: A default route (0.0.0.0/0) or custom route to default-internet-gateway is required (traffic stays on Google’s internal backbone, never traverses public internet).
• DNS Domains:

4. Cloud NAT (Network Address Translation)

Cloud NAT is a managed, software-defined, distributed NAT solution. It does not rely on proxy VMs or single points of failure.

4.1 Cloud NAT Flavors

1. Public Cloud NAT:
   • Translates internal IPs to external Google-managed or user-reserved static public IPs.
   • Outbound-only: Allows private VMs to download updates, pull container images, or call third-party APIs.
   • Inbound connections are strictly blocked.
2. Private Cloud NAT (Inter-VPC / Hybrid NAT):
   • Translates internal RFC 1918 IPs to other internal RFC 1918 IPs.
   • Solves overlapping IP address space during M&A (Mergers & Acquisitions) or cross-VPC communication.

[!IMPORTANT] Port Exhaustion Mitigation: Configure minimum ports allocated per VM instance (default is 64) and enable dynamic port allocation to avoid packet drops under heavy concurrent egress traffic.

5. Private Service Connect (PSC) vs Private Services Access (PSA)

When connecting VPCs to Managed Services (Cloud SQL, Memorystore, Vertex AI, or Third-Party SaaS), Google provides two main technologies:

5.1 Detailed Comparison: PGA vs PSA vs PSC

6. Hybrid Connectivity: Cloud VPN (Classic vs HA VPN)

Cloud VPN securely connects your on-premises network or other cloud providers (AWS, Azure) to your GCP VPC via an IPsec VPN tunnel.

6.1 Classic VPN vs HA VPN

[!NOTE] To qualify for the 99.99% SLA, you must configure two tunnels: either to two separate peer VPN gateways, or to a single peer gateway with two separate public IP interfaces in different availability zones.

7. Hybrid Connectivity: Cloud Interconnect

For high-bandwidth, mission-critical enterprise workloads, Cloud Interconnect provides enterprise-grade, low-latency, private physical connections that bypass the public internet entirely.

7.1 Interconnect Options Comparison

7.2 Interconnect SLA Topologies

• 99.9% SLA (Production): Requires 2 VLAN attachments in 1 Metropolitan area across 2 separate Edge Routers (EADs).
• 99.99% SLA (Mission Critical): Requires 4 VLAN attachments across 2 separate Metropolitan areas (Dual-region / Dual-location).

8. Real-World Enterprise Connectivity Patterns

Pattern 1: Hub-and-Spoke with Centralized Next-Gen Firewall (NGFW) Inspection

For regulated industries (Banking, Healthcare, Defense), all East-West (Spoke-to-Spoke) and North-South (Internet Ingress/Egress) traffic must pass through centralized firewall appliances (Palo Alto, Fortinet, Check Point).

Pattern 2: Shared VPC vs VPC Network Peering vs Network Connectivity Center (NCC)

Enterprise multi-project design options:

Pattern 3: Hybrid DNS Resolution Architecture

Enterprise DNS requires bidirectional resolution between on-premises Active Directory / BIND DNS and GCP Cloud DNS.

• Inbound DNS Query Flow (On-Prem $\to$ GCP): Create an Inbound Server Policy in Cloud DNS. GCP provides a private entry point IP in the VPC. On-prem DNS server forwards *.gcp.internal queries to this IP.
• Outbound DNS Query Flow (GCP $\to$ On-Prem): Create a DNS Forwarding Zone in Cloud DNS for *.corp.local. Point destination to on-premises DNS server IPs (172.16.1.10).

9. Hands-On CLI Cheat Sheet

Configure Cloud NAT

# 1. Create a Cloud Router in the region
gcloud compute routers create cr-nat-router \
    --network=prod-vpc \
    --region=us-central1

# 2. Create the Cloud NAT gateway
gcloud compute routers nats create nat-gw-us-central1 \
    --router=cr-nat-router \
    --region=us-central1 \
    --auto-allocate-nat-external-ips \
    --nat-all-subnet-ip-ranges \
    --enable-logging

Enable Private Google Access on Subnet

gcloud compute networks subnets update prod-app-subnet \
    --region=us-central1 \
    --enable-private-ip-google-access

Deploy High Availability (HA) VPN Gateway

# 1. Create HA VPN Gateway (allocates two public interfaces automatically)
gcloud compute vpn-gateways create ha-vpn-gw \
    --network=prod-vpc \
    --region=us-central1

# 2. Create Cloud Router for BGP route exchange
gcloud compute routers create cr-vpn-router \
    --network=prod-vpc \
    --region=us-central1 \
    --asn=65001

10. Summary & Key Architectural Takeaways

┌────────────────────────────────────────────────────────────────────────┐
│                      GCP ADVANCED NETWORKING MATRIX                    │
├───────────────────────┬────────────────────────────────────────────────┤
│ Requirement           │ Recommended Solution                           │
├───────────────────────┼────────────────────────────────────────────────┤
│ Private VM to GCS/BQ  │ Private Google Access (PGA)                    │
│ Private VM to Internet│ Cloud NAT (Outbound Only)                      │
│ Private VM to CloudSQL│ Private Service Connect (PSC)                  │
│ Hybrid 99.99% SLA VPN │ HA VPN (Dual Tunnels + BGP Cloud Router)       │
│ Hybrid 10G/100G Link  │ Dedicated / Partner Cloud Interconnect         │
│ Cross-Project Network │ Shared VPC (Host + Service Projects)          │
│ Multi-VPC Transit Hub │ Network Connectivity Center (NCC) / Transit Hub│
│ Centralized Security  │ Hierarchical Firewall Policies + NGFW Appliance│
└───────────────────────┴────────────────────────────────────────────────┘

Day 08 Tasks & Hands-On Exercises

• Task 1: Create a custom VPC with a private subnet (no public IPs) and verify internet access is blocked.
• Task 2: Attach a Cloud NAT Gateway and verify that the private VM can successfully execute curl -I https://google.com and run apt-get update.
• Task 3: Enable Private Google Access (PGA) on the subnet and verify private access to Cloud Storage via gsutil ls without leaving the Google backbone.
• Task 4: Create a Private Service Connect (PSC) endpoint to access Google APIs or a managed service instance.
• Task 5: (Optional/Lab) Configure an HA VPN tunnel pair between two VPCs using Cloud Router and BGP session peering.