Professional Cloud Network Engineer

Google Kubernetes Engine (GKE) gives administrators the choice between public and private cluster nodes, and this choice affects how workloads connect to the internet and how secure the cluster is. Public nodes have external IP addresses and can communicate directly with the internet. Private nodes have only internal IP addresses and cannot be reached from the internet without special configuration. The decision between these two options impacts security, cost, connectivity to Google APIs, and how you manage network traffic for your applications.

Network Service Tiers enable organizations to configure the routing paths and performance profiles for external internet traffic reaching Google Cloud resources. The tier is selected at the resource level on virtual machine (VM) external IP addresses or load balancer forwarding rules, and Google Cloud applies Premium Tier by default. Inbound data transfer is free across both tiers, but outbound data transfer pricing per gibibyte differs based on the chosen path. Network tiers operate independently from per-VM Tier_1 networking, which is a compute configuration used to increase raw bandwidth between instances.

A standalone VPC network operates independently within a single Google Cloud project, giving a team full ownership of its network environment. A Shared VPC design allows multiple projects to share a common VPC network, with a central host project managing the core network infrastructure. The choice depends heavily on your organization's IT model: a centralized model benefits from Shared VPC for consistent governance, while a decentralized model often suits standalone VPCs for team autonomy. For managed services like Private IP Cloud Composer, each environment uses up to two VPC peering connections, but Google Kubernetes Engine (GKE) clusters can reuse existing peering to reduce the total count.

Cloud HA VPN provides secure, encrypted site-to-site connectivity between Google Cloud Virtual Private Cloud (VPC) networks, on-premises data centers, and external clouds over public networks. A complete deployment pairs a regional Cloud HA VPN gateway with dynamic Border Gateway Protocol (BGP) routing managed by a Cloud Router and an external peer VPN gateway resource. This architecture establishes redundant IPsec tunnels across distinct interfaces to deliver an automated failover path and a 99.99% service level agreement (SLA).

Network Connectivity Center (NCC) spokes are attachment resources that connect different network types to an NCC hub, enabling site-to-site connectivity among on-premises and other cloud networks through Google's backbone. Spokes can be created using VPC networks, VPN tunnels, VLAN attachments (for Cloud Interconnect), or third-party router appliance virtual machines. They serve as the fundamental building blocks for hybrid and multi-cloud connectivity patterns.

Private Services Access (PSA) is a networking mechanism that lets resources inside a Virtual Private Cloud (VPC) network communicate privately with managed Google Cloud services like Cloud SQL without using external IP addresses. Administrators allocate a dedicated internal IP address range for the service producer using the gcloud compute addresses create command with the --purpose=VPC_PEERING flag. This allocation reserves a CIDR block that can be specified manually or assigned automatically by Google Cloud based on a requested prefix length. Once allocated, this address range is reserved exclusively for service producers and cannot be used for local subnets or custom static route destinations. For managed Google services, a /16 block is recommended, and the allocation must be at least a /24 block to prevent address exhaustion.

Cloud Router is a managed Google Cloud service that uses the Border Gateway Protocol (BGP) to exchange routing information between a Virtual Private Cloud (VPC) network and external networks, such as an on-premises data center. It works with connectivity services like Cloud Interconnect, Cloud VPN, and router appliances. The VPC network operates in either regional or global dynamic routing mode. In regional mode, the Cloud Router only advertises and learns routes for resources within its own region. In global mode, it exchanges routes for all subnets across every region in the VPC network, preferring local paths by assigning them a better metric.

A VPC-native Google Kubernetes Engine (GKE) cluster assigns IP addresses directly to Pods and Services from a Virtual Private Cloud (VPC) network's subnet ranges. This design uses alias IP ranges, where each Compute Engine node hosts an alias IP block from which its local Pods receive individual addresses. Traffic flows directly between Pods across VPC Network Peering connections and through Cloud VPN or Cloud Interconnect without requiring custom static routes or network address translation. This direct routing removes extra latency associated with routing hops and eliminates consumption of VPC static route quotas that limit routes-based clusters.

Cloud CDN accelerates web performance by caching content at Google's global edge points of presence (PoPs) close to end users. Cloud CDN attaches to backend services managed by a global or regional external Application Load Balancer. The load balancer routes incoming requests using a URL map to select a target backend service, which then distributes requests across supported origin types, including managed instance groups (MIGs), Cloud Storage buckets, and Cloud Run services. Network engineers enable edge caching on a backend service using the command line flag --enable-cdn alongside a specified cache mode. Secure delivery is managed at the target HTTP(S) proxy using SSL certificates, custom SSL policies, HTTP/2, HTTP/3, and TLS 1.3 early data.

Choosing the right load balancer in Google Cloud starts with understanding your traffic type and architectural needs. Application Load Balancers handle HTTP(S) traffic at Layer 7, offering content-aware routing. Network Load Balancers handle TCP, UDP, and other IP protocols at Layer 4, and come in proxy and passthrough subtypes. You must then decide between external load balancers for internet traffic and internal load balancers for traffic within your Virtual Private Cloud (VPC) or connected private networks. The scope is another key choice: global load balancers distribute traffic across multiple regions using a single anycast IP, while regional load balancers operate within a single region. Finally, proxy load balancers terminate client connections and open new ones to backends, while passthrough load balancers forward packets unchanged, preserving the original client source IP.

Cloud DNS is Google's managed Domain Name System (DNS) service that translates domain names into IP addresses. A managed zone is a container for all the DNS records of a specific domain. You manage different types of records and advanced routing policies within these zones to control how traffic is distributed.

Network Connectivity Center (NCC) connects different networks together by attaching them as spokes to a central hub resource. Google Cloud categorizes spokes into three distinct types based on the underlying resource: Virtual Private Cloud (VPC) spokes, hybrid spokes, and producer VPC spokes.

