Design, implement, and secure Google Cloud networks, from VPCs and hybrid connectivity to load balancing and Cloud Armor, and track your readiness for the Professional Cloud Network Engineer exam.
Prepare and test your skills
Prepare and test your skills
Google Cloud Observability is a unified platform that combines logging, monitoring, and tracing to help engineers understand how their network and applications are performing. The platform includes Cloud Logging, which collects and stores log entries from Google Cloud resources, and Cloud Monitoring, which collects metrics from those same resources to show how they behave over time. Network engineers use these tools together because logs tell them what happened while metrics show them how well services are running. When a network issue occurs, the engineer can search logs for error messages while simultaneously looking at metric dashboards to see whether latency has spiked or throughput has dropped.
The observability platform organizes data around three main concepts: metrics, logs, and traces. Metrics are numerical measurements like the number of packets dropped or the round-trip time between two instances, and they are collected automatically by monitoring agents. Logs are timestamped text entries that describe events, such as a firewall rule change or a failed connection attempt, and they can be filtered by severity level and resource type. Traces follow a single request as it travels through multiple services, showing exactly where delays occur in a distributed system. All three data types can be viewed in the Cloud Console, and alerts can be configured to notify engineers when metrics cross thresholds that indicate problems.
Continue with this study guide: Logging and monitoring with Google Cloud Observability
Maintaining network connectivity in Google Cloud requires regular checks of firewall rules, routing tables, and VPN tunnels to ensure they remain correctly configured as the environment evolves. Firewall rules in GCP are stateful, meaning that if traffic is allowed in one direction, the response is automatically allowed back regardless of outbound rules. When troubleshooting connectivity, engineers typically start by verifying that firewall rules permit the required traffic, then check whether the traffic is actually reaching its destination by examining flow logs. VPC Flow Logs record the source and destination IP addresses, ports, protocol, and bytes transferred for each network flow, and they can be enabled at the subnet level to capture traffic patterns.
Connectivity issues often stem from misconfigured routing, overlapping IP ranges, or asymmetric paths where outbound and return traffic take different routes. VPC networks use routes to direct traffic between subnets and to the internet, and each route has a priority value that determines which route applies when multiple routes match a destination. When a VM cannot reach an external IP address, the engineer checks whether a default route exists and whether the VM has a public IP attached or sits behind a NAT gateway. For internal connectivity problems, the engineer verifies that both VMs are in the same VPC network or in peered VPC networks, and that firewall rules allow traffic on the required ports. VPN tunnels require careful attention to phase settings, shared secrets, and routing configuration on both the Google side and the on-premises side.
Continue with this study guide: Maintaining and troubleshooting connectivity issues
Network Intelligence Center is a Google Cloud service that provides visual dashboards and diagnostic tools specifically designed for network monitoring and troubleshooting. The service includes several modules: Connectivity Tests let engineers verify reachability between two endpoints by simulating traffic without actually sending it, which helps identify where packets would be dropped before deploying an application. The module tests both internal IP addresses within a VPC and external IP addresses on the internet, and it reports the exact route a packet would take and which firewall rule or route would block it.
Network Intelligence Center also includes dashboards for monitoring firewall compliance, VPC flow logs analysis, and performance validation across network paths. The firewall insights feature analyzes existing firewall rules to identify overly permissive rules or rules that do not match any actual traffic, helping engineers apply the principle of least privilege. Performance dashboards show latency, throughput, and packet loss between different zones and regions, which is especially useful when diagnosing slow responses in multi-region deployments. When combined with Cloud Logging and Cloud Monitoring, Network Intelligence Center forms a complete toolkit for observing network behavior, testing connectivity before deploying changes, and diagnosing the root cause of problems after they occur.
Connectivity Tests simulate traffic between endpoints without actually sending packets to verify whether reachability is possible. The module reports the exact route a packet would take and identifies the specific firewall rule or route that would block it.
Firewall rules in Google Cloud are stateful, meaning that allowing traffic in one direction automatically permits the return response regardless of outbound rules. Because return traffic is allowed automatically, separate outbound firewall rules are not required for those connections.
VPC Flow Logs capture the source and destination IP addresses, ports, protocol, and bytes transferred for each network flow. They are configured at the subnet level to help analyze traffic patterns and verify whether traffic is reaching its destination.
Cloud Logging collects timestamped text entries describing specific events, whereas Cloud Monitoring collects numerical measurements over time to show how services perform. Logs help engineers discover what occurred during a network issue, while metrics indicate how well services are running through indicators like latency and throughput.
Last updated