The dynamic routing mode of a VPC network controls whether dynamic routes learned by a Cloud Router are installed in one region or across all regions globally. When using regional dynamic routing, Cloud Router programs BGP routes from on-premises networks only into the route table of the region where the Cloud Interconnect VLAN attachment or Cloud VPN gateway is located, meaning workloads in other regions cannot reach those hybrid destinations without separate regional interconnects. When using global dynamic routing, Cloud Router propagates dynamic routes to every subnet in all regions, so traffic from a VM in a remote region travels over the Google backbone to the region with the VLAN attachment before exiting to on-premises. Global dynamic routing simplifies interconnect consolidation but incurs inter-region data transfer charges for traffic that moves between regions.
High Availability VPN (HA VPN) provides encrypted hybrid connectivity between VPC networks or between a VPC and peer environments with defined SLAs. Achieving a 99.99% availability SLA requires two HA VPN gateways in the same region, each with dual tunnels across distinct physical interfaces to the peer gateway. Deploying gateways across different regions reduces the SLA to 99.9% but enables geographic redundancy. Traffic predictability depends on whether Cloud Router uses active-passive or active-active routing: active-passive uses MED values to send all traffic over a primary tunnel while keeping a backup idle, ensuring constant bandwidth during failover, while active-active uses ECMP to balance traffic across multiple paths, doubling bandwidth but risking traffic drops if one tunnel fails. Administrators should avoid active-passive across multiple HA VPN gateways because passive tunnels remain unused until all active tunnels fail.
Cloud Interconnect provides dedicated physical Layer 2 or Layer 3 connections between on-premises networks and Google Cloud for high-throughput, low-latency traffic. Routing across Cloud Interconnect uses BGP sessions between on-premises edge routers and Cloud Router instances attached to VLAN attachments. The dataplane version of a VLAN attachment determines BGP configuration requirements: VLAN attachments using Dataplane Version 1 require eBGP multi-hop with a TTL of 4 on the on-premises peer, while Dataplane Version 2 supports single-hop BGP natively. To speed up convergence during failures, administrators enable Bidirectional Forwarding Detection (BFD), which requires single-hop BGP and detects sub-second path failures.
Network Connectivity Center (NCC) organizes hybrid and multicloud architectures using a hub-and-spoke model. VPC spokes, Cloud Interconnect VLAN attachments, Cloud VPN tunnels, and Router Appliance instances attach to an NCC hub as spokes to establish any-to-any dynamic connectivity. The NCC hub manages a centralized, read-only hub route table that aggregates and distributes learned dynamic routes and subnet IP ranges across spokes. The dynamic routing mode of the underlying VPC determines how NCC dynamic routes program into VPC spokes: regional routing restricts propagation to spokes in the same region as the hybrid attachment, while global routing distributes routes globally. To advertise VPC subnet routes to on-premises networks, administrators configure spokes to include all IPv4 ranges or configure Cloud Router to advertise custom IP prefixes that aggregate spoke subnets.
The dynamic routing mode of a routing VPC network determines in which regions Network Connectivity Center dynamic routes are programmed in the VPC spokes. When the dynamic routing mode is regional, Network Connectivity Center dynamic routes from hybrid spokes are only programmed in the same region as each hybrid spoke. When the dynamic routing mode is global, Network Connectivity Center dynamic routes from hybrid spokes are programmed in all regions. The VPC spoke only uses the dynamic routing mode when hybrid spokes reside in the same hub.
The Network Connectivity Center hub route table lists all learned dynamic routes from on-premises networks and subnet routes reachable from attached spoke networks through the NCC hub. Hub route tables are read-only resources fully managed by Network Connectivity Center. The hub route table updates with route entries when specific events occur, though the exact tie-breaking logic for route selection when multiple routes to the same destination exist is not detailed in the documentation.
Spoke administrators or network administrators for the routing VPC networks must configure advertisement of subnet routes in VPC spokes. A spoke administrator for the hybrid spoke can set the includeImportRanges field to ALL_IPV4_RANGES in the hybrid spoke resource using the API or the Google Cloud CLI with the --include-import-ranges=ALL_IPV4_RANGES flag. A network administrator for the routing VPC network can advertise custom address ranges on Cloud Routers for hybrid spokes, where the custom ranges can be a list of all subnet IPv4 address ranges of VPC spokes on the hub, or larger CIDRs that contain those subnet ranges.
Connectivity Tests finds a route for the destination IP address according to the routing order. If no other routes are available to the destination VM instance, Connectivity Tests uses the default static route with the next hop as the internet gateway, because all VPC networks use this default route unless it has been removed. This demonstrates the priority order in VPC routing where specific routes take precedence over default routes.
Legacy best path selection is the original routing behavior where a Cloud Router chooses paths based primarily on the Multi-Exit Discriminator (MED) value, which is the sum of a base advertised priority and a region-to-region cost. This mode can lead to non-deterministic routing, especially when multiple paths have equal MEDs, because the tie-breaking algorithm may vary. Standard best path selection is the newer, recommended mode that provides deterministic path selection by using a consistent, predefined tie-breaking order, such as preferring the lowest router IP address, when MED values are equal. This ensures predictable traffic flow, which is critical for network troubleshooting and design.
The performance and operational implications of each mode are significant. The standard mode offers predictable performance by eliminating routing flips during equal-cost multipath (ECMP) scenarios, which simplifies capacity planning and failover testing. The legacy mode, while potentially compatible with older network designs that rely on its specific behavior, can introduce operational complexity due to its non-deterministic nature, making it harder to diagnose routing issues and ensure consistent SLAs. The key trade-off is between the stability and predictability of the standard mode and the potential need to maintain the legacy mode for compatibility with existing, unmodified on-premises routing policies or scripts.
The decision framework for selecting a mode weighs three core criteria: deterministic routing needs, existing network compatibility, and migration strategy. Choose standard best path selection when the primary requirement is deterministic, predictable routing for all new deployments and when dependent systems can be updated. Choose legacy best path selection only when strict compatibility with an existing hybrid design that cannot be altered is required, or during a phased migration where some components still depend on the old behavior. For migration, the strategy must ensure no service disruption by first understanding the current legacy routing behavior in a test environment, then updating all dependent configurations such as on-premises router policies or monitoring tools to align with the standard mode's deterministic outcomes before switching the VPC network's dynamic routing mode. The migration can be performed per Cloud Router or at the VPC network level, allowing for a controlled, phased rollout.
Legacy best path selection uses MED values to choose routes, which can produce different results when multiple paths have equal MEDs. Standard best path selection adds a consistent tie-breaking order so the same destination always uses the same path, making routing predictable.
Use legacy best path selection only when existing on-premises routing policies or scripts depend on the specific non-deterministic behavior and cannot be modified. For all new deployments, standard best path selection is recommended.
Regional dynamic routing installs hybrid routes only in the region where the interconnect exists, while global dynamic routing installs them in all regions. Global routing simplifies connectivity but can incur inter-region data transfer charges.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts