PCNE — frequently asked questions

BGP session failures on Cloud Interconnect are often caused by misconfigured BGP parameters, such as mismatched Autonomous System Numbers (ASNs) or incorrect BGP peer IP addresses. Other causes include firewall rules blocking TCP port 179, or issues with the underlying Layer 2 connectivity. Resolution involves verifying the BGP configuration on both the Cloud Router and the on-premises router, ensuring firewalls allow BGP traffic, and checking the operational status of the Interconnect attachment.

To deploy Packet Mirroring, you must first create a Packet Mirroring policy in the desired region. This involves specifying the source instances or subnets whose traffic you want to mirror, defining a filter to select specific traffic (e.g., by IP protocol or CIDR range), and designating the collector ILB (Internal Load Balancer) that will receive the mirrored packets. The collector VMs behind the ILB are typically running packet analysis or IDS/IPS software.

Asymmetric traffic, where the forward and return paths differ, can cause issues with stateful firewalls. Troubleshooting involves using tools like VPC Flow Logs to analyze the traffic paths. The solution often requires adjusting routing priorities (e.g., BGP MED values or route advertisement priorities on the Cloud Router) to ensure that traffic enters and exits through the same Interconnect link, creating a symmetric path.

In Cloud NGFW, you can configure threat prevention profiles that are associated with firewall policies. Within these profiles, you can set the action for specific threat signature categories (like malware, exploits, or C2 callbacks). To both log and drop packets, you would set the action for the relevant signature to 'Deny' and ensure that logging is enabled for that rule or profile, which sends logs to Cloud Logging for analysis.

To forward DNS queries between isolated VPCs, you can use Cloud DNS Inbound and Outbound server policies. An outbound policy is configured on the source VPC to forward queries for a specific domain (e.g., corp.example.com) to a set of designated IP addresses. An inbound policy is configured on the target VPC to accept DNS queries on those same IP addresses. You would typically place a DNS forwarder (like BIND on a GCE VM) in the target VPC to resolve the queries.

The Multi-Exit Discriminator (MED) is the primary BGP attribute used to influence inbound traffic from Google to your on-premises network, which in turn controls the active/passive state for the return (egress) traffic. By advertising a lower MED on the preferred active link, you signal to Google's BGP routers that this is the preferred path. For controlling egress from GCP to on-prem, you would manipulate the Local Preference on your on-premises router for routes learned from Google.

To configure an active/passive setup for Dedicated Interconnect, you provision two separate Interconnect connections in different edge availability domains. You then create a VLAN attachment on each connection, linking them to the same Cloud Router. On the Cloud Router's BGP configuration for these attachments, you set a higher advertisement priority (e.g., 1024) for the active link and a lower priority (e.g., 1025) for the passive link. This ensures that on-premises networks prefer the active path.

The most scalable architecture is to use a hub-and-spoke model with a central transit VPC or a Cloud Router appliance. The on-premises data center establishes a high-bandwidth connection (like Dedicated Interconnect) to the central hub. From this hub, connectivity is extended to the various regional spoke VPCs using VPC peering or through the Network Connectivity Center. This avoids the complexity of managing numerous individual connections from on-premises to each region.

VPC Flow Logs are enabled at the subnet level. In a Shared VPC, the host project administrator can enable flow logs on any subnet within the host project. A service project administrator can enable flow logs on subnets that have been shared with their project. This is done by editing the subnet configuration in the GCP Console, via gcloud commands, or with Terraform, and setting the 'Flow Logs' option to 'On'.

Cloud CDN may incorrectly cache personalized content if it doesn't distinguish between requests. To resolve this, you must configure the backend service to use a 'Signed URL Key' or, more commonly, to include specific headers (like an authorization token or a session ID) in the 'Cache key'. By adding these private headers to the cache key, Cloud CDN will store separate cached objects for each unique header value, preventing users from seeing each other's data.

