Design, implement, and secure Google Cloud networks, from VPCs and hybrid connectivity to load balancing and Cloud Armor, and track your readiness for the Professional Cloud Network Engineer exam.
Prepare and test your skills
Prepare and test your skills
Policy-based routing (PBR) is a Google Cloud Virtual Private Cloud (VPC) networking capability that directs traffic to specific next hops by evaluating packet headers beyond destination IP addresses. While standard static routes match only destination IP ranges, policy-based routes evaluate the source IP address, destination IP address, protocol, and port numbers (the 5-tuple). This matching lets administrators redirect traffic to next-hop internal load balancers, network virtual appliances (NVAs), or a Secure Web Proxy. When deploying policy-based routes, administrators must create a specific route for the intended workload and a separate default-routing route using --next-hop-other-routes="DEFAULT_ROUTING" so unmatched inter-VM traffic continues to flow normally.
Route priority determines the sequence in which Google Cloud evaluates policy-based routes, with lower numerical values indicating higher priority from 0 (highest) to 65535 (lowest). Policy-based routes are evaluated before standard subnet routes and static routes in the routing order. When routing to a Secure Web Proxy, the default-routing policy-based route must have a lower numerical priority (higher priority) than the proxy redirection route to prevent non-proxy traffic from being blocked. If multiple policy-based routes share identical priorities and match a packet, an internal algorithm picks a single route that might not be the most specific match; assigning unique priorities avoids this ambiguity.
Policy-based routes differ from static routes because static routes filter traffic using network tags and destination ranges, whereas policy-based routes filter using source IP ranges. A Secure Web Proxy configured with NEXT_HOP_ROUTING_MODE only supports HTTP, HTTPS, and TCP proxy traffic; unsupported traffic, including cross-region traffic, is dropped without notification. Furthermore, a single VPC network in a given region can host only one Secure Web Proxy as a next-hop instance. When a route matches a virtual machine (VM), all VM traffic—including background tasks and system updates—is steered to that next hop.
Dynamic routing mode controls how Cloud Router shares learned dynamic routes across regions within a VPC network. In regional dynamic routing mode, a Cloud Router shares learned routes only with resources located in its own local region. In global dynamic routing mode, Cloud Router distributes learned routes to resources in every region across the entire VPC network. Global dynamic routing enables virtual machines in any region to reach on-premises networks across all hybrid interconnects and VPN tunnels.
Route propagation in global dynamic routing mode is restricted by regional capacity quotas. When global routing is active, a Cloud Router in one region attempts to propagate up to 250 unique destinations to other regions. Each target region enforces a "from-other-regions" quota of 250 unique destinations; exceeding this limit causes the network to drop excess routes. Additionally, if a packet matches a hybrid subnet route whose destination is not active, dynamic routes learned in other regions will drop the packet rather than forwarding it across regions.
Border Gateway Protocol (BGP) path selection determines how Cloud Router and on-premises routers select optimal paths using metric attributes. The BGP selection process prioritizes paths with the highest Local Preference first, followed by the shortest Autonomous System (AS) path length. When AS path lengths are equal, the Multi-Exit Discriminator (MED) breaks the tie, with lower MED values being preferred. Cloud Router sets MED values to guide inbound traffic from on-premises networks, while Google Cloud adds an inter-region dynamic metric cost to steer outbound traffic through local regional paths instead of distant cross-region links.
Cloud Router base advertised priorities are whole numbers between 0 and 65535 that configure how on-premises routers direct return traffic into a VPC network. A base priority of 0 is the highest possible priority, while 100 serves as the default value. When two BGP sessions on Cloud VPN or Cloud Interconnect share identical base priorities, the network operates in an active-active topology using Equal-Cost Multi-Path (ECMP) routing. In contrast, assigning different base priorities creates an active-passive failover configuration where on-premises devices direct primary traffic to the lowest numerical priority.
Google Cloud automatically generates region-to-region cost metrics between 201 and 9999 based on physical distance and network latency. The overall MED metric advertised over BGP equals the Cloud Router base priority added to this region-to-region cost. Administrators keep local base priorities between 0 and 200 to ensure local hybrid paths take precedence over remote region paths. Configuring a secondary path with a base priority of 10200 or higher guarantees that it stays in backup status behind any local path configured with a priority of 200 or less.
Network Connectivity Center (NCC) applies a strict hierarchy to resolve overlapping route advertisements between connected hybrid spokes and VPC networks. When destination prefixes overlap in a hub routing table, the system selects landing VPC subnets first, hub subnets second, and Cloud Router custom routes last. Network Connectivity Center prevents duplicate subnet overlaps between routing VPC subnets and spoke hub subnets. If an administrator creates a custom route advertisement that overlaps with a landing VPC subnet or an imported hub subnet, Cloud Router ignores the custom route advertisement.
Policy-based routing evaluates traffic using 5-tuple criteria—source IP address, destination IP address, protocol, and port numbers—whereas standard static routes evaluate only destination IP ranges and network tags. In addition, Google Cloud processes policy-based routes earlier in the routing hierarchy than standard subnet routes and static routes.
Network Connectivity Center applies a hierarchy that selects landing Virtual Private Cloud subnets first, hub subnets second, and Cloud Router custom routes last. If a custom route advertisement overlaps with an existing landing subnet or an imported hub subnet, Cloud Router automatically ignores the custom route.
In global dynamic routing mode, a Cloud Router can propagate up to 250 unique destinations to other regions, and each receiving region enforces an incoming quota of 250 unique destinations. If dynamic route propagation exceeds this limit of 250 unique destinations, the network drops the excess routes.
Last updated