Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

An organization maintains a central shared services VPC network (shared-svc-vpc) connected to their on-premises environment using an HA VPN gateway with Cloud Router dynamic routing. To host a new line-of-business workload, the infrastructure team provisions a dedicated application VPC (app-vpc) and establishes a VPC Network Peering connection between app-vpc and shared-svc-vpc. Workloads in app-vpc successfully communicate with internal services residing directly in shared-svc-vpc, but they are unable to reach any on-premises servers over the HA VPN link. What is the root cause of this connectivity behavior, and how should the network topology be configured to allow app-vpc to reach on-premises?

  1. VPC Network Peering does not support transitive routing across third-party networks or VPN gateways; configure a separate VPN connection or Network Connectivity Center hub to establish direct hybrid routing for app-vpc.Answer
  2. B
    VPC Network Peering natively supports transitive routing, but the peering configuration in shared-svc-vpc failed to enable the 'Export custom routes' flag to push dynamic BGP routes to app-vpc.
  3. C
    HA VPN tunnels restrict cross-VPC traffic forwarding; migrating the hybrid connectivity from HA VPN to a Dedicated Interconnect connection will automatically enable transitive routing over the existing VPC Peering link.
  4. D
    VPC Service Controls perimeters automatically block cross-network egress; update the IAM policy in app-vpc to grant compute service accounts access to perimeter ingress/egress rules.

Answer

VPC Network Peering is non-transitive by design in Google Cloud. Dynamic routes learned from on-premises via Cloud Router and HA VPN in one VPC network cannot be transitively routed to a peered VPC network. To enable hybrid connectivity for the application VPC, direct hybrid connectivity (such as a separate VPN tunnel/Interconnect) or a supported routing architecture (such as Network Connectivity Center) must be deployed.
The correct option correctly identifies that Google Cloud VPC Network Peering is non-transitive. Virtual machines in a peered VPC network cannot access external networks (such as on-premises data centers) through a hybrid gateway located in another VPC. Direct hybrid connectivity or Network Connectivity Center must be used.

Step-by-Step Solution

1
Analyze the reported connectivity behavior
Communication succeeds between app-vpc and shared-svc-vpc, but fails between app-vpc and on-premises via the HA VPN in shared-svc-vpc.
This indicates that intra-peering connectivity is functional, but multi-hop path forwarding across the VPN gateway is blocked.
2
Evaluate Google Cloud networking constraints regarding VPC Network Peering
Google Cloud VPC Network Peering does not support transitive routing (i.e., Network A peered with Network B cannot use Network B's gateways or peering connections to reach Network C or on-premises).
VPC Peering only exchanges local subnet routes and explicitly configured custom routes between the two directly peered networks.
3
Identify the required architectural solution
Establish a direct hybrid connectivity gateway (HA VPN or Interconnect) attached directly to app-vpc, or use Network Connectivity Center.
This satisfies GCP networking constraints and ensures scalable hybrid reachability.

Key Concept

VPC Network Peering Non-Transitivity
Estimated Time:2m 0s
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic