Network connectivity failures in Google Cloud occur when control plane misconfigurations or policy blocks disrupt data plane communication between endpoints. The Network Intelligence Center provides a unified operational suite to detect, diagnose, and remediate these failures using continuous background analysis, state machine simulations, and topology visualization.
Network Analyzer is a continuous, automated configuration analysis engine within Network Intelligence Center that detects network misconfigurations and suboptimal topologies across Virtual Private Cloud (VPC) networks. The service operates purely in the management plane without processing, intercepting, or generating live user data-plane traffic. When a connectivity interruption occurs, Network Analyzer correlates the failure with recent configuration updates to identify the underlying root cause and generate actionable remediation recommendations. Because the service is globally replicated, regional or zonal cloud outages do not cause service outages for Network Analyzer, though configuration insights for resources located inside an affected zone or region become stale until connectivity recovers.
Connectivity Tests is a diagnostic tool that evaluates reachability between specific source and destination endpoints such as virtual machine (VM) instances, Google Kubernetes Engine (GKE) clusters, load balancer forwarding rules, or external internet addresses. The tool performs a static configuration analysis by executing an abstract state machine model that traces the intended packet forwarding path across VPC routes, firewall rules, Cloud VPN tunnels, and Cloud Interconnect VLAN attachments. Connectivity Tests can also perform dynamic live data plane analysis by injecting active test packets to measure real-time latency and packet loss. Diagnostic evaluations take between 30 seconds and 10 minutes depending on the total resource footprint and the complexity of the evaluated VPC configuration.
Google-managed services such as Cloud SQL and GKE run core infrastructure components inside Google-owned tenant projects that are isolated from customer VPC networks. Connectivity Tests evaluates customer-side routing and firewall policies up to the network boundary, but it cannot display detailed configuration components located inside the Google-owned project. When a test terminates at a managed boundary, the tool returns a high-level reachability determination, generating distinct error codes such as DROPPED_INSIDE_GKE_SERVICE or DROPPED_INSIDE_CLOUD_SQL_SERVICE when packets fail to enter the service. These failure states typically indicate invalid destination port inputs on the test request or internal service provisioning issues within the Google-managed network.
Common connectivity failures identified by Network Analyzer include blocked load balancer health checks, broken VPC peering associations, invalid route next hops, and dropped service traffic. For load balancer health checks, administrators must create ingress firewall allow rules for Google Cloud health check IP ranges (35.191.0.0/16, 209.85.152.0/22, and 209.85.204.0/22) directed at backend VMs on designated target ports. For VPC Network Peering links, administrators must eliminate overlapping subnet CIDRs and explicitly verify that custom route export and import flags are enabled on both sides of the peering relationship. If an invalid route next hop is flagged, the administrator must update the route to point to an active, reachable IP address or instance within the VPC network.
Network Topology is a real-time visualization tool that maps physical and logical relationships across VPC networks, hybrid interconnects, and Google-managed services. The Infrastructure view presents visual metrics for inter-entity bandwidth, cross-region egress, and packet flows, while the GKE Enterprise view illustrates workloads, pods, namespaces, and cluster communication paths. By merging static configuration states with live operational metrics, Network Topology allows administrators to identify where traffic drops or latency spikes occur between specific VM instances. If a specific cloud zone suffers an infrastructure outage, that zone's visual telemetry disappears from Network Topology while all other operating zones continue reporting unaffected real-time metrics.
Resource utilization warnings generated by Network Analyzer alert administrators when network components approach critical scale boundaries or allocation limits. Monitoring these warnings allows organizations to apply preventative scaling changes before exhausted capacity causes packet loss or provisioning failures.
Utilization warnings highlight infrastructure limits that are nearing complete consumption across subnets, network address translation gateways, and service access links. Network Analyzer continuously tracks available primary and secondary subnet IP address space, alias IP usage for container pods, Private Services Access allocation pools, and Cloud NAT port capacities. When a monitored resource reaches a high utilization threshold, the service generates a warning detailing the affected resource and its current capacity level. These proactive alerts enable administrators to resolve underlying resource constraints before VM provisioning fails or container deployments stall.
Preventative mitigation strategies resolve resource exhaustion warnings by expanding address space, raising port thresholds, or adjusting allocation architectures. When a subnet encounters IP exhaustion, administrators expand primary subnet CIDR blocks or provision secondary IP ranges to accommodate new VM instances or GKE pods. When Cloud NAT gateways encounter port allocation shortages, administrators increase the number of external IP addresses assigned to the NAT pool or raise dynamic allocation thresholds, such as increasing the max-ports-per-vm setting to 4096. For Private Services Access and Private Service Connect (PSC) limits, administrators allocate larger IP address reservations to service attachments or request project quota increases.
