A fintech enterprise is designing a hybrid network architecture to connect its on-premises transactional data center to a Google Cloud Virtual Private Cloud (VPC) hosting microservices across two GCP regions. The connection must support a aggregate throughput of 2 Gbps, mandate IPsec encryption for all data in transit over the wire, and automatically handle failover across both regions. The company does not reside in a Google Cloud colocation facility. Which TWO architectural options should the lead cloud architect select to fulfill these requirements?
- Deploy High Availability (HA) Cloud VPN gateways in each GCP region to connect to the on-premises VPN devices.Answer
- Configure Cloud Router with dynamic Border Gateway Protocol (BGP) routing in both GCP regions.Answer
- CEstablish VPC Network Peering directly between the on-premises network routers and the Google Cloud VPC network.
- DProvision a single 10 Gbps Dedicated Interconnect circuit because Cloud VPN cannot support bandwidth exceeding 1 Gbps.
Answer
The correct architecture requires deploying High Availability (HA) Cloud VPN gateways in each region combined with Cloud Router running BGP dynamic routing.
Deploying HA Cloud VPN gateways satisfies the mandatory IPsec encryption and the 2 Gbps bandwidth requirement (as HA VPN supports 3 Gbps per tunnel). Combining HA VPN with Cloud Router running BGP enables automated dynamic routing, multi-region path selection, and high-availability failover without manual static route updates.
Step-by-Step Solution
Key Concept
Designing High-Availability Encrypted Hybrid Connectivity with HA VPN and Cloud Router