Professional Cloud Network Engineer
The dynamic routing mode of a Virtual Private Cloud (VPC) network determines how Cloud Router instances propagate routes learned via Border Gateway Protocol (BGP) to VPC subnetworks and advertise VPC subnets to external networks. Every VPC network operates in either regional or global dynamic routing mode, which sets the routing behavior for all Cloud Routers inside that network. This setting controls the geographic scope of route sharing, directly affecting hybrid connectivity, multi-region resiliency, and path selection across Google Cloud regions.
Regional dynamic routing mode restricts the exchange and programming of dynamic routes to resources located strictly within the same Google Cloud region as the Cloud Router. In this mode, a Cloud Router shares only the subnet routes from its local region with the external BGP peer router. When the Cloud Router receives learned BGP routes from an external network or Cloud VPN tunnel, it installs those custom dynamic routes solely for subnets located in that specific region. Workloads residing in other Google Cloud regions do not receive these learned routes and cannot use the local hybrid connection for transit.
Global dynamic routing mode extends route exchange across the entire VPC network, allowing Cloud Routers to propagate and learn dynamic routes across all regions. In this mode, each Cloud Router advertises subnet IP address ranges from every region in the VPC network to the external peer network. Concurrently, BGP routes learned by a Cloud Router in one region are programmed into the route tables of subnets across all regions. Cloud Router applies predetermined path preferences based on regional proximity, directing traffic across Google's global backbone network to exit through the Cloud Router closest to the destination.
Architectural decisions between dynamic routing modes balance multi-region availability requirements against regional data isolation. Choose regional dynamic routing when hybrid traffic must remain strictly localized to prevent cross-region transit costs and maintain isolated failure domains between regions. Choose global dynamic routing when building multi-region architectures, active-active or active-passive inter-domain redundancy, or centralized transit hub VPC networks. Global dynamic routing ensures that if a local hybrid connection fails, traffic from that region can automatically fail over to a functional Cloud Router located in an alternate region.
Border Gateway Protocol (BGP) policies and traffic engineering in Google Cloud involve configuring Cloud Router to control how routes are advertised, learned, and selected across hybrid connections. These configurations allow administrators to manage path selection, implement failover strategies, and distribute traffic across multiple hybrid links. By managing routing attributes, networks can satisfy specific performance, cost, and availability requirements.
A BGP session establishes a dynamic routing relationship between a Cloud Router and an external peer router over Cloud Interconnect, Cloud VPN, or Router appliance instances. Each BGP session is tied to the specific connectivity resource that uses the Cloud Router and cannot be shared across different network products. In regional dynamic routing mode, the Cloud Router advertises only local regional subnets to the peer. In global dynamic routing mode, Cloud Router advertises all VPC subnets across all regions, applying a Multi-Exit Discriminator (MED) penalty equal to 200 plus the round-trip time in milliseconds between regions to prefer local paths.
Custom route advertisements allow administrators to specify exactly which IP prefixes a Cloud Router announces to peer networks instead of relying on default advertisements. By default, Cloud Router automatically advertises all VPC subnets matching the active dynamic routing mode. Custom route advertisements override or expand this behavior to announce specific public or private IP ranges, filter out internal prefixes, or modify the base priority of advertised routes. This mechanism provides precise control over how external networks reach Google Cloud resources and prevents the unintended exposure of internal subnets.
Multi-Exit Discriminators (MED) and AS path prepending are BGP attributes used on Cloud Router to steer ingress traffic across multiple hybrid connections. Multi-Exit Discriminators (MED) act as a priority metric where external peers prefer routes with lower MED values for inbound traffic to Google Cloud. AS path prepending artificially lengthens the autonomous system path by repeating the local Autonomous System Number (ASN), making a route look less attractive to external peers. These two mechanisms enable active-passive failover by directing normal traffic to a primary low-metric path, or active-active load sharing by advertising matching path metrics across redundant links.
