Managing Networking Resources

What it is

Networks change as workloads grow. Engineers expand subnets that run out of addresses, reserve static IP addresses, add custom static routes, publish names with Cloud DNS, give private VMs outbound internet with Cloud NAT, and manage firewall rules and Cloud NGFW policies.

How it works

Expanding a subnet

gcloud compute networks subnets expand-ip-range web-subnet \
  --region=us-central1 --prefix-length=20

You can expand a subnet's primary range (a smaller prefix length, such as /24 to /20) without downtime, as long as the new range does not overlap other subnets. You cannot shrink it. For a separate range, add a secondary range or create another subnet.

Reserving static IP addresses

You can also promote an ephemeral IP in use to static. Reserved external IPs that are not attached to anything are charged, so release unused ones.

Custom static routes

Every VPC has system-generated routes (subnet routes and a default route to the internet gateway). You can add custom static routes, for example to send traffic through a network appliance VM or to a VPN tunnel.

gcloud compute routes create to-onprem --network=prod-vpc \
  --destination-range=192.168.0.0/16 --next-hop-vpn-tunnel=tunnel-1 \
  --next-hop-vpn-tunnel-region=us-central1 --priority=1000

Routes can apply to all instances or only to instances with specific network tags. Dynamic routes learned through Cloud Router (BGP) are usually preferred for VPN and Interconnect because they update automatically.

Cloud DNS

Cloud DNS is a managed, authoritative DNS service.

gcloud dns managed-zones create shop-zone --dns-name="shop.example.com." \
  --description="Public zone" --visibility=public
gcloud dns record-sets create www.shop.example.com. --zone=shop-zone \
  --type=A --ttl=300 --rrdatas=203.0.113.10

Cloud NAT

Cloud NAT lets VMs and GKE nodes without external IPs make outbound connections to the internet, such as downloading updates. It does not allow inbound connections. It is configured on a Cloud Router per region.

gcloud compute routers create nat-router --network=prod-vpc --region=us-central1
gcloud compute routers nats create nat-config --router=nat-router --region=us-central1 \
  --auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges

Managing firewall rules and policies

gcloud compute firewall-rules list --filter="network=prod-vpc"
gcloud compute firewall-rules update allow-web --source-ranges=0.0.0.0/0 --rules=tcp:443
gcloud compute firewall-rules delete old-rule

Use Firewall Insights to find unused or shadowed rules, and enable firewall rules logging to see which rules allow or deny traffic. Cloud NGFW policies are managed with gcloud compute network-firewall-policies and associated with networks, or with hierarchical policies on folders and the organization.

A worked scenario

A subnet in us-central1 is running out of IPs as GKE grows; the engineer expands it from /24 to /20. Private VMs need operating system updates, so she sets up Cloud NAT on a Cloud Router. The web front end gets a global static IP for its load balancer, and a database gets a static internal IP. A private Cloud DNS zone gives internal names, and a forwarding zone resolves on-premises names.

How the exam asks about this

• "Subnet out of IP addresses, no downtime." expand-ip-range to a smaller prefix length.
• "VMs without external IPs need to download updates." Cloud NAT.
• "Internal hostnames only within the VPC." A Cloud DNS private zone.
• "Send traffic for an on-premises range through a VPN tunnel." A custom static route (or dynamic routes with Cloud Router).