Your organization maintains a production workload running on Compute Engine virtual machines in a custom Virtual Private Cloud (VPC) subnet with no external IP addresses assigned. The application requires outbound internet access to send telemetry data to an external API endpoint. In addition, system administrators require secure SSH access to these private instances without assigning public IP addresses or exposing the instances to the open internet. Which TWO network configuration actions should you perform to meet these requirements?
- Configure a Cloud NAT gateway associated with a Cloud Router in the VPC subnet's region to enable outbound internet connectivity for the private instances.Cevap
- Create an ingress firewall rule permitting TCP traffic on port 22 originating from the source IP CIDR range 35.235.240.0/20.Cevap
- CDeploy an External HTTP(S) Load Balancer to proxy administrative SSH connections directly into the private VPC subnet.
- DConfigure an egress firewall rule with a priority value of 65535 to ensure outbound traffic takes precedence over default network rules.
Cevap
The correct actions are to configure a Cloud NAT gateway associated with a Cloud Router in the subnet's region to enable outbound internet access, and to create an ingress firewall rule permitting TCP traffic on port 22 from the source IP range 35.235.240.0/20 to support Identity-Aware Proxy (IAP) TCP forwarding.
To allow instances without public IP addresses to initiate outbound connections to internet endpoints, Cloud NAT must be configured with a Cloud Router in the instance's region. To enable administrative SSH access without assigning public IP addresses, Identity-Aware Proxy (IAP) TCP forwarding should be used, which requires allowing ingress TCP traffic on port 22 from the designated Google IAP proxy IP range (35.235.240.0/20).
Adım Adım Çözüm
Anahtar Kavram
Cloud NAT and IAP TCP Forwarding Configuration for Private Compute Engine Instances
Tahmini Süre:3m 0s