Hub-and-Spoke Centralized Egress with VPC Peering

PCNE By islever Editorial Last updated

Designing an overall network architecture. Configuring VPC routing.

Short answer

B Create a default route in the hub VPC pointing to the ILB IP, export/import custom routes between hub and spokes, and delete the default internet gateway route in the spokes to enforce centralised egress.

Question

You are designing a hub-and-spoke network architecture for your company’s cloud-based environment. You need to make sure that all spokes are peered with the hub. The spokes must use the hub's virtual appliance for internet access. The virtual appliance is configured in high-availability mode with two instances using an internal load balancer with IP address 10.0.0.5. What should you do?
    1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. 4. Import the custom routes in the spokes.
    1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes. 4. Delete the default internet gateway route of the spokes.
    Correct Answer
    1. Create two default routes in the hub VPC that point to the next hop instances of the virtual appliances. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes.
    1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Create a new route in the spoke VPC that points to IP address 10.0.0.5.

Key Takeaways

The main trap is forgetting to delete the default internet gateway route in the spokes; without this, traffic bypasses the hub despite correct route propagation.

Learn how to configure hub-and-spoke networking in Google Cloud to force all spoke internet traffic through a centralized virtual appliance using route export/import and default route deletion.

Common mistake: Option A is often chosen because it handles route propagation but fails to remove the default route in the spokes, leading to split-tunneling where some traffic goes directly to the internet instead of through the hub appliance.

Expert Analysis

The Hub-and-Spoke Routing Boundary

This scenario tests the precise configuration required to force spoke VPC traffic through a centralized virtual appliance in the hub. The critical distinction lies in understanding that VPC peering does not propagate routes by default; therefore, manual route exchange via Cloud Router is mandatory for any custom or static routes beyond the default internet gateway.

Why Option B is Correct

Option B correctly implements the full lifecycle of centralized routing:

  1. Hub Configuration: It creates a specific route pointing to the internal load balancer (10.0.0.5) and ensures only relevant traffic uses it by tagging.
  2. Route Propagation: It explicitly exports these custom routes from the hub’s Cloud Router and imports them into the spokes. Without this step, the spokes would not know how to reach the internet via the hub.
  3. Traffic Enforcement: It deletes the default internet gateway route (0.0.0.0/0) from the spokes. This is the decisive action that prevents spokes from bypassing the hub and connecting directly to the internet. As noted in community feedback, "Deleting the default route in the spokes is necessary to ensure they don’t bypass the hub".

Common Pitfalls

Options A and D fail because they omit deleting the default route in the spokes, allowing direct internet access. Option C is invalid because you cannot have two conflicting default routes pointing to different next hops simultaneously without proper policy-based routing, which isn't described here. The key insight is that route import/export + default route deletion is the only combination that guarantees centralized egress.

Official Reference

https://cloud.google.com/architecture/architecture-centralized-network-appliances-on-google-cloud

This link opens the official vendor documentation in a new tab.

Exam Strategy

When designing hybrid or multi-cloud networks with centralized appliances, always verify three things: 1) Is the next-hop defined correctly? 2) Are custom routes propagated via Cloud Router export/import? 3) Is the default route removed from the spoke VPCs to prevent bypass? If any of these are missing, the design will likely fail to enforce traffic flow through the intended security or inspection layer.

Frequently Asked Questions

Why can't I just rely on VPC peering for routes?

VPC peering connects networks but does not automatically share routes. You must use Cloud Router to export and import static or BGP routes to make custom routes visible across the peering connection.

What happens if I don't delete the default route in the spokes?

If the default route (0.0.0.0/0) remains in the spoke VPC, traffic destined for the internet may take the higher-priority direct path to the internet gateway, bypassing your centralized virtual appliance entirely.

More PCNE FAQ →

Community Votes

A
50%
B
50%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. ccieman2016 👍 7 Answered B
    I think is B, export and import when configured peering btw hub-spoke, and delete default route in spoke.
  2. pfilourenco 👍 3 Answered B
    B, export and import when configured peering btw hub-spoke, and delete default route in spoke.
  3. pk349 👍 2
    B. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes. 4. Delete the default internet gateway route of the spokes. Example architecture using VPC Network Peering and internal TCP/UDP load balancer as next hop This architecture is a typical use case for enterprise environments, using the internal TCP/UDP load balancer for high availability, combined with VPC Network Peering for attaching network segments. The default route to the internet gateway in the spoke * VPC networks is deleted.
  4. al_zo 👍 2
    I meant answer B.
  5. AzureDP900 👍 1
    B. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes. 4. Delete the default internet gateway route of the spokes.
Show 8 more comments
  1. saraali 👍 1 Answered B
    Option B is the correct answer because it correctly sets up routing between the hub and spokes and ensures all spoke traffic to the internet passes through the virtual appliance in the hub. Deleting the default route in the spokes is necessary to ensure they don’t bypass the hub and connect to the internet directly.
  2. ian_gcpca 👍 1 Answered A
    Deleting the default internet gateway route in the spokes would have communication issues with the hub. Also we need to export custom routes from the hub and then import them into the spokes to propagate the routing configuration
  3. al_zo 👍 1 Answered A
    I would go for A. (default route has to be removed from the spoke) https://cloud.google.com/architecture/architecture-centralized-network-appliances-on-google-cloud#example_architectures
  4. pfilourenco 👍 1 Answered A
    Since we have BGP, A is the correct: https://cloud.google.com/network-connectivity/docs/router/how-to/viewing-logs-metrics#common-searches
  5. desertlotus1211 👍 1
    The Answer is a A: I'm suspect on deleting default internet route on spokes. Can cause issues.
  6. ulkerra 👍 1 Answered A
    Default internet route in spokes will be overridden buy hub route so we don't need to delete
  7. waelghaith 👍 1 Answered B
    No issues when you deleting default internet route on spokes VPCs.
  8. pfilourenco 👍 1
    This comment is not for this question...

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Configuring Policy-Based VPN for Non-BGP On-Premises Networks

S-grade

Deploying Packet Mirroring Policies in GCP Regions

S-grade

Troubleshooting Asymmetric Traffic on Google Cloud Interconnect

S-grade

How to Configure DNS Forwarding Across Isolated VPC Networks?

S-grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide