A financial analytics company is connecting its on-premises data center to a Google Cloud VPC to enable secure, dynamic routing for operational workloads with a required 99.99% service level agreement (SLA). The network design mandates automatic failover and dynamic route propagation without manual static route adjustments. Which TWO configuration steps must the cloud architect perform in Google Cloud to meet these requirements?
- Provision an High Availability (HA) Cloud VPN gateway with dual interfaces and configure two IPsec tunnels connected to the on-premises VPN router.Answer
- Configure a Cloud Router in the VPC network with a Google Autonomous System Number (ASN) to establish Border Gateway Protocol (BGP) sessions over the VPN tunnels.Answer
- CDeploy a single Classic VPN gateway operating with static routes to manage encrypted transit traffic up to 10 Gbps with 99.99% SLA guarantees.
- DEnable VPC Network Peering between the hybrid landing VPC and secondary VPCs to propagate on-premises BGP routes transitively across all peered networks.
- EAssign primitive IAM Network Admin roles to the Cloud VPN gateway to enforce security perimeters and prevent unauthorized data exfiltration to external Cloud Storage buckets.
Answer
To establish a 99.99% SLA hybrid connectivity topology with dynamic routing, the architect must deploy an HA Cloud VPN gateway with dual interfaces connecting two IPsec tunnels, and configure a Cloud Router to manage BGP sessions across those tunnels.
Achieving a 99.99% SLA for encrypted hybrid connectivity in Google Cloud strictly requires deploying an HA Cloud VPN gateway utilizing both interfaces connected to redundant on-premises VPN devices. Furthermore, HA Cloud VPN mandates the use of Cloud Router to establish dynamic BGP sessions for automated route propagation and zero-touch failover.
Step-by-Step Solution
Key Concept
High Availability Cloud VPN and Dynamic BGP Routing via Cloud Router