Topic 10 of 11
Connectivity and load balancing
The rest of section 2.3: establishing network connectivity (Cloud VPN, VPC Network Peering, and Cloud Interconnect), choosing and deploying load balancers, and differentiating Network Service Tiers. VPC peering is in the previous article.
Contents
Hybrid connectivity options
| Option | Traffic path | When |
|---|---|---|
| Cloud VPN | The internet, encrypted with IPsec | A quick, inexpensive connection; doesn't reduce egress costs |
| Dedicated Interconnect | A direct physical connection with Google | High bandwidth and you can reach a colocation facility |
| Partner Interconnect | Through a service provider | You can't reach the colocation facility or need less capacity |
| Cross-Cloud Interconnect | A physical connection between Google and another cloud | Connect to AWS, Azure, OCI, or Alibaba Cloud |
| Direct Peering and Carrier Peering | Peering with Google's edge network | Specific cases; Google recommends Cloud Interconnect instead |
Cloud VPN
It extends your network to the VPC through an encrypted IPsec connection. It can also connect two VPCs. It can't route traffic to the internet: it is for communication between private networks.
| HA VPN | Classic VPN | |
|---|---|---|
| SLA | 99.99% for most topologies | 99.9% |
| Routing | Dynamic only (BGP) | Static only (policy-based or route-based) |
| External IPs | Two, picked automatically from separate pools; no forwarding rules | You create the IP and forwarding rules |
| IPv6 | Yes (dual stack or IPv6-only) | No |
| API resource | vpn-gateway | target-vpn-gateway |
- For the 99.99% SLA, configure two tunnels, one from each gateway interface; with a single active interface there is no SLA.
- Each tunnel supports about 250,000 packets per second, between 1 and 3 Gbps depending on packet size.
- It requires a VPN gateway on the other side (on-premises or another cloud) with adequate redundancy.
- HA VPN over Cloud Interconnect adds IPsec encryption to Interconnect traffic, which never crosses the internet.
Cloud Interconnect
Low-latency, high-availability connections where traffic doesn't cross the internet. The VPC's internal IPs are reachable directly from on-premises, without NAT or VPN tunnels.
Dedicated Interconnect
- A physical connection between your network and Google's in a colocation facility.
- 10, 100, or 400 Gbps Ethernet circuits, up to 8 circuits per connection.
- You must install and maintain routing equipment in the colocation facility.
Partner Interconnect
- A connection through a supported service provider, with more points of connectivity.
- VLAN attachments from 50 Mbps to 50 Gbps.
- No equipment of your own in the colocation facility. For compliance with third parties, add IPsec encryption.
| Reliability level | SLA |
|---|---|
| Critical production | 99.99% |
| Non-critical production and development | 99.9% |
| No level specified | No SLA |
Interconnect can reduce egress costs; Cloud VPN alone doesn't. With Private Google Access for on-premises hosts, they reach Google APIs over internal IPs. Cross-Site Interconnect connects your on-premises sites to each other through Google's network.
Cloud Router
A distributed, fully managed service that speaks BGP with your network to create dynamic routes in the VPC. It doesn't forward packets (Andromeda does that): it only manages BGP sessions and route advertisements.
| Product | Cloud Router |
|---|---|
| Dedicated, Partner, and Cross-Cloud Interconnect | Required |
| HA VPN | Required |
| Classic VPN | Optional (usually with static routes) |
| Cloud NAT | Uses it as a control plane, without BGP sessions |
Cloud Load Balancing
To choose a load balancer, you first decide the traffic type:
Application Load Balancer
HTTP or HTTPS, Layer 7, with a flexible feature set.
Proxy Network Load Balancer
TCP with optional SSL offload, to backends in one or more regions.
Passthrough Network Load Balancer
TCP, UDP, ESP, GRE, ICMP. Preserves the client source IP.