Achieving a 99.99% SLA requires a highly redundant design. This typically involves using two Dedicated Interconnect connections in two different edge availability domains, paired with two highly available (HA) VPN tunnels over the public internet as a failover. All four connections (2 Interconnect, 2 VPN) are attached to the same Cloud Router. BGP is used to manage failover, ensuring traffic routes through the Interconnect links primarily and fails over to the VPN tunnels if both Interconnect links fail.

VPC Flow Logs provide data on accepted and dropped packets but are sampled and not ideal for precise packet loss measurement. To achieve high confidence in packet loss metrics, you should use active probing tools. This involves deploying test VMs in the peered VPCs and using tools like iperf3 or ping to generate traffic and measure loss, latency, and jitter directly. This provides a more accurate, real-time assessment of the network path's health.

To handle HTTPS traffic, Secure Web Proxy uses a man-in-the-middle (MITM) approach. You must first create or import a CA certificate into the proxy. Then, in the proxy rule configuration, you enable TLS interception and associate the CA certificate. The proxy will use this certificate to dynamically generate certificates for the HTTPS sites users visit. Finally, this CA certificate must be installed as a trusted root certificate on all client machines that will use the proxy.

A cost-effective method is to use Partner Interconnect with a supported service provider that has a presence in both your on-premises environment and Google Cloud. This avoids the high capital expenditure of Dedicated Interconnect. For connecting to other cloud providers, using a third-party network vendor or SD-WAN solution that has established interconnects with both clouds can be more economical and simpler to manage than building a complex mesh of VPNs.

BGP session flaps (rapidly going up and down) are often caused by network instability, such as high latency or packet loss on the path between BGP peers. Other causes include mismatched BGP timers (keepalive/hold-down), CPU overload on one of the routers, or misconfigured MD5 authentication. Resolution involves checking network health between the peers, ensuring BGP timers are consistent, and verifying that router resources are not exhausted.

The primary limitation is the quota on the number of VPC peering connections a VPC network can have. To scale beyond this, you can use Network Connectivity Center (NCC) with a global reachability policy. NCC is designed to manage large-scale hub-and-spoke topologies more efficiently than manual VPC peering. Alternatively, you can use a third-party virtual appliance in the hub VPC and connect spokes using VPN, which has different scaling limits.

The best practice is to use a modular approach. Create reusable Terraform modules for common resources (like VPCs, subnets, firewall rules). Then, use a separate Terraform configuration for each environment (dev, staging, prod) that calls these modules. Crucially, configure a remote backend like a GCS bucket to store the Terraform state file, enabling team collaboration and state locking. Use service accounts with least-privilege IAM roles for Terraform to apply changes.

Intermittent failures over the public internet are often due to network congestion, routing issues, or middleboxes (like firewalls or proxies). Troubleshooting steps include: 1) Using traceroute or mtr to identify where packet loss or high latency occurs. 2) Checking GCP's status dashboard for any service disruptions. 3) Reviewing VPC Flow Logs for denied packets. 4) Capturing packets on the VM (tcpdump) to see if SYN packets are arriving and if SYN-ACKs are being sent, which helps isolate the failure point.

Low-volume packet loss can be difficult to diagnose. Start by enabling VPC Flow Logs on the relevant subnets to check for packets being dropped by firewall rules. Use ping and traceroute between instances to test the network path. If the loss is specific to a certain type of traffic, use tcpdump on the source and destination VMs to capture packets and analyze the flow. The issue could be related to instance-level resource exhaustion (e.g., vCPU steal time) or an overloaded load balancer.

To achieve a 99.9% SLA for a Shared VPC, you need redundancy at the Interconnect level. This is done by provisioning two VLAN attachments on two separate Dedicated Interconnect connections (or with two different partners via Partner Interconnect) in different edge availability domains. Both attachments should be connected to the same Cloud Router in the host project. This provides an active/active or active/passive setup that can tolerate the failure of a single Interconnect link or an entire edge availability domain.