Operating the network

# Add a subnet to an existing network
gcloud compute networks subnets create subnet-eu --network=prod-vpc \
  --range=10.20.0.0/24 --region=europe-west1

# Add or remove a secondary range
gcloud compute networks subnets update subnet-eu --region=europe-west1 \
  --add-secondary-ranges=pods=10.30.0.0/20
gcloud compute networks subnets update subnet-eu --region=europe-west1 \
  --remove-secondary-ranges=pods

# Convert an auto mode network to custom mode
gcloud compute networks update prod-vpc --switch-to-custom-subnet-mode

• You can remove a secondary range only if no resources use its IP addresses.
• Before deleting a subnet you must delete everything that uses it: VMs, reserved internal IP addresses, internal forwarding rules, and Cloud NAT gateways.
• In an auto mode network you can't delete the automatically created subnets. You must convert it to custom mode; the conversion keeps the subnets with their names and ranges and is one-way. Afterwards, gcloud commands must reference the subnet explicitly with --subnet.

Expanding a subnet range

You expand the primary IPv4 range of an existing subnet by shortening its prefix length (for example, from /24 to /20). It takes a few minutes and doesn't interrupt traffic in the subnet.

gcloud compute networks subnets expand-ip-range subnet-eu \
  --region=europe-west1 --prefix-length=20

• For automatically created subnets, the broadest prefix allowed is /16; anything broader would conflict with the other automatic subnets.
• Proxy-only subnets for load balancers can't be expanded.
• Afterwards, review anything that depends on the old range: add firewall rules that cover the expanded range and, in GKE, add it to the control plane authorized networks.

Private Google Access

By default, a VM without an external IP address can only send packets to internal destinations. Enabling Private Google Access on the subnet lets those VMs reach the external IP addresses of Google APIs and services (and App Engine). It only applies to interfaces without an external IP.

gcloud compute networks subnets update subnet-eu --region=europe-west1 \
  --enable-private-ip-google-access

External IP addresses are ephemeral or static. In general, an ephemeral address is released when you stop or delete the resource. A static address is a reserved resource that stays yours until you release it.

# Reserve a new regional address
gcloud compute addresses create web-ip --region=europe-west1

# Reserve a global address for a global load balancer
gcloud compute addresses create lb-ip --global --ip-version=IPV4

# Promote an in-use ephemeral address to static
gcloud compute addresses create web-ip --addresses=34.0.0.10 --region=europe-west1

# Release an address
gcloud compute addresses delete web-ip --region=europe-west1

• Required role: roles/compute.networkAdmin.
• Only one resource at a time can use a static address, and you can't rename it.
• A static address that is reserved but unassigned is charged at a higher rate than addresses in use.
• In the console you can release it only if it isn't in use; with gcloud you can release it even while assigned, and it stays on the resource until the resource is deleted. Once released, you might not get it back.

Static internal IP addresses

Reserving an internal address takes it out of the subnet's dynamic allocation pool, so you always use the same IP even if you delete and recreate the resource. They are regional.

gcloud compute addresses create db-ip --region=europe-west1 \
  --subnet=subnet-eu --addresses=10.20.0.50

• If you omit --addresses, a free address from the subnet is allocated.
• You can't change the internal IP of an existing VM, whether running or stopped. You can promote its ephemeral address to static.
• Deleting the resource doesn't release a static internal address: you must release it manually.

A route has a single destination prefix and a single next hop. The routing table is defined at the VPC network level and there is no physical router: it's a distributed virtual mechanism.

gcloud compute routes create to-onprem --network=prod-vpc \
  --destination-range=192.168.0.0/16 \
  --next-hop-instance=appliance-vm --next-hop-instance-zone=europe-west1-b \
  --priority=800 --tags=needs-appliance

• Order: special routing paths, policy-based routes, subnet routes, and then, among static and dynamic routes, the most specific destination wins first (10.240.1.0/24 before 10.240.0.0/16), then priority.
• Priority from 0 (highest) to 65,535 (lowest); default 1000. Several routes with the same destination and priority share traffic (ECMP).
• The default route is used only when no more specific route matches. Removing it doesn't fully isolate the network, because some special paths don't depend on it.
• Static routes with tags are never exchanged through VPC Network Peering.

A managed global DNS service that publishes your zones and records without running your own DNS servers. It supports IAM permissions at the project and zone level.

gcloud dns managed-zones create internal-zone --description="Internal" \
  --dns-name=corp.internal. --visibility=private --networks=prod-vpc

gcloud dns record-sets create db.corp.internal. --zone=internal-zone \
  --type=A --ttl=300 --rrdatas=10.20.0.50

• To let on-premises hosts resolve private zones, you create an inbound server policy. Forwarding isn't supported for public zones.
• Combining a public and a private zone with the same name gives you split horizon: different answers depending on whether the query comes from the VPC or the internet.

Address translation for outbound traffic from VMs, GKE clusters, Cloud Run, Cloud Run functions, App Engine standard, and regional internet NEGs. It only allows responses to established connections: it doesn't allow unsolicited inbound connections. It's a distributed, software-defined service with no proxy VMs.

gcloud compute routers create nat-router --network=prod-vpc --region=europe-west1

gcloud compute routers nats create nat-config --router=nat-router \
  --region=europe-west1 --nat-all-subnet-ip-ranges --auto-allocate-nat-external-ips

• Each gateway belongs to one VPC network, one region, and one Cloud Router. Cloud Router only groups the configuration: traffic doesn't pass through it and it doesn't use BGP for this.
• --nat-custom-subnet-ip-ranges limits it to certain subnets. Manual IP assignment lets you give a third party a fixed list of source IPs.
• Traffic to Google APIs uses Private Google Access even if the VM uses Public NAT.
• Cloud NAT logging is disabled by default.

Connectivity Tests

A diagnostics tool that checks connectivity between two endpoints (a VM, GKE cluster, forwarding rule, internet IP…). It analyzes your configuration and simulates the path a packet would take through the VPC, VPN tunnels, or VLAN attachments; in some cases it also sends real packets to measure latency and loss. It helps find inconsistent or obsolete configuration, such as a firewall rule or route that blocks traffic. It uses the Network Management API.

Exam scenarios

Common exam traps