Professional Cloud Network Engineer
BGP session authentication secures the connection between a Cloud Router and an external router using a shared MD5 key configured on both ends. This prevents unauthorized routers from establishing a session and injecting false routes. Link-local addresses are automatically assigned from the 169.254.0.0/16 range to each end of a Cloud Interconnect VLAN attachment for BGP peering. These addresses are not routable on the public internet, providing isolated communication for the BGP control plane between Google's cloudRouterIpAddress and your customerRouterIpAddress.
BGP attributes are values exchanged between routers to influence path selection. The Autonomous System Number (ASN) identifies a routing domain; a single Cloud Router must use the same local ASN across all its sessions. For Partner Interconnect, Cloud Router must use the fixed Google ASN 16550. The Multi-Exit Discriminator (MED) attribute influences inbound traffic flow, where a lower MED value indicates a more preferred path into your network. The Local Preference attribute controls outbound traffic flow within your own autonomous system, where a higher value indicates a more preferred exit path.
A BGP session on a Cloud Router is bound to a single connectivity resource like a VLAN attachment or VPN tunnel. Establishing a session is a two-step process: first create a router interface with a link-local IP, then bind a BGP peer to that interface. The session uses route priority (default 100) to influence path selection. Setting identical priorities across sessions enables active-active routing with traffic balanced equally. Setting a lower priority on a primary session and a higher one on a secondary enables active-standby routing, where the secondary path acts as a backup.
Community strings are BGP attributes that tag routes with metadata for automated policy application. In Google Cloud, you can use community strings with Cloud Router to mark routes advertised to on-premises networks, allowing downstream routers to make decisions based on those tags. For comprehensive traffic engineering across hybrid connections like Cloud VPN and Interconnect, you combine MED, Local Preference, and community strings to control both inbound and outbound flows based on performance, cost, or reliability requirements.
Bidirectional Forwarding Detection (BFD) is a UDP-based protocol that provides fast link-failure detection for BGP sessions. In Google Cloud, BFD operates in single-hop, asynchronous mode with control-only packets and is supported only on Cloud Interconnect (Dedicated or Partner) VLAN attachments using Dataplane version 2. It is not supported for HA VPN tunnels. BFD session initialization supports three modes: ACTIVE (local router initiates), PASSIVE (waits for peer), and DISABLED.
BFD detection speed is controlled by configurable timers negotiated between peers. The minimum transmit interval and minimum receive interval define packet rates, and the detection multiplier defines how many consecutive missed packets declare a path down. The actual transmission interval is the larger value between the local transmit interval and the peer's receive interval. Default settings (1000 ms interval, multiplier of 5) detect failures in about 5 seconds, much faster than the default 60-second BGP hold timer. Upon failure, BFD alerts the BGP process to reconverge. Cloud Router also uses a BFD dampening penalty system to suppress notifications during repeated session flaps, preventing routing instability.
Custom learned routes are user-defined IP prefixes configured directly on a Cloud Router BGP session. They dynamically inject external network destinations (like on-premises CIDR ranges) into the VPC routing table without requiring the remote BGP peer to advertise them. Each route is assigned a Multi-Exit Discriminator (MED) priority metric (default 100, lower is preferred). A single BGP session supports a maximum of 10 custom learned routes. Local VPC subnets always take precedence; any custom learned route that matches or is more specific than a subnet is ignored.
Custom advertisement mode in Cloud Router controls which IP prefixes are advertised to external networks. Unlike the default mode (which advertises only local VPC subnets), custom mode allows advertising external IP ranges or IPs from other peered VPCs. Advertisement mode can be set at the router level (applies to all sessions) or at the individual BGP session level. A critical rule is that if any custom advertised route is specified on a BGP session, that session advertises only those custom prefixes and ignores all routes from the router-level configuration. A maximum of 200 custom advertised routes are allowed per BGP session.
Path selection in hybrid networks uses the MED attribute. For active-active configurations, redundant tunnels use equal MED values and traffic is balanced using equal-cost multipath (ECMP) routing. For active-passive, the primary tunnel advertises a lower MED. Failover occurs when a tunnel becomes unhealthy; the Cloud Router withdraws the associated routes, which can take 40–60 seconds. To prevent asymmetric routing and loops, MED values must be set symmetrically on both sides of the connection. For complex topologies with multiple gateways, active-active designs are preferred over active-passive.
The VPC network's best path selection algorithm determines how multiple routes to the same destination are prioritized. Google Cloud offers two modes: legacy and standard. The standard mode uses a more deterministic and comprehensive set of criteria for comparing routes, which is the recommended setting for new networks. The legacy mode is maintained for backward compatibility with existing deployments. The choice between them affects the order in which routes are evaluated, potentially changing the active path for traffic in networks with complex, overlapping route advertisements.
MED is an attribute advertised to neighboring networks to influence which path they use to send traffic into your network (lower MED is preferred). Local Preference is an attribute used within your own autonomous system to decide which path to use to send traffic out to external destinations (higher Local Preference is preferred).
Use custom learned routes when you need to inject specific external IP ranges (like a partner network) into your VPC routing table without being able to configure the remote BGP peer to advertise those prefixes to you.
BFD provides rapid, sub-second to few-second detection of link failures by continuously exchanging control packets. It alerts the BGP process immediately upon failure, triggering reconvergence without waiting for the much longer BGP hold timer (default 60 seconds) to expire.
Configuring any custom advertised route on a BGP session changes that session's behavior to advertise only the specified custom prefixes. It will not advertise local VPC subnets or any prefixes defined at the Cloud Router's global custom advertisement configuration for that session.
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts