6.2 Hybrid & Multicloud Connectivity: Cloud VPN & Cloud Interconnect
Key Takeaways
- Cloud HA VPN provides a 99.99% service availability SLA using dual active interfaces (interface 0 and interface 1) with dynamic BGP routing managed by Cloud Router.
- Each HA VPN tunnel supports up to 3 Gbps (250,000 packets per second); bandwidth scales horizontally by configuring multiple parallel tunnels with Equal-Cost Multi-Path (ECMP) routing.
- Dedicated Interconnect provides direct physical 10 Gbps or 100 Gbps fiber circuits at colocation facilities, whereas Partner Interconnect connects through telecommunications providers with bandwidth options from 50 Mbps to 50 Gbps.
- To achieve a 99.99% availability SLA with Cloud Interconnect, enterprise architecture requires four VLAN attachments deployed across two distinct Google Cloud colocation facilities (Edge Availability Domains) and two Cloud Routers.
- Cloud Router dynamically advertises VPC routes and learns on-premises prefixes via BGP; traffic steering is controlled using Multi-Exit Discriminators (MED) and custom route priorities.
Hybrid & Multicloud Connectivity: Cloud VPN & Cloud Interconnect
Architectural Imperative: Enterprise digital transformation rarely occurs overnight; large organizations operate in hybrid states for years. Google Cloud provides a suite of hybrid networking services engineered to meet diverse bandwidth, latency, availability, and security requirements. Architects must design hybrid topologies that balance cost against stringent Service Level Agreements (SLAs), choosing between encrypted public transport (Cloud HA VPN) and dedicated private physical links (Cloud Interconnect).
Cloud VPN: Classic VPN vs. Cloud HA VPN
Google Cloud VPN securely extends on-premises networks or other cloud environments (AWS, Azure) into a Google Cloud VPC using industry-standard IPsec (IKEv1 / IKEv2) encrypted tunnels over the public internet.
+-----------------------------------------------------------------------------------------+
| CLOUD HA VPN 99.99% SLA TOPOLOGY |
| |
| +-----------------------------+ +-------------------------+ |
| | ON-PREMISES ROUTERS | Dual IPsec Tunnels | GOOGLE CLOUD HA VPN | |
| | Peer Router 0 (IP: 1.1.1.1) | <====== Tunnel 0 =======> | Interface 0 (BGP BGP-0) | |
| | | (Over Internet) | | |
| | Peer Router 1 (IP: 2.2.2.2) | <====== Tunnel 1 =======> | Interface 1 (BGP BGP-1) | |
| +-----------------------------+ +-------------------------+ |
| | Managed By |
| +-------------------------+ |
| | Cloud Router (ASN 65001)| |
| +-------------------------+ |
+-----------------------------------------------------------------------------------------+
Classic VPN (Legacy) vs. Cloud HA VPN Comparison
| Architectural Parameter | Classic VPN (Deprecated for New Builds) | Cloud HA VPN (Modern Standard) |
|---|---|---|
| Availability SLA | 99.9% availability. | 99.99% availability (when configured with dual tunnels to redundant peer routers). |
| Gateway Interfaces | Single external IP address / interface. | Two interfaces (Interface 0 and Interface 1), each with an independent public IP. |
| Routing Mechanism | Static routing or dynamic BGP routing. | Strictly Dynamic BGP using Cloud Router (static routing is not supported). |
| Throughput per Tunnel | Up to 3 Gbps (250,000 packets per second). | Up to 3 Gbps (250,000 pps) per tunnel. |
| Bandwidth Scaling | Single tunnel limits. | Horizontal ECMP scaling across multiple tunnels (e.g., 4 tunnels = ~12 Gbps). |
| Topology Requirements | Single peer gateway. | Requires dual peer gateways or a single peer device with dual active interfaces. |
HA VPN Topology Requirements for 99.99% SLA
To qualify for Google's 99.99% uptime SLA, the on-premises side must match one of two approved topologies:
- Two Peer Devices: Two separate on-premises physical routers, each with its own public IP, establishing one tunnel to HA VPN Interface 0 and one tunnel to HA VPN Interface 1.
- One Peer Device with Dual IP Interfaces: A single high-availability on-premises router configured with two separate public IP addresses, establishing independent BGP-peered tunnels to both HA VPN interfaces.
Cloud Interconnect: Dedicated vs. Partner Interconnect
For enterprise workloads requiring guaranteed high bandwidth, predictable single-digit millisecond latency, and bypass of the public internet, Cloud Interconnect establishes private physical connections directly into Google's global network.
+-----------------------------------------------------------------------------------------+
| CLOUD INTERCONNECT DEPLOYMENT MODELS |
+-----------------------------------------------------------------------------------------+
| 1. DEDICATED INTERCONNECT |
| - Direct physical fiber cross-connect in a Google Colocation Facility (Meet-Me Room)|
| - Capacities: 10 Gbps or 100 Gbps single circuits (up to 8x aggregated via LACP). |
| - Customer owns or leases space in the colocation facility. |
+-----------------------------------------------------------------------------------------+
| 2. PARTNER INTERCONNECT |
| - Logical connection provisioned through a certified Service Provider (e.g., Equinix)|
| - Capacities: 50 Mbps, 100 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, 50 Gbps|
| - Ideal when enterprise datacenter is NOT colocated in a Google Edge facility. |
+-----------------------------------------------------------------------------------------+
Detailed Interconnect Feature Matrix
| Dimension | Cloud HA VPN | Partner Interconnect | Dedicated Interconnect |
|---|---|---|---|
| Connection Type | Encrypted IPsec over Public Internet. | Private Layer 2/3 via Service Provider. | Direct physical Layer 2 fiber cross-connect. |
| Bandwidth Options | 3 Gbps per tunnel (scales via ECMP). | 50 Mbps to 50 Gbps per attachment. | 10 Gbps or 100 Gbps per circuit port. |
| Latency Profile | Variable (subject to public internet jitter). | Predictable, low latency. | Ultra-low, deterministic latency. |
| Availability SLA | 99.99% (with redundant tunnels). | 99.9% or 99.99% (topology dependent). | 99.9% (single metro) or 99.99% (dual metro). |
| Provisioning Time | Minutes (pure software configuration). | Days to weeks (provider dependent). | Weeks to months (cross-connect cabling). |
| Data Encryption | IPsec encrypted by default. | Unencrypted on the wire (add MACsec/VPN). | Unencrypted on the wire (MACsec supported). |
Interconnect High Availability Architectures (99.9% vs. 99.99% SLA)
Google Cloud defines strict architectural blueprints required to qualify for financial SLA credits on Cloud Interconnect.
+-----------------------------------------------------------------------------------------+
| 99.99% SLA DEDICATED INTERCONNECT TOPOLOGY |
| |
| ON-PREMISES DATA CENTERS GOOGLE CLOUD GLOBAL NETWORK |
| |
| +------------------------+ +----------------------------------------+ |
| | Metro 1: Datacenter A | == Cross-Conn== | Colocation Facility 1 (Edge Zone 1) | |
| | Router On-Prem-1 | | VLAN Attachment 1 -> Cloud Router 1 | |
| | | == Cross-Conn== | Colocation Facility 1 (Edge Zone 2) | |
| | | | VLAN Attachment 2 -> Cloud Router 1 | |
| +------------------------+ +----------------------------------------+ |
| |
| +------------------------+ +----------------------------------------+ |
| | Metro 2: Datacenter B | == Cross-Conn== | Colocation Facility 2 (Edge Zone 1) | |
| | Router On-Prem-2 | | VLAN Attachment 3 -> Cloud Router 2 | |
| | | == Cross-Conn== | Colocation Facility 2 (Edge Zone 2) | |
| | | | VLAN Attachment 4 -> Cloud Router 2 | |
| +------------------------+ +----------------------------------------+ |
| | |
| v |
| [ Global VPC Network ] |
+-----------------------------------------------------------------------------------------+
The 99.99% Availability Architecture Checklist
To achieve 99.99% availability for mission-critical enterprise workloads:
- Two Distinct Metros / Colocation Facilities: Deploy connections across two geographically distinct Google Cloud Edge Availability Domains (e.g., Facility 1 in Ashburn, Facility 2 in Chicago).
- Four Physical Circuits & VLAN Attachments: Provision two physical circuits/attachments in Metro 1 (split across two separate Edge Availability Domains / NPU router chassis) and two physical circuits/attachments in Metro 2.
- Two Cloud Routers: Deploy two distinct Cloud Routers in the target Google Cloud region (or across two regions if Global Dynamic Routing is enabled), terminating BGP sessions from each respective facility.
- Global Dynamic Routing: Enable Global Dynamic Routing on the VPC network so that learned on-premises routes propagate to all subnets across all worldwide regions.
[!IMPORTANT] The 99.9% vs 99.99% Exam Distinction: A 99.9% SLA topology requires only one metro area / colocation facility with two separate circuits connected to two distinct edge routers (Edge Availability Domain 1 and 2). A 99.99% SLA topology strictly mandates two separate metro areas / colocation facilities with a total of four connections.
Cloud Router & Dynamic BGP Routing Mechanics
Cloud Router is a fully managed, software-defined control-plane service that runs Border Gateway Protocol (BGP) to exchange routing information dynamically between Google Cloud VPCs and on-premises networks. Cloud Router does not sit in the data plane (it does not forward actual packets); it programs the Andromeda SDN kernel with routes learned via BGP.
