An organization is operating three Virtual Private Cloud (VPC) networks in Google Cloud: vpc-frontend, vpc-hub, and vpc-backend. To centralize administration, vpc-frontend is peered with vpc-hub, and vpc-backend is also peered with vpc-hub. Compute Engine instances in vpc-frontend need to communicate directly with internal workloads in vpc-backend. Network administrators observe that traffic sent from vpc-frontend to vpc-backend is dropped, even though both networks are successfully peered with vpc-hub. Which network topology modification should be implemented to enable connectivity between vpc-frontend and vpc-backend?
- Establish a direct VPC Network Peering connection between vpc-frontend and vpc-backend.Cevap
- BEnable custom route import and export flags on the existing VPC Network Peering connections attached to vpc-hub to allow transitive routing.
- CReplace the VPC Network Peering connections with HA VPN tunnels to vpc-hub, because HA VPN automatically enables transitive BGP routing between connected VPCs without extra configuration.
- DConfigure a VPC Service Controls perimeter encompassing all three VPCs and add an ingress rule permitting inter-VPC traffic forwarding through vpc-hub.
Cevap
Establish a direct VPC Network Peering connection between vpc-frontend and vpc-backend.
VPC Network Peering in Google Cloud is explicitly non-transitive. Traffic originating in one peered network cannot traverse a intermediate network to reach a third network. To allow direct communication between two spoke VPC networks, an explicit direct VPC Network Peering connection must be established between them.
Adım Adım Çözüm
Anahtar Kavram
VPC Network Peering Non-Transitivity