VPC networks and Cloud NGFW

• It provides connectivity for VMs (including GKE nodes), hosts internal load balancers, and connects to on-premises through Cloud VPN or Cloud Interconnect.
• Resources in a VPC communicate over internal IPs, subject to firewall rules, which are enforced on the VMs themselves.
• A project can have several VPCs. New projects start with the default network (auto mode with pre-populated firewall rules), unless the compute.skipDefaultNetworkCreation constraint prevents it.
• They don't support broadcast or multicast.
• A VM can use any subnet in the region of its zone.

Auto mode or custom mode

You can switch from auto mode to custom mode, but not back.

gcloud compute networks create prod-vpc --subnet-mode=custom
gcloud compute networks subnets create web-subnet \
  --network=prod-vpc --region=us-central1 --range=10.10.0.0/24

Subnets and IP ranges

• Each subnet has a primary IPv4 range (VM internal IPs, internal load balancers, protocol forwarding) and, optionally, secondary ranges used only by alias IP ranges (for example, GKE Pods and Services).
• Ranges don't need to be contiguous, but every primary or secondary range in the network must be a unique CIDR block.
• Subnet purpose: regular (PRIVATE, the default) or reserved for Private NAT (PRIVATE_NAT). It generally can't be changed later.

Google uses the first two and last two addresses of the primary range. All addresses in secondary ranges are usable. The gateway doesn't respond to ping. Expanding a subnet is covered in domain D3.

Shared VPC

It connects resources from several projects in the same organization to a common network so they communicate over internal IPs. It centralizes control of subnets, routes, and firewalls while delegating instance management. In the API it is called "XPN".

• A project can't be a host and a service project at the same time. There can be several hosts, but each service project attaches to only one.
• Shared VPC Admin (roles/compute.xpnAdmin): enables the host and attaches service projects.
• Service Project Admin: with roles/compute.networkUser on the host (on the whole project or specific subnets) can create resources in those subnets without being able to change the network.

gcloud compute shared-vpc enable HOST_PROJECT_ID
gcloud compute shared-vpc associated-projects add SERVICE_PROJECT_ID --host-project HOST_PROJECT_ID

VPC Network Peering

It connects two VPC networks so their resources communicate over internal IPs, with the same latency and bandwidth as within one network. They can be in the same project, different projects, or different organizations.

• It isn't transitive: if A is peered with B and B with C, A and C can't communicate.
• The networks stay administratively separate; only routes are exchanged, according to each side's configuration.
• It doesn't exchange firewall rules or policies: one network's network tags and service accounts don't select VMs in the other.
• Two auto mode networks can't be peered; a custom one with an auto one can, if the custom one has no ranges within 10.128.0.0/9.

Cloud Next Generation Firewall is a distributed firewall with stateful inspection and Layer 7 control, for north-south traffic (entering or leaving the VPC) and east-west traffic (within the VPC). It applies rules to VMs and to certain Envoy-based load balancers.

VPC firewall rules

They belong to a VPC network. Each rule has these components:

• They are stateful: if a connection is allowed, the response is allowed too while tracking stays active (at least one packet every 10 minutes).
• Implied actions: if no rule matches, ingress traffic to a VM is denied and egress traffic is allowed.
• The default network includes default-allow-internal (from 10.128.0.0/9), default-allow-ssh (tcp:22), default-allow-rdp (tcp:3389), and default-allow-icmp, all with priority 65534 and editable.
• Traffic to the metadata server (169.254.169.254) is always allowed.
• A single rule can't combine network tags and service accounts.

gcloud compute firewall-rules create allow-web --network=prod-vpc \
  --direction=INGRESS --action=ALLOW --rules=tcp:80,tcp:443 \
  --source-ranges=0.0.0.0/0 --target-tags=web --priority=1000

Firewall policies

A policy groups several rules so you can update them at once and control who manages them with IAM.

• Policy rules have priorities from 0 to 2,147,483,547.
• Actions: allow, deny, goto_next (continue evaluating at the next level), and apply_security_profile_group (send to Layer 7 inspection).

Evaluation order

With the default order (AFTER_CLASSIC_FIREWALL):

With BEFORE_CLASSIC_FIREWALL, global and regional network policies are evaluated before VPC rules. You change it with gcloud compute networks update --network-firewall-policy-enforcement-order. Hierarchical and system policies always come first.

Secure tags, network tags, and service accounts

That is why filtering by service account or secure tag is stricter than by network tag: an instance admin can add a network tag to a VM and change which rules apply to it. Secure tags enable identity-based micro-segmentation. A tag key supports up to 1,000 values and its purpose can't be changed later.

Exam scenarios

Common exam traps