High Availability Cloud Virtual Private Network (Cloud HA VPN) provides secure, encrypted site-to-site connectivity between Google Cloud Virtual Private Cloud (VPC) networks, on-premises data centers, and external clouds over public networks. A complete deployment pairs a regional Cloud HA VPN gateway with dynamic Border Gateway Protocol (BGP) routing managed by a Cloud Router and an external peer VPN gateway resource. This architecture establishes redundant IPsec tunnels across distinct interfaces to deliver an automated failover path and a 99.99% service level agreement (SLA).
A Cloud HA VPN gateway uses dual physical interfaces to eliminate single points of failure across public IPsec connections. To qualify for the 99.99% SLA, network administrators must configure two active VPN tunnels so that interface 0 and interface 1 on the Cloud HA VPN gateway connect to matching peer gateway interfaces. When provisioning the gateway, the stackType attribute is configured as either IPV4_ONLY by default or IPV4_IPV6. Internet Key Exchange version 2 (IKEv2) is the standard negotiation protocol and is mandatory when routing IPv6 traffic over the tunnels.
An external peer VPN gateway resource represents the physical routers, firewalls, or third-party cloud gateways residing outside Google Cloud. The configuration assigns a specific redundancyType based on how many public IP addresses the external peer system presents:
StudyCerts
StudyCertsSINGLE_IP_INTERNALLY_REDUNDANT applies to a single peer device that uses one external IP address on interface 0.TWO_IPS_REDUNDANCY applies to a dual-interface peer device or two separate single-interface peer devices mapped to interfaces 0 and 1.FOUR_IPS_REDUNDANCY applies to configurations requiring four external IP interfaces (assigned to interface IDs 0, 1, 2, and 3), such as connections terminating on Amazon Web Services (AWS).All interface IDs and public IP addresses must match precisely between the Cloud HA VPN gateway and the external peer VPN gateway. If the interface mapping or peer IP assignments do not align, the IPsec tunnels fail to establish.
A Cloud Router automates the dynamic exchange of network routes between a VPC network and external peer networks over IPsec VPN tunnels. Each regional Cloud Router uses an autonomous system number (Google ASN) chosen from private ranges 64512 to 65534 or 4200000000 to 4294967294. Once set, the Google ASN applies to every BGP session on that router and cannot be changed later. Each VPN tunnel maps to a dedicated Cloud Router interface with a link-local /30 subnet, and traffic priority is tuned by adjusting the advertised_route_priority attribute to define primary and backup paths.
Network Virtual Appliances (NVAs) provide centralized security inspection and traffic filtering for packets moving between branch offices, data centers, and VPC networks. In a transit architecture, NVAs operating in single-network interface (single-NIC mode) deploy inside a central transit VPC that connects to spoke VPCs using VPC Network Peering or Cloud HA VPN. Internal TCP/UDP Load Balancers sit in front of the NVAs to provide health checking, automatic scaling, and symmetric flow hashing for stateful traffic inspection. Policy-based routing directs traffic into the NVA security layer by evaluating packet metadata such as source and destination IP ranges.
Cloud Interconnect delivers enterprise-grade private connectivity between on-premises networks and Google Cloud without traversing the public internet. Dedicated Interconnect provides physical fiber connections directly into Google colocation facilities, while Partner Interconnect routes traffic through a certified service provider's network. Organizations select Dedicated Interconnect for high-bandwidth private circuits or Partner Interconnect when they cannot physically colocate with Google or require smaller bandwidth allocations.
A Cloud Interconnect link connects to a VPC network through a VLAN attachment, also known as an interconnect attachment. The attachment provisions a dedicated VLAN and a pair of link-local IP addresses shared between a Cloud Router interface and the on-premises router subinterface. The Cloud Router and on-premises router establish a BGP session across these link-local addresses. On-premises route advertisements become custom dynamic routes inside the VPC, while the Cloud Router advertises VPC subnet ranges back to the on-premises network.
VLAN attachments support configurable maximum transmission unit (MTU) sizes of 1440, 1460, 1500, or 8896 bytes. The 8896-byte jumbo frame setting is available only on unencrypted IPv4 and IPv6 attachments. For reliable packet delivery, all VLAN attachments associated with a VPC network must share the same MTU, and the VPC network MTU should match this value. Google API Client Library requests always enforce a 1440-byte MTU regardless of the attachment configuration.
Provisioning Dedicated Interconnect begins by ordering physical ports, receiving a Letter of Authorization (LOA), and coordinating circuit cross-connects with the colocation vendor. Once Google tests and verifies the physical circuit, administrators create VLAN attachments to begin routing production traffic. Dedicated Interconnect uses a fixed monthly port fee for outbound data transfers. Pricing differentiates between local connections, where the attachment metropolitan area matches the destination Google Cloud region, and remote connections, where the metro area and destination region differ.
Achieving an official availability SLA requires deploying redundant Interconnect connections across distinct failure domains. A 99.9% SLA requires two connections deployed across two separate edge availability domains within a single metropolitan area. A mission-critical 99.99% SLA requires four connections deployed across two distinct Google Cloud regions, with each regional pair using separate edge availability domains in separate metropolitan areas. Organizations can use Cloud Interconnect groups to organize resources and automatically validate their topology against 99.9% or 99.99% architectural standards.