How to choose a load balancer
| Aspect | Options |
|---|---|
| External or internal | External: traffic from the internet. Internal: clients in the same VPC or connected through peering, Cloud VPN, or Interconnect |
| Global, cross-region, or regional | Global: external only, a single anycast IP, and IPv6 termination. Cross-region: internal with backends in several regions. Regional: backends in one region, IPv4 only, or requirements that traffic and TLS stay in one region |
| Proxy or passthrough | Proxy: terminates the connection at the load balancer (Google Front Ends or Envoy) and opens a new one to the backend. Passthrough: the packet reaches the backend unchanged and responses go straight to the client (direct server return) |
| Network tier | Premium or Standard (see below) |
- Resilience: a global or cross-region load balancer survives a regional outage; a regional one, a zonal outage. Overall resilience also depends on backend redundancy.
- Proxy load balancers don't preserve the client IP by default. For authentication on Application Load Balancers, Google recommends Identity-Aware Proxy (IAP).
Load balancer summary
| Load balancer | Modes | Network tier |
|---|---|---|
| Application Load Balancer | Global external, regional external, classic, regional internal, cross-region internal | Global external Premium only; regional external Premium or Standard; internal Premium |
| Proxy Network Load Balancer | Global external, regional external, classic, regional internal, cross-region internal | Global external Premium only; regional external Premium or Standard |
| Passthrough Network Load Balancer | Regional external, internal, global external (preview) | Depends on the mode |
If you don't specify a tier, the load balancer uses Premium. Internal load balancers always use Google's backbone (Premium), without Premium's internet egress charges.
Network Service Tiers
| Premium | Standard | |
|---|---|---|
| Routing | Over Google's backbone; traffic enters and exits at the peering point closest to the client | Over ISP and transit networks; enters and exits near the resource's region |
| Optimizes for | Performance and latency | Cost |
| Features | All | Foundational: Cloud NAT, regional external Application Load Balancer, regional external passthrough Network Load Balancer |
| SLA | 99.99% | 99.9% |
- The tier is chosen per resource (the external IP of a VM or load balancer), so you can mix them.
- The global external Application Load Balancer and global external proxy Network Load Balancer exist only in Premium. Cloud VPN gateways only support Premium.
- In either tier, traffic between Google Cloud VMs stays on Google's network.
- Cloud CDN is always Premium.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| An encrypted, inexpensive connection to on-premises over the internet with 99.99% | HA VPN | Two interfaces, BGP, and a 99.99% SLA. |
| 10 Gbps private, not over the internet, with your own equipment in a colocation facility | Dedicated Interconnect | A direct physical connection with Google. |
| A private connection but you can't reach a Google colocation facility | Partner Interconnect | Through a service provider. |
| Connect directly to a VPC in another cloud | Cross-Cloud Interconnect | A physical connection between Google and the other provider. |
| Encrypt traffic that goes over Interconnect | HA VPN over Cloud Interconnect | IPsec over the VLAN attachments. |
| A global HTTPS website with a single anycast IP and backends in several regions | Global external Application Load Balancer | Layer 7, Premium Tier. |
| A game that uses UDP and needs the client source IP | External passthrough Network Load Balancer | Doesn't terminate the connection and supports UDP. |
| Terminate TLS only in one region for compliance | Regional load balancer | TLS is terminated in the deployed region. |
| Cut egress costs for an app without strict latency requirements | Standard Tier | Uses ISP networks instead of Google's backbone. |
Common exam traps
❓ Does HA VPN support static routes?
No. HA VPN only uses dynamic routing with BGP (Cloud Router). Classic VPN uses static routes.
❓ Is Cloud Interconnect traffic encrypted?
Not by itself. To encrypt it, use HA VPN over Cloud Interconnect.
❓ Does Cloud VPN reduce egress costs?
No. Dedicated and Partner Interconnect can.
❓ Can an internal load balancer be global?
No. For internal load balancers with backends in several regions, use cross-region mode.
❓ Does an Application Load Balancer preserve the client source IP?
Not by default, because it is a proxy. Passthrough Network Load Balancers do preserve it.
❓ Can Standard Tier be used with the global external Application Load Balancer?
No. It exists only in Premium Tier.
Did you get this topic?
Test what you just learned
An online store has backends in us-central1 and europe-west1. It wants a single IP for all its users worldwide, HTTPS terminated close to them, and traffic distributed across the backends. Which load balancer should it deploy?
Ready to test "Connectivity and load balancing"?
Original questions, each with a full explanation.
Start a mock exam