Network Topology is a visualization tool within the Network Intelligence Center that maps your network configuration and overlays real-time traffic metrics. It shows resources like virtual machine (VM) instances, groups them into expandable categories, and displays live data flows and throughput between entities. You can select any entity—a VM, subnet, or Cloud Router—to view ingress and egress byte counts, and expand time-series charts for up to six weeks to spot historical patterns such as sudden latency increases. For hybrid topologies, Network Topology displays connections like Cloud Interconnect, Cloud VPN, and Router Appliance instances as distinct points, allowing you to analyze traffic volume across individual VPN tunnels and VLAN attachments. If traffic nears a connection’s limit, you can view historical charts to diagnose recurring bottlenecks. For Google Kubernetes Engine (GKE), a dedicated view shows relationships between clusters, namespaces, workloads, and pods, tracking metrics like queries per second and HTTP latency. Traffic from external clients into GKE is visible down to the cluster level. The tool also helps evaluate path selection in complex multi-VPC and hybrid networks, where administrators choose between a mesh topology (all connected VPCs communicate directly) and a star topology (all traffic passes through a central hub VPC) in Network Connectivity Center (NCC). Cloud Router uses Border Gateway Protocol (BGP) to distribute routes across these topologies, and Private Service Connect (PSC) routes traffic privately to designated producer endpoints without full network exposure.
Connectivity Tests is a diagnostics tool within Network Intelligence Center that analyzes network configuration and, for supported paths, performs live data plane analysis to check connectivity between endpoints like VMs, GKE clusters, or Cloud SQL instances. Configuration analysis simulates a packet’s expected forwarding path through your VPC network by modeling the network as a finite state machine. The analysis checks each logical step: it first evaluates egress firewall rules to see if the source is allowed to send the packet, then attempts to match a route for the destination IP address. If multiple valid routes exist, the test returns all possible paths because the actual selection method is internal. The packet continues through the simulated path, checking relevant ingress firewall rules at the destination. A result of Reachable means the configuration analysis found a complete allowable path; Unreachable indicates the packet was dropped at a specific step. A routing issue is indicated when the packet is dropped because no valid route exists, often due to a missing custom route, an incorrect next hop, or a down VPN tunnel. A firewall issue is indicated when a specific VPC firewall rule, hierarchical firewall policy, or global network firewall policy explicitly blocks the packet. The detailed results specify the exact rule that denied the packet. For supported paths, Connectivity Tests also performs live data plane analysis, sending real packets between the hypervisors of the source and destination VMs to validate the actual data plane and provide baseline latency and packet loss metrics. A mismatch between configuration analysis (e.g., Reachable) and live data plane results (e.g., packets dropped) can highlight issues not captured in static configuration, such as data plane bugs. Live analysis only runs when configuration analysis shows a reachable path. When testing Google-managed services like Cloud SQL or GKE control planes, the tool can analyze the path up to the Google-owned VPC network but cannot provide configuration details within that network. To construct a test scenario, you specify source and destination endpoints using a 5-tuple (without source port). Supported traffic flows include VM-to-VM, VM-to-internet, VM-to-on-premises, and VM-to-load balancer, among others. The supported protocols are TCP and UDP. After making configuration changes, administrators should wait 20 to 120 seconds before rerunning the test to incorporate the updates.
Performance Dashboard provides visibility into network performance metrics with two scopes: a Google-wide view showing performance for any zone pair across all of Google Cloud, and a project-scoped view showing metrics only for traffic involving your project’s VMs. Packet loss is measured actively using UDP packets for internal IP addresses and TCP packets for external IP addresses. Latency (round-trip time) is calculated passively from sampled TCP traffic headers by measuring the time between a TCP sequence number and its corresponding acknowledgment. The dashboard displays median latency for up to 50 zone pairs. A Google-wide issue typically manifests as degraded performance across multiple zone pairs, while a project-scoped issue is isolated to specific VMs or configurations. When diagnosing, first check the Google-wide view to rule out infrastructure issues, then drill into the project-specific view. Anomaly detection is supported through alerting policies in Cloud Monitoring; for example, an alert can trigger when packet loss exceeds 5% for 5 minutes for any region pair. The Performance Dashboard automatically exports time-series data to Cloud Monitoring, requiring the monitoring.timeSeries.list permission. In a Shared VPC architecture, the dashboard shows metrics only for VMs within the specific service project, not for cross-service project traffic routed through the host project. Low-confidence data (fewer than 400 probes per minute) is flagged with an asterisk or N/A. The recommended troubleshooting flow is to first check the Google-wide dashboard, then use Network Topology to examine specific communication paths, filtering down to individual GKE clusters or peered entities to identify whether the issue stems from specific VM instances, pod bottlenecks, or intermediary network hops.
Firewall Insights is a service within Network Intelligence Center that analyzes firewall rule configurations and network topology to help administrators monitor and improve firewall behavior. The service uses the Cloud Firewall Insights Service Agent role (roles/firewallinsights.serviceAgent) to retrieve configuration details, including firewall rules, VMs, routes, and network metadata. It evaluates both defined and effective firewall rules across VPC networks. Firewall Insights identifies resources with open or overly permissive ingress rules, correlating rule hits with threat intelligence feeds and compliance frameworks. It also categorizes ineffective rules: unused rules (zero hits, safe to remove), redundant rules (multiple rules performing the same action on overlapping traffic, can be consolidated), and overly permissive rules (rules that match more traffic than intended, such as broad source IP ranges). The service provides hit counts that reveal how often each rule has been matched by traffic flows. Administrators use this evidence to make informed decisions about modifying or deleting rules, reducing the attack surface and simplifying firewall management. The analysis supports routine network operations by ensuring firewall policies remain aligned with actual workload requirements and compliance obligations.
Network Analyzer is a tool within Network Intelligence Center that scans your VPC network configurations to identify network failures, suboptimal configurations, and utilization warnings. It proactively analyzes the network topology, routes, and firewall rules to detect issues such as misconfigured routing, subnet conflicts, or resource exhaustion. Network Analyzer generates a list of findings with severity levels, enabling administrators to address problems before they cause downtime. The tool helps maintain a healthy network by providing automated checks that complement the manual diagnostics of Connectivity Tests and Performance Dashboard. While it does not perform live data plane analysis, its configuration-based scans catch common configuration errors that would otherwise lead to connectivity failures or performance degradation.
Flow Analyzer provides visual and metric-based analysis of traffic patterns by processing records generated by VPC Flow Logs. For data to appear in Flow Analyzer, VPC Flow Logs must be enabled on the relevant subnetworks, metadata logging must not be disabled, and the destination log bucket must be upgraded to use Log Analytics. Flow Analyzer groups flow data into defined alignment periods, ranging from one-minute windows for granular anomaly detection to multi-week spans for macro-level trend analysis. Administrators can analyze data using metric types such as Bytes sent or Packets sent, applying alignment calculations including total traffic, average traffic rate, median rate, P95 traffic rate, or maximum rate. The tool helps identify unexpected traffic spikes, abnormal communication patterns, and volume trends. When combined with VPC Flow Logs, which record connection details (source and destination IP, ports, protocol, total packets and bytes), Flow Analyzer gives administrators a detailed view of network traffic that supports troubleshooting, capacity planning, and security analysis.
Use Connectivity Tests and examine the detailed trace results. If the packet is dropped at a step where no valid route exists for the destination IP, it is a routing issue. If the packet is dropped at a step where a specific firewall rule is identified as blocking the packet, it is a firewall issue. The tool shows the exact rule name or the missing route.
Use the Google-wide view first to establish a baseline and rule out broader infrastructure issues. If the Google-wide view shows normal performance, switch to the project-scoped view to see if the problem is isolated to your project’s VMs. If the issue appears only in your project view, it is likely a project-scoped configuration or resource constraint problem.
VPC Flow Logs are the raw logs that record network connection details (source/destination IP, ports, protocol, packets, bytes). Flow Analyzer is a tool that processes those logs (after they are enabled and the log bucket is upgraded to Log Analytics) and provides visual and metric-based analysis, grouping data into alignment periods for trend detection and anomaly identification.
Firewall Insights identifies rules that are unused (zero hits), redundant (duplicate actions), or overly permissive (broad source ranges). By removing unused rules, consolidating redundant ones, and narrowing overly permissive rules, you reduce the attack surface and simplify firewall management. The tool provides hit counts and compliance correlation to justify these changes.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts