Planning and implementing a cloud solution · Topic 8 of 9
Connectivity, Load Balancers and Network Tiers
Cloud VPN, Cloud Interconnect and VPC Network Peering, choosing Google Cloud load balancers, and the difference between Premium and Standard Network Service Tiers.
- 4 min
- Includes a diagram
- HA VPN: encrypted over the internet, Cloud Router BGP, 99.99 percent SLA when redundant.
- Dedicated Interconnect: 10, 100 or 400 Gbps circuits at a colocation facility; Partner Interconnect through a provider; not encrypted by default.
- Load balancer choice: layer 7 (Application) or layer 4 (Network), external or internal, global or regional, proxy or passthrough.
What it is
Workloads must connect to on-premises networks, to other VPCs and to users. The exam covers network connectivity (Cloud VPN, Cloud Interconnect, VPC Network Peering), choosing a load balancer for the traffic type and audience, and the two Network Service Tiers.
How it works
Hybrid and VPC connectivity
| Option | What it is | Bandwidth and SLA | Choose when |
|---|---|---|---|
| HA VPN | IPsec tunnels over the internet, two interfaces, dynamic routing with Cloud Router (BGP) | Each tunnel up to about 3 Gbps; 99.99 percent SLA when configured with redundant tunnels | Encrypted connection quickly and cheaply, moderate bandwidth |
| Dedicated Interconnect | Physical connection between your network and Google at a colocation facility | 10 Gbps, 100 Gbps or 400 Gbps circuits | High bandwidth, low latency, you can reach a Google colocation facility |
| Partner Interconnect | Connectivity through a supported service provider | From 50 Mbps up to 50 Gbps | You cannot reach a Google facility or need less bandwidth |
| VPC Network Peering | Private connection between two VPCs | Google's network | Connect VPCs, not on premises |
Interconnect traffic does not travel over the public internet, but it is not encrypted by default; HA VPN over Interconnect or MACsec can add encryption.
"Encrypted, quick to set up, moderate bandwidth" is HA VPN. "Steady multi-gigabit traffic with low latency" is Interconnect, Dedicated if you can reach a facility, Partner otherwise.
Choosing a load balancer
Start with three questions: HTTP(S) or other traffic?, external or internal clients?, global or regional?
| Load balancer | Traffic | Clients | Scope | Typical use |
|---|---|---|---|---|
| Global external Application Load Balancer | HTTP and HTTPS (layer 7) | Internet | Global, one anycast IP | Websites and APIs with users worldwide; works with Cloud CDN and Cloud Armor |
| Regional external Application Load Balancer | HTTP and HTTPS | Internet | One region | Regional compliance needs |
| Internal Application Load Balancer | HTTP and HTTPS | Inside the VPC or connected networks | Regional or cross-region | Internal microservices |
| External proxy Network Load Balancer | TCP, with optional SSL offload | Internet | Global or regional | Non-HTTP TCP services |
| External passthrough Network Load Balancer | TCP, UDP and other IP protocols | Internet | Regional | Preserve client IP, UDP services such as gaming |
| Internal passthrough Network Load Balancer | TCP and UDP | Internal | Regional | Internal TCP and UDP services, such as databases behind a VIP |
Passthrough load balancers forward packets without terminating the connection, so the backend sees the client IP. Proxy load balancers terminate the connection and open a new one to the backend.
Network Service Tiers
| Premium Tier (default) | Standard Tier | |
|---|---|---|
| Path | Traffic enters and leaves Google's network close to the user and travels on Google's private backbone | Traffic travels mostly over the public internet and enters Google's network in the region of the resource |
| Performance | Lower latency, higher reliability | Lower performance |
| Cost | Higher egress price | Lower egress price |
| Global load balancing | Supported | Not supported; regional only |
Global external load balancers need Premium Tier. Standard Tier resources are regional.
A worked scenario
A media company serves a website to users worldwide through a global external Application Load Balancer with Cloud CDN, on Premium Tier. Its internal recommendation service uses an internal Application Load Balancer. The head office connects with HA VPN for now; the data center, which moves large nightly backups, uses Partner Interconnect because it cannot reach a Google colocation facility. A UDP game server uses an external passthrough Network Load Balancer to keep client IPs.
How the exam asks about this
- "Single global IP address for an HTTPS site with backends in several regions." Global external Application Load Balancer.
- "Load balance UDP traffic and preserve client IP." External passthrough Network Load Balancer.
- "Encrypted connection to on premises over the internet with 99.99 percent SLA." HA VPN with redundant tunnels.
- "Cheapest egress, latency not critical." Standard Tier.
What to remember for the exam
- HA VPN: encrypted over the internet, Cloud Router BGP, 99.99 percent SLA when redundant.
- Dedicated Interconnect: 10, 100 or 400 Gbps circuits at a colocation facility; Partner Interconnect through a provider; not encrypted by default.
- Load balancer choice: layer 7 (Application) or layer 4 (Network), external or internal, global or regional, proxy or passthrough.
- Premium Tier: Google backbone, global load balancing; Standard Tier: cheaper, regional.
Common mistakes
Choosing a Network Load Balancer for URL-based routing. URL and host routing are layer 7 features of Application Load Balancers.
Assuming Interconnect is encrypted. Add HA VPN over Interconnect or MACsec if encryption is required.
Using Standard Tier with a global load balancer. Global load balancing requires Premium Tier.
Check yourself
Which load balancer gives one global anycast IP for HTTPS traffic to backends in several regions?
The global external Application Load Balancer.
When would you choose Partner Interconnect over Dedicated Interconnect?
When you cannot reach a Google colocation facility or need less bandwidth than a 10 Gbps circuit.
What is the main tradeoff of Standard Tier networking?
Lower egress cost but lower performance, and only regional resources.
Topic 8 of 9 in Planning and implementing a cloud solution
Test yourself on Planning and implementing a cloud solution
The full Google Cloud Associate Cloud Engineer question bank has 661 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.