Hybrid connectivity configurations impose specific structural requirements on Cloud Routers when integrating different transport types. When deploying High Availability (HA) VPN over Cloud Interconnect, network designs require two distinct Cloud Routers: one dedicated to Cloud Interconnect to forward only encrypted traffic to the VLAN attachment, and a second regular Cloud Router to establish BGP sessions for the HA VPN tunnels. For Partner Interconnect deployments, Cloud Router must use ASN 16550 for all BGP sessions. A Cloud Router configured with ASN 16550 for Partner Interconnect can only manage BGP sessions for other Partner Interconnect attachments, with an exception allowing Dedicated Interconnect attachments when ASN 16550 is acceptable.
Dynamic route exchange in complex multi-VPC topologies coordinates route distribution across multiple VPC networks and on-premises environments using Cloud Router, HA VPN, Cloud Interconnect, and Network Connectivity Center. These architectures establish scalable, multi-region connectivity while preventing network loops, quota limits, and unexpected cross-region data transfer charges. Administrators balance isolation against transit reachability when selecting dynamic routing designs for enterprise scale.
High Availability (HA) VPN gateways use BGP to exchange dynamic routes across dual tunnels connecting VPC networks or external environments. In an active-active setup, both tunnels forward traffic concurrently to aggregate bandwidth, though a tunnel failure can drop packets if the remaining link lacks sufficient capacity. In an active-passive setup, only the primary tunnel carries traffic while the secondary tunnel remains on standby, maintaining predictable throughput during failover. For a single HA VPN gateway, active-passive routing is recommended for predictable operation, whereas active-passive across multiple gateways should be avoided because standby tunnels will not activate until all active tunnels across all gateways fail.
Connecting two VPC networks directly with HA VPN provides secure transit and dynamic route exchange between distinct cloud environments. To obtain the 99.99% availability Service Level Agreement (SLA), both HA VPN gateways must reside in the same region, with Tunnel 0 linking interface 0 and Tunnel 1 linking interface 1 between the gateways. Deploying HA VPN gateways in different regions reduces the availability SLA to 99.9%. When interconnecting three or more VPC networks, administrators deploy a hub-and-spoke transit topology that connects each spoke VPC to a central hub VPC through dedicated HA VPN gateways.
Network Connectivity Center provides a centralized hub-and-spoke control model that automates dynamic route exchange across VPC networks, hybrid connections, and third-party router appliances. The dynamic routing mode of the hub VPC network governs how learned routes propagate from hybrid spokes to attached VPC spokes. If the hub VPC uses regional dynamic routing, hybrid spoke routes reach only VPC spokes in that local region; if the hub VPC uses global dynamic routing, hybrid routes reach VPC spokes across all regions. Spoke administrators enable subnet route propagation by setting the includeImportRanges field to ALL_IPV4_RANGES or by configuring custom route advertisements on the hybrid Cloud Routers.
Multi-VPC architectures often employ a dedicated transit VPC network connected via Network Connectivity Center to avoid building a complex full mesh of point-to-point links. In this model, external links such as Cloud Interconnect or Cloud VPN terminate inside a central transit VPC that acts as a hub for multiple workload spoke VPCs. A transit hub architecture can also host shared security infrastructure, such as centralized firewalls and inspection proxies, enabling any-to-any communication between spokes. This centralized design consolidates external dynamic routing policies, simplifies peering topologies, and minimizes administrative overhead.
Managing dynamic routes across complex topologies requires proactive safeguards against routing loops, resource limits, and inter-region costs:
Regional dynamic routing restricts Cloud Router route advertisements and learned BGP route installations strictly to the subnets inside the local region. Global dynamic routing allows Cloud Routers to advertise all VPC subnets across all regions and installs learned routes into subnets network-wide using metric penalties to favor local paths.
Choose an active-passive configuration when using a single HA VPN gateway to ensure predictable bandwidth and smooth failover without traffic drops. Avoid using active-passive routing across multiple gateways, because backup tunnels on any gateway will not pass traffic until every active tunnel across all gateways has failed.
Cloud Router applies a Multi-Exit Discriminator (MED) penalty equal to 200 plus the inter-region round-trip time in milliseconds to routes learned outside the destination's local region. This added metric ensures that traffic automatically prefers local Cloud Interconnect or Cloud VPN paths before falling back to cross-region paths.
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts