How to Connect GCP to Non-BGP On-Premises Networks?

You are configuring your organization's Google Cloud environment to connect to your on-premises network, which does not support Border Gateway Protocol (BGP). Your on-premises network has 30 CIDR ranges that must be reachable from Google Cloud. Your VPN gateway creates a unique child security association (SA) per CIDR. You must ensure that the 30 CIDR ranges in your on-premises network are reachable from Google Cloud. Following Google-recommended practices, which two methods can you use to accomplish this? (Choose two.)

Create a single Cloud VPN tunnel that uses route-based VPN. Source Reference Answer
Create a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors.
Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to unique peer IP addresses. Source Reference Answer
Create multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the remote traffic selectors.
Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to the same peer IP address.

Community Votes

100%

100% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests your ability to map static on-premises CIDRs to GCP VPN architectures, with the common trap being the misapplication of policy-based routing limits or ignoring the unique child SA constraint.

This question evaluates configuring Cloud VPN connections between Google Cloud and on-premises networks lacking BGP support. The community consensus strongly validates using route-based VPNs or multiple policy-based tunnels to statically route multiple CIDR blocks.

Candidates frequently select option B, incorrectly assuming policy-based routing can efficiently bundle 30 CIDRs into a single tunnel, overlooking Google’s guidance on traffic selector limits and configuration overhead.

Community Discussion (7 comments)

waelghaith 👍 1 Selected: AC

A & C Answer here: recheck this link and check your answer https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing#route-alignment

netmaster81 👍 1 Selected: AC

IKEv1 supports 1 CIDR for each VPN and on SA for each IKEv2 supports up to 30 CIDR for each VPN but all of them share one SA as the current VPN use unique SA for each CIDR then we can't use IKEV2.. not B

AzurePete 👍 1 Selected: BD

B. Create a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors. D. Create multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the remote traffic selectors. Policy-based routing allows you to specify which traffic is sent over specific tunnels based on the local and remote traffic selectors (CIDR blocks). You can either create a single tunnel with 30 remote traffic selectors (option B) or create multiple tunnels, each with up to 10 remote traffic selectors (option D). Option A is incorrect because route-based VPNs require BGP, which your on-premises network does not support. Options C and E are incorrect because they suggest creating a tunnel for each CIDR block, which would result in 30 tunnels. This is unnecessary and would increase complexity and management overhead.

Positron75 👍 3 Selected: AC

The documentation points towards A+C: https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing?hl=en#route-alignment For A: "Use a route-based VPN. Both traffic selectors are 0.0.0.0/0 by definition for route-based VPNs. You can create routes that are more specific than the traffic selectors." For C: "Use policy-based routing to create multiple Cloud VPN tunnels so that each tunnel only has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. (...) Your peer VPN gateway must offer separate external IP addresses to which each Cloud VPN tunnel can connect. Tunnels on the same Classic VPN gateway must connect to unique peer gateway IP addresses."

desertlotus1211 👍 1

Answer A&B are correct.

dev62 👍 3

B&C : https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing

[Removed] 👍 2 Selected: AC

The correct methods are options A and C.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Route-based VPNs (Option A) utilize 0.0.0.0/0 traffic selectors by design, allowing you to install specific static routes for each on-premises CIDR without relying on BGP. This architecture cleanly separates control plane signaling from data plane routing, making it highly scalable for environments with numerous subnets. Option C aligns with Google’s recommended practice for policy-based routing when explicit CIDR-to-tunnel mapping is required, ensuring each tunnel negotiates its own security association per prefix as specified. Together, these approaches satisfy the connectivity requirements while adhering to cloud networking best practices.

Why the Other Options Are Wrong

Option B attempts to force 30 CIDRs into a single policy-based tunnel’s remote traffic selectors, which violates configuration limits and degrades packet processing performance. Option D unnecessarily fragments the routing table across multiple tunnels with arbitrary CIDR splits, increasing operational complexity without solving the underlying routing alignment issue. Option E proposes sharing a single peer IP address across multiple policy-based tunnels, which typically triggers IPsec negotiation conflicts and prevents proper stateful inspection unless strictly isolated by different local and remote selectors, making it unreliable in production.

Community Comment Notes

Test-takers overwhelmingly cite Google’s official route-alignment documentation to confirm that route-based and multi-tunnel policy-based setups are the only viable paths. Comment [1] accurately explains that route-based VPNs default to broad traffic selectors, enabling granular static route installation post-negotiation. Comment [5] provides crucial technical context regarding IKEv2 child SA behaviors versus the scenario’s unique SA-per-CIDR requirement, which directly eliminates single-tunnel policy options. The overwhelming vote distribution reinforces that understanding traffic selector mechanics is essential for passing this exam objective.

Official Reference

Exam Strategy

Always map explicit network constraints like 'no BGP' and 'unique child SA per CIDR' directly to Google’s documented VPN architectures before guessing. Prioritize route-based solutions for scalability, and reserve policy-based multi-tunnel designs for strict CIDR segregation requirements.

Related Analysis

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide