VPC Flow Logs records network flow samples across Virtual Private Cloud (VPC) networks to help engineers monitor network traffic, perform security forensics, and optimize network costs. Flow logs capture traffic associated with virtual machine (VM) instances, Google Kubernetes Engine nodes, Cloud Run Direct VPC egress, and Cloud Interconnect or Cloud VPN VLAN attachments. The logging process begins with packet sampling, aggregates those packets over a configurable interval between 5 seconds and 15 minutes, and then applies an optional secondary sampling rate. For outbound traffic, packets are sampled before egress firewall rules evaluate them, which allows administrators to log denied egress attempts. In contrast, inbound traffic is sampled after ingress firewall rules evaluate them, meaning denied ingress traffic is never recorded in VPC Flow Logs.
Cloud NAT provides managed network address translation and exports operational logs to Cloud Logging to assist with capacity planning and connection troubleshooting. Administrators can configure Cloud NAT logging to record successful address translations, connection drop errors caused by port exhaustion, or both events simultaneously. To prevent excessive logging traffic, each VM instance operates under a rate limit for log generation that scales in proportion to its assigned vCPU count. In a Shared VPC architecture, users must hold the roles/monitoring.viewer role in the service project to view VM-level metrics in Cloud Monitoring, whereas viewing NAT gateway-level metrics requires the same role in the host project.
Cloud DNS query logging records name resolution requests directly to Cloud Logging to help diagnose name resolution failures and audit domain policy enforcement. Network administrators configure query logging on DNS zones to capture client lookups, response codes, and resolution errors. To support long-term analysis, centralized auditing, or external SIEM ingestion, teams create Cloud Logging sinks to export telemetry to BigQuery, Pub/Sub, or Cloud Storage. Aggregated sinks configured at the organization level can automatically capture and route DNS and network logs across all underlying folders, projects, and billing accounts into a single destination.
Cloud Next Generation Firewall (Cloud NGFW) provides distributed stateful protection and Layer 7 packet inspection across organization, folder, and VPC network hierarchies. Firewall rules are enforced immediately at the virtual interface layer, securing VM instances even while they are still booting. Cloud NGFW Enterprise includes intrusion prevention capabilities that route traffic through Google-managed zonal firewall endpoints using packet intercept technology. These endpoints inspect data streams for active threat signatures, such as malware, spyware, and command-and-control activity, and generate security logs when threats are identified or blocked.
Firewall Rules Logging audits the evaluation of individual VPC firewall rules by recording every connection decision for both ingress and egress directions. When an allowed connection matches an enabled rule, the system emits a single log entry upon connection establishment. When a packet matches a deny rule, the system generates repeated log entries every 5 seconds for as long as that denied connection attempts to send packets. Each log entry records the rule action, the matching rule name, and the source and destination IP addresses and transport ports.
Firewall Insights analyzes historical firewall evaluation logs using machine learning to detect misconfigurations, optimize rule strictness, and surface packet-drop signals. The service automatically identifies shadowed rules, which are lower-priority rules whose attributes are entirely overlapped and superseded by higher-priority or equal-priority rules. Firewall Insights calculates shadowed rules within 24 hours after an administrator enables Firewall Rules Logging on the relevant rules. Deny rule insights examine dropped packet patterns over a default 24-hour observation window to help administrators distinguish intentional security blocks from network configuration mistakes.
VPC Service Controls establishes security perimeters around sensitive Google-managed services, such as Cloud Storage and BigQuery, to prevent data exfiltration. The service denies API requests to protected resources whenever those calls originate outside the authorized perimeter boundary or from unapproved environments. Cloud Logging records both dry-run evaluations and active perimeter violation audit logs. Security teams inspect these audit logs to identify unauthorized egress attempts, verify access patterns, and refine ingress and egress perimeter rules before enforcing them in production.
Cloud VPN exports Internet Key Exchange (IKE) control plane events to Cloud Logging under the vpn_gateway resource type to assist with tunnel negotiation diagnostics. During Phase 1 negotiations, administrators inspect log entries such as initiating IKE_SA or establishing IKE_SA failed, peer not responding to isolate connectivity issues with the remote peer. Successful Phase 1 negotiations generate logs showing pre-shared key authentication and IKE_SA established between endpoints. Phase 2 negotiations track CHILD_SA lifecycle events, where log warnings like Remote traffic selectors narrowed indicate mismatched encryption subnets, and DELETE for ESP CHILD_SA records unexpected tunnel teardowns.
Cloud Router manages dynamic routing across hybrid connections by establishing Border Gateway Protocol (BGP) peering sessions and logging route state transitions. Setting the VPC dynamic routing mode to global propagates learned hybrid routes to subnets across all regions, while setting it to regional restricts dynamic routes strictly to the local region. Administrators configure base advertised route priorities on BGP sessions to control traffic paths: identical priorities establish an active-active equal-cost multi-path (ECMP) architecture, while differing priorities establish an active-passive failover routing path. When route propagation issues occur, administrators verify custom route advertisements and inspect Cloud Router status using the routers.getRouterStatus API method.
Network Connectivity Center (NCC) manages wide-area enterprise connectivity by organizing external sites and VPC networks into a centralized hub and attached spokes. To enable data transit between non-Google Cloud sites over the Google network backbone, administrators must set the site-to-site data transfer setting to true on each hybrid spoke. When software-defined wide area network (SD-WAN) systems attach using Router appliance spokes, BGP peering must use internal RFC 1918 IP addresses instead of link-local 169.254.x.x addresses. Each Router appliance requires two separate BGP sessions targeting distinct Cloud Router interfaces, and VPC firewall rules must permit ingress TCP traffic on port 179.
Network Intelligence Center Connectivity Tests uses an abstract state machine to evaluate packet forwarding paths across VPC networks, Cloud VPN tunnels, and Cloud Interconnect attachments. The diagnostic engine traces configuration paths to determine whether traffic drops originate from missing routes or restrictive firewall rules. Connectivity Tests analyzes the Google Cloud side of the path and assumes external on-premises configurations are functioning correctly. Combining Connectivity Tests with VPC Flow Logs and Network Topology telemetry provides complete visibility into bandwidth consumption and packet drop locations across hybrid network topologies.
VPC Flow Logs intercepts outbound packets before they reach egress firewall rules, allowing the system to log denied egress attempts. Inbound packets are evaluated by ingress firewall rules before reach the sampling point, so blocked ingress packets are dropped prior to log collection.
An active-active configuration uses identical base advertised route priorities across multiple BGP sessions, distributing traffic using equal-cost multi-path (ECMP) routing. An active-passive configuration assigns different priorities across BGP sessions, directing all primary traffic to the path with the most preferred priority and using the alternate path strictly for failover.
Dry-run logs record perimeter violations in Cloud Logging without actually blocking the API request. This allows security administrators to test and verify perimeter rules against live workloads, identifying legitimate traffic patterns that need to be permitted before enabling active enforcement.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts