Professional Cloud Network Engineer
Cloud Router is a managed Google Cloud service that enables dynamic routing between your Virtual Private Cloud (VPC) network and external networks, like your on-premises data center. It uses the Border Gateway Protocol (BGP) to automatically exchange routing information, updating the VPC's routing tables without any manual intervention when network paths change.
A Cloud Router is a control plane service that establishes BGP peering sessions. It works with connectivity services like Cloud Interconnect, Cloud VPN, and router appliances. The routes it learns are applied based on the VPC network's dynamic routing mode. In regional dynamic routing mode, the Cloud Router only advertises and learns routes for resources within its own region. In global dynamic routing mode, it exchanges routes for all subnets across every region in the VPC network, preferring local paths by assigning them a better metric.
Establishing a BGP session requires configuring an Autonomous System Number (ASN) for both the Cloud Router and the external peer router. For Partner Interconnect, you must use Google's public ASN 16550. For Dedicated Interconnect, HA VPN, or router appliances, you configure a private ASN (like 65001) for the Cloud Router. The IP addresses used for the BGP connection depend on the underlying service: Cloud Interconnect and Cloud VPN use link-local addresses (like 169.254.0.0/29), while router appliances use standard internal IPs from the VPC subnet. All BGP traffic uses TCP port 179, which must be allowed through any relevant firewalls.
Each BGP session on a Cloud Router pairs an interface with a peer configuration. You can tune session behavior by setting BGP timers, like keepalive and hold-time intervals, to control how quickly the session detects a failure. For stability, you can enable graceful restart to maintain data flow during router maintenance. For security, you can enable MD5 authentication to validate BGP control packets. You can also set a Multi-Exit Discriminator (MED) value (called advertised route priority) on each session; a lower MED gives that path a higher preference for inbound traffic.
By default, Cloud Router advertises all subnet routes (ALL_SUBNETS mode). You can set it to CUSTOM advertisement mode to selectively advertise only specific IP ranges, including custom CIDRs, Google API addresses, or health-check ranges. This provides precise control over what you announce to peers. For redundant connections, path selection is managed via MED values. Equal MEDs on multiple sessions trigger Equal-Cost Multipath (ECMP) routing, balancing traffic evenly (active/active). Unequal MEDs create an active/passive setup, where traffic prefers the lower-MED path and fails over to the higher-MED backup only if the primary fails.
Advanced route management involves fine-tuning how Cloud Router shares routes with peer networks using custom advertisements, MED values, and policies to enforce specific traffic patterns and ensure rapid failure detection in hybrid architectures.
When the default route advertisements don't meet your needs, you can configure custom advertisements. This involves setting the Cloud Router's advertisement mode to CUSTOM and then specifying the exact IP ranges you want to announce. This is useful for summarizing routes to reduce prefix count or for filtering out sensitive internal ranges from being exposed to external networks.
Multi-Exit Discriminators (MED) are used to influence how peer networks send traffic into your Google Cloud network. By setting different advertised route priorities (MED values) on redundant paths, you can create deterministic active/passive failover. For example, in an HA VPN setup, you would set a lower MED (like 10) on the primary tunnel and a higher MED (like 20) on the secondary tunnel, forcing all inbound traffic to prefer the primary path.
Bidirectional Forwarding Detection (BFD) is a protocol that provides sub-second link failure detection, which is much faster than standard BGP timers. When BFD is enabled on a VPN tunnel with dynamic routing, the Cloud Router can detect a failure and remove the affected routes from the routing table within the BGP hold timer period, accelerating convergence and reducing potential packet loss.
Designing for high availability requires redundant connections. Active/active designs use ECMP to load-balance traffic across multiple equal-cost paths. Active/passive designs keep one link as a standby. For Cloud Interconnect, redundancy requires at least two connections in different edge availability domains within the same region. Cloud Router itself is distributed across zones within a region for resiliency. Multi-region designs connect networks in different geographical areas to achieve even higher availability (99.99%).
A static route is a manually created, permanent entry in a VPC routing table that directs traffic for a specific destination to a predefined next hop. It is used for deterministic routing and controlled failover, unlike dynamic routes which are learned automatically.
Every static route is defined by its Network (the VPC), Destination range (a single CIDR block like 10.2.0.0/16), Priority (a number from 0 to 65535, where lower is better), and Next hop (the target resource). You can optionally use Network tags to restrict the route to apply only to specific VM instances.
Static routes can direct traffic to several types of next hops. You can send traffic to the default internet gateway. You can specify a next-hop instance (a specific VM with IP forwarding enabled). You can use a next-hop internal passthrough Network Load Balancer to distribute traffic across a backend group. You can also direct traffic to a next-hop Classic VPN tunnel that uses static routing.
Google Cloud evaluates routes in a strict order when forwarding a packet. First, it checks for a matching subnet route; if one exists, it is used exclusively and all custom static routes are ignored. If no subnet route matches, the system then selects the most specific destination among the remaining static and dynamic routes. Among custom routes, local VPC routes are preferred over imported peering routes. Finally, if multiple routes have the exact same destination, the route with the highest priority (lowest numerical value) is selected.
To create a static route, you define its parameters in the VPC network. For a next-hop instance, the target VM must exist and have IP forwarding enabled. For a next-hop load balancer, the load balancer must be created first. A static route's destination cannot overlap with or be more specific than any existing subnet route in the VPC. To configure failover, you create a primary route with a higher priority (e.g., 100) and a secondary route to a different next hop with a lower priority (e.g., 200); traffic will only use the secondary path if the primary next hop becomes unreachable.
Static routes can be exchanged with peered VPC networks, except for routes that use the default internet gateway or network tags. Within Network Connectivity Center, a static route in one spoke can use a load balancer in another spoke as its next hop if the hub's policy allows it. The key limitation is that a static route is always overridden by a more general subnet route for the same destination, both within the VPC and across peered networks.
In regional mode, a Cloud Router only advertises subnet routes from its own region and only propagates learned external routes to resources in that same region. In global mode, it advertises all subnet routes from every region in the VPC and propagates learned routes to resources in all regions, while still preferring local paths.
Use a static route when you need a permanent, deterministic path that will not change automatically, such as for routing traffic to a specific network appliance, implementing a simple failover scenario with route priorities, or directing traffic to a legacy VPN tunnel that uses static routing. Use dynamic routing when you need automatic adaptation to network changes, like failover between redundant cloud connections.
Among static (and dynamic) routes to the identical destination CIDR block, Google Cloud selects the route with the highest priority, which is the route with the lowest numerical priority value (e.g., a priority of 100 is higher than 200). Traffic will use the highest priority route as long as its next hop is healthy.
The MED (configured as the "advertised route priority" in Cloud Router) is a BGP attribute used to influence how external peer networks send traffic into your Google Cloud network. A lower MED value makes a path more preferred, allowing you to steer inbound traffic over a specific connection, which is essential for creating active/passive failover designs.
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts