A financial company establishes an HA VPN connection between their on-premises network and a Hub VPC in Google Cloud. They then connect a Spoke VPC to the Hub VPC using VPC Network Peering. Workloads in the Spoke VPC are unable to communicate with hosts in the on-premises data center. What is the fundamental cause of this connectivity failure?
- VPC Network Peering does not support transitive routing, preventing traffic from passing from the Spoke VPC through the Hub VPC to the on-premises network.Answer
- BHA VPN connections strictly forbid carrying traffic originated from peered Google Cloud networks under any routing topology.
- CVPC Network Peering automatically disables Cloud Router dynamic BGP route propagation for all connected networks.
- DHA VPN must be replaced with Dedicated Interconnect to support multi-VPC connectivity.
Answer
VPC Network Peering does not support transitive routing, preventing traffic from passing from the Spoke VPC through the Hub VPC to the on-premises network.
VPC Network Peering in Google Cloud is strictly non-transitive. If VPC A is peered with VPC B, and VPC B is connected to an on-premises network via HA VPN or Interconnect, VPC A cannot reach the on-premises network through VPC B unless an explicit transit architecture (such as Network Connectivity Center or appliance proxies) is used.
Step-by-Step Solution
Key Concept
VPC Network Peering Non-Transitivity