Dedicated Interconnect is a Google Cloud service that provides a direct, private physical connection between an on-premises network and Google's network. Planning and provisioning this infrastructure involves a multi-step workflow: you analyze bandwidth and redundancy needs, choose a colocation facility where Google's network is present, order the connection, and use a provided Letter of Authorization (LOA) to have your colocation vendor establish the physical cross-connect. After the physical Layer 1 and 2 connectivity is tested and active, you create logical VLAN attachments on top of it to enable Layer 3 routing.

High Availability VPN (HA VPN) is a Google Cloud service that creates secure, redundant IPSec tunnels between a Google Cloud Virtual Private Cloud (VPC) network and an on-premises VPN gateway. An HA VPN deployment has two main components: the HA VPN gateway in Google Cloud and the peer VPN gateway on the on-premises side. Google Cloud represents the peer device as an external VPN gateway resource, which stores the remote device’s IP addresses and interface configuration. The HA VPN gateway automatically receives two external IP addresses—one for interface 0 and one for interface 1—so that a failure on one path does not break connectivity.

BGP session authentication secures the connection between a Cloud Router and an external router using a shared MD5 key configured on both ends. This prevents unauthorized routers from establishing a session and injecting false routes. Link-local addresses are automatically assigned from the 169.254.0.0/16 range to each end of a Cloud Interconnect VLAN attachment for BGP peering. These addresses are not routable on the public internet, providing isolated communication for the BGP control plane between Google's cloudRouterIpAddress and your customerRouterIpAddress.

Drain mode is a backend configuration that gracefully halts new connections while allowing existing, active sessions to finish before scheduled maintenance begins. When an administrator places a backend service into a draining state, the Application Load Balancer immediately stops routing new client requests to those instances. The load balancer continues forwarding traffic for established connections, such as active file transfers or WebSocket sessions, until they finish or time out. Health checks continue running while a backend drains, but the draining state overrides a healthy status so the load balancing data plane excludes the instance from new traffic pools. After maintenance concludes, an administrator must manually remove the backend from drain mode, as it does not return to service automatically.

VPC Flow Logs records network flow samples across Virtual Private Cloud (VPC) networks to help engineers monitor traffic, perform security forensics, and optimize network costs. Flow logs capture traffic associated with VM instances, Google Kubernetes Engine nodes, Cloud Run Direct VPC egress, and Cloud Interconnect or Cloud VPN VLAN attachments. The logging process begins with packet sampling, aggregates those packets over a configurable interval between 5 seconds and 15 minutes, and then applies an optional secondary sampling rate. For outbound traffic, packets are sampled before egress firewall rules evaluate them, which allows administrators to log denied egress attempts. In contrast, inbound traffic is sampled after ingress firewall rules evaluate them, meaning denied ingress traffic is never recorded in VPC Flow Logs.

Network Topology is a visualization tool within the Network Intelligence Center that maps your network configuration and overlays real-time traffic metrics. It shows resources like virtual machine (VM) instances, groups them into expandable categories, and displays live data flows and throughput between entities. You can select any entity—a VM, subnet, or Cloud Router—to view ingress and egress byte counts, and expand time-series charts for up to six weeks to spot historical patterns such as sudden latency increases. For hybrid topologies, Network Topology displays connections like Cloud Interconnect, Cloud VPN, and Router Appliance instances as distinct points, allowing you to analyze traffic volume across individual VPN tunnels and VLAN attachments. If traffic nears a connection’s limit, you can view historical charts to diagnose recurring bottlenecks. For Google Kubernetes Engine (GKE), a dedicated view shows relationships between clusters, namespaces, workloads, and pods, tracking metrics like queries per second and HTTP latency. Traffic from external clients into GKE is visible down to the cluster level. The tool also helps evaluate path selection in complex multi-VPC and hybrid networks, where administrators choose between a mesh topology (all connected VPCs communicate directly) and a star topology (all traffic passes through a central hub VPC) in Network Connectivity Center (NCC). Cloud Router uses Border Gateway Protocol (BGP) to distribute routes across these topologies, and Private Service Connect (PSC) routes traffic privately to designated producer endpoints without full network exposure.

Optimizing port allocation and advanced NAT rule-based IP mapping involves configuring Cloud NAT to efficiently translate internal IP addresses to external IP addresses for outbound internet traffic. This process requires calculating the number of static IP addresses needed based on ports per VM to prevent port exhaustion, and using advanced NAT rules to route specific egress traffic through designated IPs.

A multi-NIC virtual machine is a single Compute Engine instance that connects to multiple VPC networks through separate network interfaces, allowing it to inspect and control traffic between different networks. Each network interface attaches to a different VPC or subnet, with one interface typically connected to an untrusted transit network and others connected to trusted internal networks. The appliance must have IP forwarding enabled on its network interfaces to forward traffic between them, and instance-level firewall rules must be configured to allow the intended traffic flows.

Planning a Google Cloud firewall strategy involves selecting the right combination of native distributed firewalls and third-party network virtual appliances to secure traffic across an organization. Organizations build a layered defense by combining broad organization-wide guardrails, project-level network policies, and workload-specific filtering. Native options include hierarchical firewall policies, global network firewall policies, regional network firewall policies, and legacy Virtual Private Cloud (VPC) firewall rules. When organizations require vendor-specific threat feeds, deep Layer 7 packet inspection, or parity with on-premises equipment, they integrate third-party firewall appliances into their architecture.

Cloud Armor provides two main types of security policies for protecting services behind a load balancer: edge security policies and backend security policies. These policies work with Cloud CDN and load balancers to filter malicious traffic. The key difference is when in the request flow they are applied.