Setting up static and dynamic routing (e.g., Cloud Router).

Cloud Router is a managed Google Cloud service that enables dynamic routing between your Virtual Private Cloud (VPC) network and external networks, like your on-premises data center. It uses the Border Gateway Protocol (BGP) to automatically exchange routing information, updating the VPC's routing tables without any manual intervention when network paths change.

1.1Cloud Router Architecture and Dynamic Routing Modes

A Cloud Router is a control plane service that establishes BGP peering sessions. It works with connectivity services like Cloud Interconnect, Cloud VPN, and router appliances. The routes it learns are applied based on the VPC network's dynamic routing mode. In regional dynamic routing mode, the Cloud Router only advertises and learns routes for resources within its own region. In global dynamic routing mode, it exchanges routes for all subnets across every region in the VPC network, preferring local paths by assigning them a better metric.

1.2Autonomous System Numbers and Peering Configuration

Establishing a BGP session requires configuring an Autonomous System Number (ASN) for both the Cloud Router and the external peer router. For Partner Interconnect, you must use Google's public ASN 16550. For Dedicated Interconnect, HA VPN, or router appliances, you configure a private ASN (like 65001) for the Cloud Router. The IP addresses used for the BGP connection depend on the underlying service: Cloud Interconnect and Cloud VPN use link-local addresses (like 169.254.0.0/29), while router appliances use standard internal IPs from the VPC subnet. All BGP traffic uses TCP port 179, which must be allowed through any relevant firewalls.

1.3Dynamic BGP Session Attributes, Timers, and Authentication

Each BGP session on a Cloud Router pairs an interface with a peer configuration. You can tune session behavior by setting BGP timers, like keepalive and hold-time intervals, to control how quickly the session detects a failure. For stability, you can enable graceful restart to maintain data flow during router maintenance. For security, you can enable MD5 authentication to validate BGP control packets. You can also set a Multi-Exit Discriminator (MED) value (called advertised route priority) on each session; a lower MED gives that path a higher preference for inbound traffic.

1.4Custom Route Advertisements and Deterministic Routing

By default, Cloud Router advertises all subnet routes (ALL_SUBNETS mode). You can set it to CUSTOM advertisement mode to selectively advertise only specific IP ranges, including custom CIDRs, Google API addresses, or health-check ranges. This provides precise control over what you announce to peers. For redundant connections, path selection is managed via MED values. Equal MEDs on multiple sessions trigger Equal-Cost Multipath (ECMP) routing, balancing traffic evenly (active/active). Unequal MEDs create an active/passive setup, where traffic prefers the lower-MED path and fails over to the higher-MED backup only if the primary fails.

Advanced route management involves fine-tuning how Cloud Router shares routes with peer networks using custom advertisements, MED values, and policies to enforce specific traffic patterns and ensure rapid failure detection in hybrid architectures.

2.1Custom Route Advertisements

When the default route advertisements don't meet your needs, you can configure custom advertisements. This involves setting the Cloud Router's advertisement mode to CUSTOM and then specifying the exact IP ranges you want to announce. This is useful for summarizing routes to reduce prefix count or for filtering out sensitive internal ranges from being exposed to external networks.

2.2Multi-Exit Discriminators (MED) and BGP Route Policies

Multi-Exit Discriminators (MED) are used to influence how peer networks send traffic into your Google Cloud network. By setting different advertised route priorities (MED values) on redundant paths, you can create deterministic active/passive failover. For example, in an HA VPN setup, you would set a lower MED (like 10) on the primary tunnel and a higher MED (like 20) on the secondary tunnel, forcing all inbound traffic to prefer the primary path.

2.3Bidirectional Forwarding Detection (BFD)

Bidirectional Forwarding Detection (BFD) is a protocol that provides sub-second link failure detection, which is much faster than standard BGP timers. When BFD is enabled on a VPN tunnel with dynamic routing, the Cloud Router can detect a failure and remove the affected routes from the routing table within the BGP hold timer period, accelerating convergence and reducing potential packet loss.

2.4Redundant Topologies for High Availability

Designing for high availability requires redundant connections. Active/active designs use ECMP to load-balance traffic across multiple equal-cost paths. Active/passive designs keep one link as a standby. For Cloud Interconnect, redundancy requires at least two connections in different edge availability domains within the same region. Cloud Router itself is distributed across zones within a region for resiliency. Multi-region designs connect networks in different geographical areas to achieve even higher availability (99.99%).

A static route is a manually created, permanent entry in a VPC routing table that directs traffic for a specific destination to a predefined next hop. It is used for deterministic routing and controlled failover, unlike dynamic routes which are learned automatically.

3.1Key Parameters of a Static Route

Every static route is defined by its Network (the VPC), Destination range (a single CIDR block like 10.2.0.0/16), Priority (a number from 0 to 65535, where lower is better), and Next hop (the target resource). You can optionally use Network tags to restrict the route to apply only to specific VM instances.

3.2Supported Next-Hop Types

Static routes can direct traffic to several types of next hops. You can send traffic to the default internet gateway. You can specify a next-hop instance (a specific VM with IP forwarding enabled). You can use a next-hop internal passthrough Network Load Balancer to distribute traffic across a backend group. You can also direct traffic to a next-hop Classic VPN tunnel that uses static routing.

3.3Route Selection and Priority Logic

Google Cloud evaluates routes in a strict order when forwarding a packet. First, it checks for a matching subnet route; if one exists, it is used exclusively and all custom static routes are ignored. If no subnet route matches, the system then selects the most specific destination among the remaining static and dynamic routes. Among custom routes, local VPC routes are preferred over imported peering routes. Finally, if multiple routes have the exact same destination, the route with the highest priority (lowest numerical value) is selected.

3.4Configuring Static Routes with Different Next Hops

To create a static route, you define its parameters in the VPC network. For a next-hop instance, the target VM must exist and have IP forwarding enabled. For a next-hop load balancer, the load balancer must be created first. A static route's destination cannot overlap with or be more specific than any existing subnet route in the VPC. To configure failover, you create a primary route with a higher priority (e.g., 100) and a secondary route to a different next hop with a lower priority (e.g., 200); traffic will only use the secondary path if the primary next hop becomes unreachable.

3.5Interactions and Limitations

Static routes can be exchanged with peered VPC networks, except for routes that use the default internet gateway or network tags. Within Network Connectivity Center, a static route in one spoke can use a load balancer in another spoke as its next hop if the hub's policy allows it. The key limitation is that a static route is always overridden by a more general subnet route for the same destination, both within the VPC and across peered networks.

Key Facts

• Cloud Router is a fully managed BGP speaker that dynamically exchanges routes between Google Cloud VPCs and external networks like on-premises data centers.
• The VPC's dynamic routing mode (regional or global) determines whether Cloud Router advertises and learns routes only within its region or across all regions in the network.
• Static routes are manually configured paths with a fixed next hop and priority; they are overridden by any matching subnet route in the VPC.
• For redundant connections, Equal-Cost Multipath (ECMP) provides active/active load balancing, while unequal Multi-Exit Discriminator (MED) values create an active/passive failover setup.
• Bidirectional Forwarding Detection (BFD) provides sub-second link failure detection, significantly speeding up convergence compared to standard BGP timers.