Policy-based routing (PBR) is a Google Cloud Virtual Private Cloud (VPC) networking capability that directs traffic to specific next hops by evaluating packet headers beyond destination IP addresses. While standard static routes match only destination IP ranges, policy-based routes evaluate the source IP address, destination IP address, protocol, and port numbers (the 5-tuple). This matching lets administrators redirect traffic to next-hop internal load balancers, network virtual appliances (NVAs), or a Secure Web Proxy. When deploying policy-based routes, administrators must create a specific route for the intended workload and a separate default-routing route using --next-hop-other-routes="DEFAULT_ROUTING" so unmatched inter-VM traffic continues to flow normally.
Route priority determines the sequence in which Google Cloud evaluates policy-based routes, with lower numerical values indicating higher priority from 0 (highest) to 65535 (lowest). Policy-based routes are evaluated before standard subnet routes and static routes in the routing order. When routing to a Secure Web Proxy, the default-routing policy-based route must have a lower numerical priority (higher priority) than the proxy redirection route to prevent non-proxy traffic from being blocked. If multiple policy-based routes share identical priorities and match a packet, an internal algorithm picks a single route that might not be the most specific match; assigning unique priorities avoids this ambiguity.
Policy-based routes differ from static routes because static routes filter traffic using network tags and destination ranges, whereas policy-based routes filter using source IP ranges. A Secure Web Proxy configured with NEXT_HOP_ROUTING_MODE only supports HTTP, HTTPS, and TCP proxy traffic; unsupported traffic, including cross-region traffic, is dropped without notification. Furthermore, a single VPC network in a given region can host only one Secure Web Proxy as a next-hop instance. When a route matches a virtual machine (VM), all VM traffic—including background tasks and system updates—is steered to that next hop.
Dynamic routing mode controls how Cloud Router shares learned dynamic routes across regions within a VPC network. In regional dynamic routing mode, a Cloud Router shares learned routes only with resources located in its own local region. In global dynamic routing mode, Cloud Router distributes learned routes to resources in every region across the entire VPC network. Global dynamic routing enables virtual machines in any region to reach on-premises networks across all hybrid interconnects and VPN tunnels.
Route propagation in global dynamic routing mode is restricted by regional capacity quotas. When global routing is active, a Cloud Router in one region attempts to propagate up to 250 unique destinations to other regions. Each target region enforces a "from-other-regions" quota of 250 unique destinations; exceeding this limit causes the network to drop excess routes. Additionally, if a packet matches a hybrid subnet route whose destination is not active, dynamic routes learned in other regions will drop the packet rather than forwarding it across regions.
Border Gateway Protocol (BGP) path selection determines how Cloud Router and on-premises routers select optimal paths using metric attributes. The BGP selection process prioritizes paths with the highest Local Preference first, followed by the shortest Autonomous System (AS) path length. When AS path lengths are equal, the Multi-Exit Discriminator (MED) breaks the tie, with lower MED values being preferred. Cloud Router sets MED values to guide inbound traffic from on-premises networks, while Google Cloud adds an inter-region dynamic metric cost to steer outbound traffic through local regional paths instead of distant cross-region links.
Cloud Router base advertised priorities are whole numbers between 0 and 65535 that configure how on-premises routers direct return traffic into a VPC network. A base priority of 0 is the highest possible priority, while 100 serves as the default value. When two BGP sessions on Cloud VPN or Cloud Interconnect share identical base priorities, the network operates in an active-active topology using Equal-Cost Multi-Path (ECMP) routing. In contrast, assigning different base priorities creates an active-passive failover configuration where on-premises devices direct primary traffic to the lowest numerical priority.
Google Cloud automatically generates region-to-region cost metrics between 201 and 9999 based on physical distance and network latency. The overall MED metric advertised over BGP equals the Cloud Router base priority added to this region-to-region cost. Administrators keep local base priorities between 0 and 200 to ensure local hybrid paths take precedence over remote region paths. Configuring a secondary path with a base priority of 10200 or higher guarantees that it stays in backup status behind any local path configured with a priority of 200 or less.
Network Connectivity Center (NCC) applies a strict hierarchy to resolve overlapping route advertisements between connected hybrid spokes and VPC networks. When destination prefixes overlap in a hub routing table, the system selects landing VPC subnets first, hub subnets second, and Cloud Router custom routes last. Network Connectivity Center prevents duplicate subnet overlaps between routing VPC subnets and spoke hub subnets. If an administrator creates a custom route advertisement that overlaps with a landing VPC subnet or an imported hub subnet, Cloud Router ignores the custom route advertisement.
Regional dynamic routing mode restricts Cloud Router so it only shares learned dynamic routes with resources in the same region as the next hop. Global dynamic routing mode propagates routes learned by a Cloud Router in one region to all resources across every region in the Virtual Private Cloud network.
When Border Gateway Protocol routes have identical Local Preference and equal AS path lengths, Google Cloud uses the Multi-Exit Discriminator (MED) value to break the tie. Paths with a lower MED value are prioritized over paths with higher values.
An administrator can assign a base priority of 10200 or higher to the backup Cloud Router BGP session. Because region-to-region dynamic costs range from 201 to 9999, a priority of 10200 ensures the backup route remains numerically higher (lower priority) than any primary local link configured with a base priority of 200 or less.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts