Extending to on-premises environments (hybrid networking)

Design Redundant Topologies for High Availability and SLAs

To build a hybrid network that is highly available, you need to design it to meet strict Service Level Agreements (SLAs). For a 99.99% availability guarantee from Google, you must use four Cloud Interconnect connections spread across two different Google Cloud regions. This pattern ensures minimal downtime for mission-critical applications.

Redundancy is achieved by using diverse paths. This means connecting through different metropolitan areas and using a mix of Dedicated Interconnect (for direct physical links) and Partner Interconnect (which uses a service provider). This strategy prevents a single point of failure from breaking the connection between your on-premises data center and the cloud.

A common and organized design is the Hub-and-Spoke topology. In this model, a central hub VPC connects to multiple spoke VPCs and your on-premises network. This setup allows for centralized security policy management and uses VPC Network Peering or VPN tunnels for connectivity.

For the most demanding applications, a Hot HA pattern is used. Here, both the cloud and on-premises sites actively serve traffic. Cloud Router uses BGP for global dynamic routing to manage this traffic. If one site fails, the system uses weighted routing to quickly send all users to the healthy site, resulting in a very low Recovery Time Objective (RTO).

Maintaining seamless operation also depends on Cloud DNS. DNS peering and forwarding zones allow resources across the hybrid boundary to find each other. Health checks ensure traffic is only sent to active endpoints, while inbound and outbound forwarders handle name resolution in both directions.

Distinguish Between Dedicated and Partner Interconnect Solutions

Cloud Interconnect provides private, high-performance connectivity between your on-premises network and Google Cloud. The two main options are Dedicated Interconnect and Partner Interconnect. Your choice depends on your bandwidth needs and physical location.

Dedicated Interconnect establishes a direct physical link between your equipment and Google's network. This requires your hardware to be in a supported colocation facility. It offers 10-Gbps or 100-Gbps circuits and is cost-effective for very high, consistent bandwidth demands, as traffic flows directly without using the public internet.

Partner Interconnect is for organizations that cannot reach a Google colocation facility. You connect through a supported service provider who manages the link to Google. It offers flexible capacity from 50 Mbps to 50 Gbps and reduces the maintenance burden since you don't manage hardware in a colocation site.

Both solutions use a Cloud Router to manage dynamic routing via the Border Gateway Protocol (BGP). This allows your on-premises routers and your VPC to automatically exchange route information, simplifying network management. For added security, you can deploy HA VPN over Cloud Interconnect, which adds IPsec encryption to the private connection while maintaining high availability.

It's important to note that for connecting to other clouds like AWS or Azure, Google offers Cross-Cloud Interconnect. This is different from Carrier Peering, which is used primarily for accessing Google Workspace rather than connecting to internal VPC resources.

Evaluate Cloud VPN for Secure Internet-Based Connectivity

Cloud VPN creates encrypted tunnels over the public internet to connect your on-premises network to your Google Cloud VPC. For professional use, High Availability (HA) VPN is the standard, as it provides 99.99% availability by establishing two separate tunnels, ensuring connectivity remains if one path fails.

Cloud Router integrates with the VPN to handle dynamic routing using the Border Gateway Protocol (BGP). This enables automated route propagation, meaning the network automatically learns the best paths between environments. BGP also allows for stateful failover, which automatically switches traffic to a healthy tunnel without manual intervention.

In hybrid designs, VPNs are often used within topologies like hub-and-spoke. Here, a central hub VPC connects to on-premises via VPN and then shares that secure connection with multiple spoke VPCs. This creates a centralized point for managing security policies and firewall rules across the entire infrastructure.

Setting up a secure VPN requires careful configuration. You must ensure Pre-Shared Keys (PSK) and encryption ciphers match on both the cloud and on-premises gateways. Administrators also need to properly advertise custom IP ranges through the Cloud Router so that on-premises systems can locate cloud resources, and configure firewall rules to allow the necessary traffic.

Maintaining resilience involves monitoring the health of VPN tunnels and BGP sessions. Troubleshooting steps include verifying that PSKs match, checking that ASN numbers are correctly configured for BGP, and ensuring firewall rules on both sides allow traffic. Regular testing of the failover process ensures the hybrid network remains robust during outages.