Integrated monitoring across the Network Intelligence Center suite provides continuous operational verification of network scaling decisions. Administrators review Performance Dashboard metrics to differentiate between broader Google Cloud infrastructure performance anomalies and localized project-level resource constraints. By enabling Cloud NAT error logging and configuring metric alerts for failures like nat_allocation_failed, teams establish automated alerting workflows. This continuous observability loop ensures that capacity adjustments successfully relieve infrastructure pressure and preserve production workload reliability.
Suboptimal VPC and routing configurations cause packets to traverse inefficient paths, incur elevated latency, create asymmetric routing loops, or trigger policy enforcement mismatches. Diagnosing routing behaviors, refining Border Gateway Protocol (BGP) dynamic route advertisements, and resolving routing conflicts ensure optimized traffic delivery across enterprise architectures.
Automated configuration analysis identifies dormant, conflicting, or inefficient network rules across single-project and multi-project environments. Network Analyzer evaluates network topology, Cloud Next Generation Firewall (Cloud NGFW) policies, static routes, and dynamic BGP sessions whenever configuration changes occur in the project. Administrators pair Network Analyzer with Firewall Insights to identify shadowed or redundant firewall rules that never process active traffic. Combining these tools with Connectivity Tests allows teams to verify path behavior against mathematical models before applying network modifications to live production traffic.
Cloud Router exchanges dynamic routing information between VPC networks and on-premises systems over Cloud VPN, Cloud Interconnect, or Router appliance instances using BGP. Setting the dynamic routing mode of a VPC network to global ensures that Cloud Router advertises and learns dynamic routes across all Google Cloud regions rather than restricting route propagation to the local region where the session terminates. When multiple paths advertise the same destination prefix, Cloud Router determines path preference using the Multi-Exit Discriminator (MED), calculated as a base value of 200 plus the inter-region round-trip network latency in milliseconds. To prevent asymmetric routing or traffic drops across Equal-Cost Multi-Path (ECMP) routes, administrators must ensure consistent prefix advertisements and explicitly advertise custom ranges, such as proxy-only subnets used by hybrid load balancers.
Network Connectivity Center (NCC) centralizes wide-area network management using a hub-and-spoke model connecting VPC networks, hybrid connections, and third-party router instances. When creating an NCC hub, administrators choose between a full-mesh topology for any-to-any spoke communication and a star topology to restrict data paths to a centralized group of core spokes. Suboptimal routing occurs when VPC spokes fail to propagate routes to external networks due to improperly configured include-export or exclude-export IP filters. For Router appliance deployments, BGP sessions fail if interfaces use link-local 169.254.x.x addresses instead of internal RFC 1918 addresses within the VPC subnet, if firewall policies block TCP port 179, or if dual BGP interfaces advertise mismatched route prefixes.
Resolving route conflicts requires an understanding of strict routing precedence, peering rules, and service access designs. Google Cloud always prioritizes direct VPC subnet routes over static or dynamic routes; an on-premises BGP advertisement that overlaps a local subnet CIDR is ignored, leading to traffic blackholing if IP address assignments collide. Across VPC Network Peering links, dynamic routes and custom default routes (0.0.0.0/0) do not propagate unless explicitly enabled for export on the source network and import on the destination network. If default internet routes are removed to force outbound egress through security appliances, administrators must implement Private Google Access (PGA) or configure Private Service Connect endpoints to maintain direct, low-latency communication with Google APIs without routing across hybrid backhauls.
StudyCerts
StudyCerts35.191.0.0/16, 209.85.152.0/22, and 209.85.204.0/22.169.254.x.x link-local IP addresses.Network Analyzer is an automated, continuous monitoring engine that scans VPC configurations to detect misconfigurations, capacity limits, and suboptimal designs without user initiation. Connectivity Tests is an on-demand diagnostic tool that simulates packet forwarding across state machines or injects live test packets between specified endpoints to validate reachability and measure path latency.
When dynamic routing is set to regional, Cloud Router only shares and learns routes for subnets located in the same region as the BGP session. When dynamic routing is set to global, Cloud Router distributes and learns routes for all subnets across every region in the entire VPC network.
VPC Network Peering only exchanges local subnet routes by default to prevent unintentional route hijacking. Static custom routes and dynamic BGP routes require administrators to explicitly configure the export custom routes setting on the originating VPC network and the import custom routes setting on the receiving VPC network.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills