Google Cloud Networking
Google Cloud Networking connects and controls traffic among cloud resources, users, the internet, and external networks. You build it with virtual networks, subnets, routes, firewalls, load balancers, name resolution, and managed connectivity services.
itCloud computing | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Google Cloud Networking
Google Cloud Networking gives your workloads paths to each other and to the systems around them. Those paths carry traffic among virtual machines, Google Kubernetes Engine clusters, serverless workloads, managed services, users, the internet, and external networks.
Start with one mental model:
Addressing identifies an endpoint. Routing selects a path. Firewall policy permits or denies the traffic. A frontend accepts traffic for a service. DNS gives that service a name.
These jobs interact, but they are not interchangeable. A route does not grant access. A firewall rule does not create a path. DNS does not prove that a service is reachable.
The VPC network is the foundation
A Virtual Private Cloud network is a virtual network inside Google Cloud. The VPC network is global. Its subnets are regional. Resources in different regions can use subnets in one VPC network and communicate over Google's network, subject to routes and firewall policy.
A subnet provides an IP address range in one region. When you create a resource, you select a VPC network and a compatible subnet. That choice gives the resource an address and places it within the network's routing and policy context.
Google Cloud offers auto mode and custom mode VPC networks. Auto mode creates subnets automatically. Custom mode starts without subnets, so you choose the regions and address ranges. Google recommends custom mode for most production designs because deliberate address planning prevents later conflicts.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://docs.cloud.google.com/vpc/docs/overview
Supports
- VPC provides networking to virtual machines, Google Kubernetes Engine clusters, and serverless workloads
- A VPC network is global, contains regional subnets, and is logically isolated
- Routes select paths, while forwarding rules direct traffic to Google Cloud resources
- VPC networks support peering, Shared VPC, hybrid connectivity, load balancing, and private access
- https://docs.cloud.google.com/vpc/docs/vpc
Supports
- VPC networks are virtual networks implemented inside Google's production network
- Projects can contain multiple VPC networks
- Auto mode creates subnets automatically and custom mode allows explicit subnet design
- https://docs.cloud.google.com/vpc/docs/subnets
Supports
- Subnets are regional resources with associated address ranges
- Custom mode networks start without subnets and auto mode networks create subnets automatically
- Subnets can support IPv4-only, dual-stack, or IPv6-only interfaces according to stack type
- https://docs.cloud.google.com/vpc/docs/create-modify-vpc-networks
Supports
- Custom mode VPC networks are better suited for most production use cases
- Auto mode networks add subnets and use predetermined IPv4 ranges
- https://docs.cloud.google.com/vpc/docs/routes
Supports
- Routes define paths from virtual machine instances to destinations and pair a destination prefix with a next hop
- VPC routes include subnet, default, static, and dynamic route types
- Cloud Router manages dynamic routes from Border Gateway Protocol information
- Route selection considers applicability, route type, and the most specific static or dynamic destination
- https://docs.cloud.google.com/firewall/docs/firewalls
Supports
- VPC firewall rules include direction, priority, action, target, filters, protocol, ports, and optional logging
- The matching rule with the lowest numerical priority value takes effect
- VPC firewall rules are stateful
- Implied rules deny ingress and allow egress
- https://docs.cloud.google.com/load-balancing/docs/load-balancing-overview
Supports
- Cloud Load Balancing distributes traffic across application backends
- The portfolio includes Application and Network Load Balancers
- Load balancers have internal and external, global and regional, and proxy and passthrough choices
- Health checks and frontend, backend, and forwarding resources participate in traffic delivery
- https://docs.cloud.google.com/nat/docs/overview
Supports
- Cloud NAT provides managed network address translation for supported outbound traffic
- Cloud NAT supports established inbound response traffic but not unsolicited inbound connections
- Cloud NAT is a distributed managed service rather than a proxy virtual machine
- Cloud NAT gateways are configured regionally for selected subnets
- https://docs.cloud.google.com/dns/docs/overview
Supports
- Cloud DNS manages public and private zones and records
- Private zones are visible to authorized VPC networks
- Cloud DNS supports inbound and outbound forwarding for private name resolution
- Time to live controls resolver caching after record changes
- https://docs.cloud.google.com/vpc/docs/private-google-access
Supports
- Eligible virtual machine interfaces without external addresses can reach supported Google APIs through Private Google Access
- Private Google Access is enabled per subnet
- https://docs.cloud.google.com/vpc/docs/private-access-options
Supports
- Private Service Connect, Private Google Access, private services access, and VPC Network Peering solve different private connectivity patterns
- The suitable private access option depends on the client and service type
- https://docs.cloud.google.com/vpc/docs/shared-vpc
Supports
- Shared VPC lets eligible resources in attached service projects use a host project's VPC network
- Shared VPC supports centralized network control with delegated workload administration
- https://docs.cloud.google.com/network-connectivity/docs/how-to/choose-product
Supports
- Cloud VPN and Cloud Interconnect connect VPC networks with on-premises or other cloud networks
- Cloud Router uses Border Gateway Protocol for dynamic routing with supported connectivity products
- Network Connectivity Center uses a hub-and-spoke connectivity model
- https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/overview
Supports
- Cloud VPN uses Internet Protocol Security to connect private networks
- Cloud VPN is site-to-site connectivity rather than client dial-in or public internet routing
- https://docs.cloud.google.com/vpc/docs/flow-logs
Supports
- VPC Flow Logs samples supported packets and aggregates flow records
- Flow records support monitoring, forensics, security analysis, and expense optimization
- https://docs.cloud.google.com/network-intelligence-center/docs/connectivity-tests/concepts/overview
Supports
- Connectivity Tests analyzes supported Google Cloud configuration for reachability
- Configuration analysis does not guarantee live data-plane or application success
- https://docs.cloud.google.com/network-intelligence-center/docs/network-analyzer/overview
Supports
- Network Analyzer detects network misconfigurations and suboptimal configurations
- Insights cover topology, firewall rules, routes, dependencies, and service connectivity