Configuring and implementing hybrid and multicloud network interconnectivity

Cloud Interconnect is a direct physical connection between your on-premises network and Google's network, bypassing the public internet entirely. It comes in two flavors: Dedicated Interconnect, where you provision a private circuit directly from your data center to a Google colocation facility, and Partner Interconnect, where you connect through a supported service provider. Because the traffic never travels over the public internet, Cloud Interconnect offers lower latency, higher bandwidth (up to 100 Gbps per connection for Dedicated), and a more consistent experience than a VPN. You must configure a Cloud Router to exchange routes with your on-premises network over this connection, and you can use multiple Interconnect attachments for redundancy.

A site-to-site IPSec VPN creates an encrypted tunnel between your on-premises VPN gateway and a Cloud VPN gateway in your VPC, sending traffic over the public internet. It is the most affordable way to connect to Google Cloud, but its performance depends on the quality of your internet link and can be less reliable than a dedicated connection. You can use either a classic VPN (static routing) or a HA VPN (high-availability VPN with dynamic routing). HA VPN uses two external IP addresses and two tunnels to provide a 99.99% SLA when configured with a Cloud Router and BGP. The VPN gateway sits at the edge of your VPC, and traffic flows through the tunnel to reach resources in your private subnets.

Cloud Router is a managed BGP (Border Gateway Protocol) router that dynamically exchanges routes between your on-premises network and your VPC. It works with both Cloud Interconnect and Cloud VPN, learning the subnets on each side and automatically updating routes when networks change. You create a Cloud Router in a region, then attach it to a VPN tunnel or an Interconnect VLAN attachment. The router advertises your VPC’s IP ranges to the on-premises side and receives the on-premises ranges in return, so traffic can flow in both directions without manual static route entries. Cloud Router also supports custom route advertisements and route priorities, letting you control which path traffic takes when multiple connections exist.

Network Connectivity Center is a hub-and-spoke service that centralizes the management of multiple hybrid and multicloud connections. You create a hub in a region, then attach spokes such as Cloud VPN tunnels, Cloud Interconnect attachments, or connections to third-party routers. The hub automatically propagates routes between all spokes, so a single on-premises site can reach multiple VPCs or other on-premises locations through the hub without needing a full mesh of tunnels. Network Connectivity Center also supports policy-based routing to control how traffic flows between spokes, and it integrates with Cloud Router to exchange BGP routes. This simplifies the network topology when you have many sites or clouds to connect.

Key Facts

• Cloud Interconnect provides a direct physical connection to Google’s network, while site-to-site IPSec VPN uses the public internet with encryption.
• Cloud Router uses BGP to dynamically exchange routes between on-premises and VPC networks, working with both Interconnect and VPN.
• Network Connectivity Center acts as a central hub that connects multiple spokes (VPN, Interconnect, third-party) and automatically propagates routes between them.
• HA VPN with Cloud Router offers a 99.99% SLA when configured with two tunnels and dynamic routing.