+-----------------------------------------------------------------------------------------+
| BGP TRAFFIC STEERING MECHANISMS |
+-----------------------------------------------------------------------------------------+
| 1. MULTI-EXIT DISCRIMINATOR (MED) / BGP METRIC |
| - Lower metric = Higher preference. |
| - Directs Google Cloud egress traffic to preferred on-premises paths. |
| - Primary Link: MED = 100 | Standby Backup Link: MED = 200 |
+-----------------------------------------------------------------------------------------+
| 2. BGP AS-PATH PREPENDING |
| - Advertises longer AS paths on backup links to influence inbound on-prem traffic. |
+-----------------------------------------------------------------------------------------+
| 3. CUSTOM ROUTE ADVERTISEMENTS |
| - Cloud Router can advertise specific VPC subnets, summarized supernets, or |
| a default route (0.0.0.0/0) to backhaul internet traffic through on-prem firewalls|
+-----------------------------------------------------------------------------------------+
Dynamic Routing Modes: Regional vs. Global
- Regional Dynamic Routing: A Cloud Router in
us-central1will learn on-premises routes and program them only into the routing tables of subnets located inus-central1. VMs ineurope-west1cannot reach the on-premises datacenter through this Cloud Router. - Global Dynamic Routing: A Cloud Router in
us-central1propagates learned on-premises routes to every subnet across the entire global VPC. Furthermore, subnets ineurope-west1andasia-east1are advertised back to the on-premises BGP peer. Global Dynamic Routing is mandatory for multi-region hybrid architectures.
Hybrid Link Security & Encryption Options
By default, Cloud Dedicated Interconnect and Partner Interconnect carry unencrypted Layer 3 traffic across dedicated physical fiber links. Organizations with strict regulatory or cryptographic compliance mandates have two architectural options for encrypting hybrid traffic:
- MACsec (Media Access Control Security - IEEE 802.1AE):
- Operates at Layer 2 directly on the physical 100 Gbps Dedicated Interconnect circuits.
- Provides hardware-level, line-rate cryptographic encryption with zero packet latency and zero IPsec MTU encapsulation overhead.
- Configured using pre-shared keys managed securely via Cloud KMS.
- Cloud HA VPN over Cloud Interconnect:
- Deploys HA VPN gateways using private RFC 1918 IP addresses inside the VPC, establishing IPsec tunnels across the private VLAN attachments of Dedicated or Partner Interconnect.
- Delivers end-to-end Layer 3 IPsec encryption over a dedicated, private physical pipe with predictable SLA bandwidth.
Concrete Architectural Scenario: Active/Standby Hybrid Failover
Scenario Profile
- Enterprise: Healthcare provider storing electronic health records (EHR) on-premises with real-time analytics in Google Cloud.
- Requirements:
- Baseline steady-state throughput of 8 Gbps with sub-5ms latency for database replication.
- Automated, hitless failover to a secondary path if the primary link is severed.
- Active/Standby traffic model: 100% of production traffic must use the primary path under normal conditions to simplify on-premises stateful firewall tracking.
Architectural Solution & Configuration
- Primary Circuit: Provision a 10 Gbps Dedicated Interconnect in Colocation Facility 1 (Equinix Ashburn) with VLAN Attachment 1 attached to Cloud Router 1.
- Standby Circuit: Provision a 10 Gbps Dedicated Interconnect in Colocation Facility 2 (Equinix Chicago) with VLAN Attachment 2 attached to Cloud Router 2.
- BGP Route Priority Configuration:
- On Cloud Router 1 (Ashburn), configure custom route advertisement with a Base Priority (MED) of 100.
- On Cloud Router 2 (Chicago), configure custom route advertisement with a Base Priority (MED) of 200.
- On on-premises edge routers, configure BGP local preference so that Ashburn is preferred for GCP-bound traffic, and apply AS-Path prepending on the Chicago router advertisements to Google Cloud.
- Operational Result: Google Cloud routing automatically forwards 100% of egress traffic via Ashburn (MED 100). If the Ashburn fiber cross-connect drops, BGP keepalives expire within 3 seconds, and Cloud Router instantly converges traffic onto the Chicago standby circuit (MED 200) without manual administrative intervention.
[!IMPORTANT] Exam Watch: Cloud Router does not pass data packets—it is purely a dynamic control plane protocol engine. If an exam question asks how to dynamically route traffic between a VPC with subnets in three different continents and an on-premises datacenter over a single Interconnect in North America, the correct answer is to set the VPC dynamic routing mode to Global.
An enterprise architect is designing a hybrid connectivity architecture between an on-premises datacenter and Google Cloud. The workload requires a 99.99% availability Service Level Agreement (SLA) on Dedicated Interconnect. What is the minimum topology required to achieve this SLA?
A global company has deployed virtual machines across three Google Cloud regions: us-east1, europe-west1, and asia-east1. They establish a Dedicated Interconnect connection in us-east1. Virtual machines in us-east1 can communicate with on-premises servers, but virtual machines in europe-west1 and asia-east1 cannot reach on-premises IP addresses. What is the root cause of this behavior?
An enterprise operates an Active/Standby hybrid connection to Google Cloud using dual Cloud Routers. The networking team wants Google Cloud egress traffic to prefer the primary Dedicated Interconnect link in us-east4 under normal conditions, and automatically fail over to the secondary Interconnect in us-central1 only if the primary link fails. Which Cloud Router setting should be configured?
An organization is migrating an application that generates 10 Gbps of sustained traffic between an on-premises datacenter and Google Cloud. The security team mandates that all traffic must be encrypted with IPsec. How can the architect satisfy both the 10 Gbps throughput requirement and the IPsec encryption requirement using Cloud HA VPN?