Design, implement, and secure Google Cloud networks, from VPCs and hybrid connectivity to load balancing and Cloud Armor, and track your readiness for the Professional Cloud Network Engineer exam.
Prepare and test your skills
Prepare and test your skills
The dynamic routing mode of a Virtual Private Cloud (VPC) network determines how Cloud Router instances propagate routes learned via Border Gateway Protocol (BGP) to VPC subnetworks and advertise VPC subnets to external networks. Every VPC network operates in either regional or global dynamic routing mode, which sets the routing behavior for all Cloud Routers inside that network. This setting controls the geographic scope of route sharing, directly affecting hybrid connectivity, multi-region resiliency, and path selection across Google Cloud regions.
Regional dynamic routing mode restricts the exchange and programming of dynamic routes to resources located strictly within the same Google Cloud region as the Cloud Router. In this mode, a Cloud Router shares only the subnet routes from its local region with the external BGP peer router. When the Cloud Router receives learned BGP routes from an external network or Cloud VPN tunnel, it installs those custom dynamic routes solely for subnets located in that specific region. Workloads residing in other Google Cloud regions do not receive these learned routes and cannot use the local hybrid connection for transit.
Global dynamic routing mode extends route exchange across the entire VPC network, allowing Cloud Routers to propagate and learn dynamic routes across all regions. In this mode, each Cloud Router advertises subnet IP address ranges from every region in the VPC network to the external peer network. Concurrently, BGP routes learned by a Cloud Router in one region are programmed into the route tables of subnets across all regions. Cloud Router applies predetermined path preferences based on regional proximity, directing traffic across Google's global backbone network to exit through the Cloud Router closest to the destination.
Architectural decisions between dynamic routing modes balance multi-region availability requirements against regional data isolation. Choose regional dynamic routing when hybrid traffic must remain strictly localized to prevent cross-region transit costs and maintain isolated failure domains between regions. Choose global dynamic routing when building multi-region architectures, active-active or active-passive inter-domain redundancy, or centralized transit hub VPC networks. Global dynamic routing ensures that if a local hybrid connection fails, traffic from that region can automatically fail over to a functional Cloud Router located in an alternate region.
Border Gateway Protocol (BGP) policies and traffic engineering in Google Cloud involve configuring Cloud Router to control how routes are advertised, learned, and selected across hybrid connections. These configurations allow administrators to manage path selection, implement failover strategies, and distribute traffic across multiple hybrid links. By managing routing attributes, networks can satisfy specific performance, cost, and availability requirements.
A BGP session establishes a dynamic routing relationship between a Cloud Router and an external peer router over Cloud Interconnect, Cloud VPN, or Router appliance instances. Each BGP session is tied to the specific connectivity resource that uses the Cloud Router and cannot be shared across different network products. In regional dynamic routing mode, the Cloud Router advertises only local regional subnets to the peer. In global dynamic routing mode, Cloud Router advertises all VPC subnets across all regions, applying a Multi-Exit Discriminator (MED) penalty equal to 200 plus the round-trip time in milliseconds between regions to prefer local paths.
Custom route advertisements allow administrators to specify exactly which IP prefixes a Cloud Router announces to peer networks instead of relying on default advertisements. By default, Cloud Router automatically advertises all VPC subnets matching the active dynamic routing mode. Custom route advertisements override or expand this behavior to announce specific public or private IP ranges, filter out internal prefixes, or modify the base priority of advertised routes. This mechanism provides precise control over how external networks reach Google Cloud resources and prevents the unintended exposure of internal subnets.
Multi-Exit Discriminators (MED) and AS path prepending are BGP attributes used on Cloud Router to steer ingress traffic across multiple hybrid connections. Multi-Exit Discriminators (MED) act as a priority metric where external peers prefer routes with lower MED values for inbound traffic to Google Cloud. AS path prepending artificially lengthens the autonomous system path by repeating the local Autonomous System Number (ASN), making a route look less attractive to external peers. These two mechanisms enable active-passive failover by directing normal traffic to a primary low-metric path, or active-active load sharing by advertising matching path metrics across redundant links.
Hybrid connectivity configurations impose specific structural requirements on Cloud Routers when integrating different transport types. When deploying High Availability (HA) VPN over Cloud Interconnect, network designs require two distinct Cloud Routers: one dedicated to Cloud Interconnect to forward only encrypted traffic to the VLAN attachment, and a second regular Cloud Router to establish BGP sessions for the HA VPN tunnels. For Partner Interconnect deployments, Cloud Router must use ASN 16550 for all BGP sessions. A Cloud Router configured with ASN 16550 for Partner Interconnect can only manage BGP sessions for other Partner Interconnect attachments, with an exception allowing Dedicated Interconnect attachments when ASN 16550 is acceptable.
Dynamic route exchange in complex multi-VPC topologies coordinates route distribution across multiple VPC networks and on-premises environments using Cloud Router, HA VPN, Cloud Interconnect, and Network Connectivity Center. These architectures establish scalable, multi-region connectivity while preventing network loops, quota limits, and unexpected cross-region data transfer charges. Administrators balance isolation against transit reachability when selecting dynamic routing designs for enterprise scale.
High Availability (HA) VPN gateways use BGP to exchange dynamic routes across dual tunnels connecting VPC networks or external environments. In an active-active setup, both tunnels forward traffic concurrently to aggregate bandwidth, though a tunnel failure can drop packets if the remaining link lacks sufficient capacity. In an active-passive setup, only the primary tunnel carries traffic while the secondary tunnel remains on standby, maintaining predictable throughput during failover. For a single HA VPN gateway, active-passive routing is recommended for predictable operation, whereas active-passive across multiple gateways should be avoided because standby tunnels will not activate until all active tunnels across all gateways fail.
Connecting two VPC networks directly with HA VPN provides secure transit and dynamic route exchange between distinct cloud environments. To obtain the 99.99% availability Service Level Agreement (SLA), both HA VPN gateways must reside in the same region, with Tunnel 0 linking interface 0 and Tunnel 1 linking interface 1 between the gateways. Deploying HA VPN gateways in different regions reduces the availability SLA to 99.9%. When interconnecting three or more VPC networks, administrators deploy a hub-and-spoke transit topology that connects each spoke VPC to a central hub VPC through dedicated HA VPN gateways.
Network Connectivity Center provides a centralized hub-and-spoke control model that automates dynamic route exchange across VPC networks, hybrid connections, and third-party router appliances. The dynamic routing mode of the hub VPC network governs how learned routes propagate from hybrid spokes to attached VPC spokes. If the hub VPC uses regional dynamic routing, hybrid spoke routes reach only VPC spokes in that local region; if the hub VPC uses global dynamic routing, hybrid routes reach VPC spokes across all regions. Spoke administrators enable subnet route propagation by setting the includeImportRanges field to ALL_IPV4_RANGES or by configuring custom route advertisements on the hybrid Cloud Routers.
Multi-VPC architectures often employ a dedicated transit VPC network connected via Network Connectivity Center to avoid building a complex full mesh of point-to-point links. In this model, external links such as Cloud Interconnect or Cloud VPN terminate inside a central transit VPC that acts as a hub for multiple workload spoke VPCs. A transit hub architecture can also host shared security infrastructure, such as centralized firewalls and inspection proxies, enabling any-to-any communication between spokes. This centralized design consolidates external dynamic routing policies, simplifies peering topologies, and minimizes administrative overhead.
Managing dynamic routes across complex topologies requires proactive safeguards against routing loops, resource limits, and inter-region costs:
Regional dynamic routing mode restricts Cloud Router to advertising and programming dynamic routes strictly within the same Google Cloud region, whereas global dynamic routing mode advertises subnet ranges from all regions and installs learned Border Gateway Protocol (BGP) routes network-wide across every region. In global mode, Cloud Router applies a Multi-Exit Discriminator (MED) penalty of 200 plus the round-trip latency in milliseconds to prefer local regional paths over cross-region paths.
To qualify for the 99.99% availability Service Level Agreement (SLA), both High Availability (HA) VPN gateways must reside in the same Google Cloud region, with Tunnel 0 linking interface 0 and Tunnel 1 linking interface 1 between the gateways. Deploying HA VPN gateways across different regions reduces the availability SLA to 99.9%.
The dynamic routing mode of the hub Virtual Private Cloud (VPC) network governs how routes learned from hybrid spokes propagate to attached VPC spokes. If the hub VPC network uses regional dynamic routing, hybrid spoke routes reach only VPC spokes located in that local region. When the hub VPC operates in global dynamic routing mode, hybrid spoke routes are propagated to VPC spokes across all regions.
Deploying High Availability (HA) VPN over Cloud Interconnect requires two distinct Cloud Routers. One Cloud Router is dedicated to Cloud Interconnect to forward only encrypted traffic to the VLAN attachment, while a second regular Cloud Router establishes Border Gateway Protocol (BGP) sessions for the HA VPN tunnels.
Last updated