An organization is operating three Virtual Private Cloud (VPC) networks in Google Cloud: vpc-frontend, vpc-hub, and vpc-backend. To centralize administration, vpc-frontend is peered with vpc-hub, and vpc-backend is also peered with vpc-hub. Compute Engine instances in vpc-frontend need to communicate directly with internal workloads in vpc-backend. Network administrators observe that traffic sent from vpc-frontend to vpc-backend is dropped, even though both networks are successfully peered with vpc-hub. Which network topology modification should be implemented to enable connectivity between vpc-frontend and vpc-backend?
- Establish a direct VPC Network Peering connection between vpc-frontend and vpc-backend.Answer
- BEnable custom route import and export flags on the existing VPC Network Peering connections attached to vpc-hub to allow transitive routing.
- CReplace the VPC Network Peering connections with HA VPN tunnels to vpc-hub, because HA VPN automatically enables transitive BGP routing between connected VPCs without extra configuration.
- DConfigure a VPC Service Controls perimeter encompassing all three VPCs and add an ingress rule permitting inter-VPC traffic forwarding through vpc-hub.
Answer
Establish a direct VPC Network Peering connection between vpc-frontend and vpc-backend.
VPC Network Peering in Google Cloud is explicitly non-transitive. Traffic originating in one peered network cannot traverse a intermediate network to reach a third network. To allow direct communication between two spoke VPC networks, an explicit direct VPC Network Peering connection must be established between them.
Step-by-Step Solution
Key Concept
VPC Network Peering Non-Transitivity