An organization is deploying a multi-VPC environment in Google Cloud consisting of a Management VPC, a Workload VPC, and a Hybrid Connectivity VPC connected to an on-premises data center using HA VPN and Cloud Router. The team requires direct private connectivity between the Management VPC and Workload VPC, as well as multi-region reachability for hybrid routes across all deployed subnets. Which TWO actions should the cloud architect take to configure this network topology according to Google Cloud recommended practices?
- Establish direct VPC Network Peering between the Management VPC and the Workload VPC to enable direct, non-transitive communication between their resources.Answer
- BPeer both the Management VPC and the Workload VPC to the Hybrid Connectivity VPC so on-premises traffic can reach both VPCs via transitive peering routing.
- Configure the VPC network dynamic routing mode to Global on the Hybrid Connectivity VPC to allow Cloud Router to propagate routes across all regions.Answer
- DReplace HA VPN with Classic VPN configured with static routes to achieve continuous dynamic routing updates across all subnets.
- ERely strictly on standard IAM roles to prevent unauthorized cross-VPC data access without deploying VPC Service Controls or firewall rules.
Answer
Establish direct VPC Network Peering between the Management VPC and the Workload VPC, and set the dynamic routing mode to Global on the Hybrid Connectivity VPC's Cloud Router configuration.
Establishing direct VPC Network Peering ensures low-latency, private connectivity between the Management and Workload VPCs without relying on non-supported transitive routing. Setting the VPC dynamic routing mode to Global ensures Cloud Router dynamically propagates BGP routes from on-premises to subnets in all regions across the VPC.
Step-by-Step Solution
Key Concept
VPC Network Peering Non-Transitivity and Global Dynamic Routing