Cloud Interconnect traffic is unencrypted by default, requiring additional security configurations for regulated or sensitive workloads. Organizations can enable MACsec for Cloud Interconnect to provide line-rate, Layer 2 hardware encryption between the on-premises router and Google's edge router. Alternatively, teams can deploy HA VPN over Cloud Interconnect, which establishes an encrypted IPsec tunnel over the private VLAN attachments and uses a dedicated Cloud Router for the encrypted routing tier. Organization policies can also restrict which VPC networks are authorized to attach to Cloud Interconnect connections.
Cross-Cloud Interconnect provisions direct, high-bandwidth physical connections between Google Cloud and other cloud providers such as AWS, Microsoft Azure, Oracle Cloud Infrastructure, or Alibaba Cloud. Google manages the physical cabling between cloud edge ports, while customers provision and pay for the ports on both sides under a shared responsibility model. Google's SLA covers network availability up to the provider hand-off point. High availability designs mirror standard Interconnect requirements, using redundant links across distinct metropolitan areas and edge domains to achieve 99.9% or 99.99% reliability.
Network Connectivity Center (NCC) manages global wide-area network routing by linking VPC networks, branch offices, and external clouds through a centralized hub-and-spoke model. The service supports VPC spokes, hybrid spokes, and Router appliance spokes to integrate third-party Software-Defined WAN (SD-WAN) virtual appliances directly into Google Cloud's network fabric. This hub architecture simplifies complex multi-cloud topologies while supporting centralized traffic inspection and consistent route propagation.
Router appliances are third-party NVAs running on Compute Engine virtual machines that exchange dynamic BGP routes with a regional Cloud Router. Network Connectivity Center uses Router appliance instances to connect a VPC network to external networks or to connect two distinct VPC networks using dynamic routing. The Cloud Router manages the BGP peering sessions with the Router appliance instances, automatically learning and advertising network prefixes. To join the transit architecture, Router appliance virtual machines are assigned directly to an NCC hybrid spoke.
A hybrid spoke in Network Connectivity Center connects external on-premises or branch networks to an NCC hub using Router appliances, Cloud Interconnect VLAN attachments, or Cloud HA VPN tunnels. Multiple hybrid and VPC spokes can attach to a single hub, allowing organizations to scale multi-site branch topologies across regions. VPC spokes can access on-premises networks through hybrid spokes residing in separate routing VPC networks. When a hybrid spoke has site-to-site data transfer enabled, the Cloud Router re-advertises learned prefixes to all other hybrid spokes attached to that hub.
An SD-WAN NVA can use up to 8 virtual network interfaces (multi-NIC mode) to connect multiple network segments while preventing overlapping IP addresses between subnets. Deploying a multi-NIC appliance across distinct VPC networks requires valid Identity and Access Management (IAM) permissions in every target network. This multi-NIC design allows an NVA to sit directly in the traffic path between VPC networks and private branch environments, enforcing centralized security inspection on cross-boundary traffic flows.
Network Connectivity Center relies on Cloud Router to establish External BGP (eBGP) sessions with peer routing devices. All non-Google routers belonging to a single spoke must use the same Autonomous System Number (ASN) when advertising prefixes to Cloud Router. Different spokes attached to the same hub must use distinct ASNs to prevent routing conflicts and route dropping. Network Connectivity Center does not support BGP communities, and all routes introduced by hybrid spokes are installed as dynamic routes that follow standard VPC routing precedence.
Site-to-site data transfer enables external branch offices and data centers to exchange IPv4 traffic with each other across Google's private backbone network. When data transfer is enabled on multiple hybrid spokes associated with the same hub, Cloud Router re-advertises BGP prefixes learned from one branch spoke to all other hybrid spokes on that hub. All hybrid spokes participating in data transfer must reference Router appliances, VPN tunnels, or VLAN attachments residing in a single VPC network. This capability creates a global mesh between remote sites, such as offices in New York, Sydney, and Tokyo, and supports IPv4 traffic exclusively.
Network Connectivity Center enforces strict IP version rules depending on the spoke configuration:
When data transfer is enabled on hybrid spokes, all participating resources and data paths are restricted to IPv4.
Cloud Router operates purely in the control plane to install dynamic routes in the software-defined network, never carrying data plane traffic directly. When configured for regional dynamic routing, the Cloud Router advertises and learns subnets located only in its local region. When configured for global dynamic routing, the Cloud Router advertises subnets across all regions in the VPC network, but applies a distance penalty (200 plus the inter-region round-trip time in milliseconds) to prioritize local interconnects and maintain symmetric regional routing paths.
0 and interface 1 to matching peer gateway interfaces.Choose Dedicated Interconnect when your organization can physically colocate with Google in a supported facility and requires high-bandwidth circuits with predictable, fixed-port pricing. Choose Partner Interconnect when your infrastructure cannot colocate directly with Google or when your bandwidth requirements are smaller than the standard physical circuit sizes.
MACsec provides line-rate Layer 2 hardware encryption directly on the physical link between your router and Google's edge. In contrast, HA VPN over Cloud Interconnect establishes an IPsec encrypted tunnel inside the VLAN attachment, requiring a separate Cloud Router to manage the encrypted routing tier.
Regional dynamic routing restricts Cloud Router to learning and advertising subnets within its local region only. Global dynamic routing advertises all subnets across the entire VPC network, adding a metric penalty of 200 plus latency to routes learned outside the local region to keep traffic on local paths whenever possible.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills