Examkin

Soru

Zorluk: OrtaDesigning Network Architecture and Hybrid Connectivity

An international logistics enterprise is migrating its dispatch system to Google Cloud. The network design connects an on-premises data center to a central hub Virtual Private Cloud (VPC) using Dedicated Interconnect. The central hub VPC is peered via VPC Network Peering to three separate spoke VPCs housing isolated microservices. On-premises systems can successfully reach resources in the hub VPC, but cannot establish communication with any instances in the spoke VPCs. Which network architecture modification should you recommend to enable connectivity between on-premises systems and the spoke VPC workloads while adhering to Google Cloud routing constraints?

  1. Migrate the environment to a Shared VPC topology where the central network project acts as the Host Project and spoke projects act as Service Projects, attaching the Dedicated Interconnect directly to the Host VPC network.Cevap
  2. B
    Configure custom BGP route advertisements on the central hub VPC's Cloud Router to export the subnet IP ranges of all three spoke VPC networks over the Dedicated Interconnect to on-premises routers.
  3. C
    Enable transitive routing flags on each VPC Network Peering connection between the central hub VPC and the spoke VPC networks.
  4. D
    Replace the Dedicated Interconnect connection with individual Cloud HA VPN tunnels established directly from the on-premises data center to each spoke VPC network.

Cevap

Migrate the environment to a Shared VPC topology where the central network project acts as the Host Project and spoke projects act as Service Projects, attaching the Dedicated Interconnect directly to the Host VPC network.
Google Cloud VPC Network Peering is non-transitive. Traffic arriving at a hub VPC over a Dedicated Interconnect cannot traverse peering boundaries to reach spoke VPCs. Implementing a Shared VPC architecture allows spoke projects (Service Projects) to attach their instances directly to subnets in the host VPC, enabling seamless hybrid communication over the Dedicated Interconnect without relying on transitive peering.

Adım Adım Çözüm

1
Identify the cause of connectivity failure between on-premises networks and spoke VPCs.
Recognize that Google Cloud VPC Network Peering is strictly non-transitive, meaning traffic from on-premises over Dedicated Interconnect cannot pass through the hub VPC to reach peered spoke VPCs.
VPC Network Peering does not forward packets across multiple peering hops or between external hybrid connections and peered networks.
2
Evaluate alternative network topologies to support centralized hybrid connectivity across multiple projects.
Shared VPC allows a host project to share subnets across service projects, enabling workloads in different projects to reside directly within subnets attached to the shared hybrid connection.
Shared VPC eliminates the need for VPC Network Peering while providing native, non-transitive connectivity to hybrid infrastructure.

Anahtar Kavram

VPC Network Peering Non-Transitivity and Shared VPC Design
Bu soruyu puanla

Konular

Designing Network Architecture and Hybrid Connectivity