An enterprise is designing a secure hybrid networking solution to connect their on-premises data center to a Google Cloud Virtual Private Cloud (VPC) network over the public internet. The architecture must satisfy the following technical requirements: Provide a high-availability, encrypted connection with automated stateful failover. Support dynamic routing and automated route propagation for both IPv4 and IPv6 subnets. Use a single BGP peering session per VPN tunnel to advertise both IPv4 and IPv6 Network Layer Reachability Information (NLRI). How should the Cloud Architect implement this hybrid network connectivity?

Deploy a Cloud HA VPN gateway with IKEv2, configure Cloud Router, and establish Multiprotocol BGP (MP-BGP) sessions using link-local IPv4 addresses configured with IPv6 next-hop attributes.: ### What Cloud HA VPN with Multiprotocol BGP Is **Cloud HA VPN** is Google Cloud's high-availability VPN solution that provides a 99.99% service level agreement (SLA) by utilizing two distinct public IP interfaces across separate gateway hardware. Combined with **Cloud Router**, it enables dynamic route advertisement and stateful route failover between on-premises networks and VPCs using **Border Gateway Protocol (BGP)**. ### How It Meets the Technical Requirements - **Automated Stateful Failover:** Cloud HA VPN establishes dual IPsec tunnels over two separate gateway interfaces with active BGP sessions on Cloud Router. If one tunnel fails, BGP automatically withdraws routes or relies on alternate paths without manual administrative intervention. - **Dual-Stack Route Exchange:** HA VPN natively supports dual-stack (IPv4 and IPv6) traffic when configured with **IKEv2**. - **Single BGP Peering per Tunnel:** By leveraging **Multiprotocol BGP (MP-BGP)** over link-local IPv4 peering addresses (`169.254.x.x`), both IPv4 and IPv6 reachability information are exchanged across the same session, utilizing configured **IPv6 next-hop** addresses for IPv6 packet forwarding. ### Key Advantages and Capabilities - **IKEv2 Requirement:** HA VPN dual-stack configurations mandate IKEv2 for robust security negotiation and cryptographic profiles. - **MP-BGP Efficiency:** Reduces control plane complexity by allowing IPv6 routes to be advertised over existing IPv4 BGP sessions. - **Automated Convergence:** Link-local peering with BGP keepalive and hold timers ensures rapid detection of link failures and seamless traffic rerouting. - **High Bandwidth & Encryption:** Delivers wire-speed IPsec encryption using ESP across redundant tunnels. ### Why This Is Optimal This solution uses native Google Cloud networking services that fully support dual-stack routing over IPsec tunnels without requiring GRE overlays or static routing overhead.

StudyCerts

Ha Vpn Dual Stack Cloud Router Bgp | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Ha Vpn Dual Stack Cloud Router Bgp

Section: Extending to on-premises environments (hybrid networking)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a secure hybrid networking solution to connect their on-premises data center to a Google Cloud Virtual Private Cloud (VPC) network over the public internet. The architecture must satisfy the following technical requirements:

Provide a high-availability, encrypted connection with automated stateful failover.
Support dynamic routing and automated route propagation for both IPv4 and IPv6 subnets.
Use a single BGP peering session per VPN tunnel to advertise both IPv4 and IPv6 Network Layer Reachability Information (NLRI).

How should the Cloud Architect implement this hybrid network connectivity?

Deploy a Cloud HA VPN gateway and configure two separate BGP peering sessions per tunnel, one dedicated to an IPv4 link-local IP and another dedicated to an IPv6 link-local IP without MP-BGP.

Deploy a Cloud HA VPN gateway configured for IKEv1, disable Cloud Router BGP sessions, and define dual-stack static routes pointing to custom route targets.

Deploy a Classic VPN gateway, configure policy-based routing for IPv4 and IPv6 traffic, and configure static routes in the VPC network.

Deploy a Cloud HA VPN gateway with IKEv2, configure Cloud Router, and establish Multiprotocol BGP (MP-BGP) sessions using link-local IPv4 addresses configured with IPv6 next-hop attributes.

Professional Cloud Architect

Ha Vpn Dual Stack Cloud Router Bgp

Related questions