Managing and provisioning a solution infrastructure · Topic 1 of 6
Hybrid and Multicloud Connectivity
Configuring HA VPN, Dedicated, Partner and Cross-Cloud Interconnect, Cloud Router and Network Connectivity Center, with the topologies that earn each SLA.
- 4 min
- Includes a diagram
- HA VPN: encrypted, quick, 99.99% with two interfaces in use.
- Interconnect: private and high bandwidth; 99.9% needs two edge availability domains in one metro, 99.99% needs two metros.
- Partner Interconnect when you cannot reach a Google colocation facility.
What it is
Hybrid connectivity joins Google Cloud to on-premises sites; multicloud connectivity joins it to other cloud providers. The exam tests which option fits the bandwidth, encryption, lead time and availability required, and which topology earns the SLA.
How it works
The options
| Option | Path | Encrypted by default | Typical use |
|---|---|---|---|
| HA VPN | IPsec over the internet | Yes | Quick setup, moderate bandwidth, backup for Interconnect |
| Dedicated Interconnect | Your own physical circuits at a Google colocation facility | No (add MACsec or HA VPN over Interconnect if needed) | High bandwidth, private path, consistent latency |
| Partner Interconnect | Through a supported service provider | No | Site not near a Google colocation facility, or smaller bandwidth |
| Cross-Cloud Interconnect | Google-provisioned links to another cloud provider | No | Private, high-bandwidth links to other clouds without your own equipment in a colocation facility |
Dedicated Interconnect circuits come in 10 Gbps and 100 Gbps sizes (and larger in some locations). Partner Interconnect attachments come in a range of smaller capacities through the provider. A single HA VPN tunnel carries a few Gbps, so higher VPN throughput needs several tunnels.
Topologies for the SLA
| Option | Topology | SLA |
|---|---|---|
| HA VPN | Two interfaces on the HA VPN gateway, each with a tunnel to the peer side, BGP on Cloud Router | 99.99% |
| Interconnect (Dedicated or Partner) | Two connections or attachments in different edge availability domains of one metro | 99.9% |
| Interconnect | Four connections across two metros (two per metro), with Cloud Routers in two regions | 99.99% |
A single connection, or two connections in the same edge availability domain, carry no availability SLA.
"Within one week" and "encrypted" point to HA VPN. "Consistent latency", "private" and tens of Gbps point to Interconnect. Interconnect circuits can take weeks or months to provision.
Cloud Router and routing
Cloud Router runs BGP with on-premises routers and learns and advertises routes. Dynamic routing mode decides whether routes learned in one region are used across all regions of the VPC (global) or only in that region (regional). Use custom route advertisements to advertise ranges such as Private Google Access addresses to on premises.
Reaching Google APIs privately from on premises
| Need | Configuration |
|---|---|
| Reach Google APIs over the hybrid link | Advertise private.googleapis.com or restricted.googleapis.com ranges and point DNS at them |
| Only APIs supported by VPC Service Controls | restricted.googleapis.com, or a Private Service Connect endpoint for the VPC-SC bundle |
| A private IP of your choice for Google APIs | A Private Service Connect endpoint for Google APIs |
Many sites and many networks
Network Connectivity Center uses a hub with spokes. Hybrid spokes (VPN tunnels, Interconnect attachments, router appliances) and VPC spokes attach to the hub. With site-to-site data transfer, branch sites or plants can reach each other over Google's network through their links to Google Cloud.
Google Cloud to Google Cloud
Between VPCs: VPC Network Peering, Shared VPC, Private Service Connect or Network Connectivity Center VPC spokes. HA VPN can also connect two Google Cloud VPC networks when encryption between them is required.
A worked scenario
A data center must send about 12 TB every night to Cloud Storage inside six hours, off the internet, and survive one path failing. That is about 4.4 Gbps sustained. Two 10 Gbps Dedicated Interconnect connections in separate edge availability domains give the capacity, the private path and redundancy; on-premises hosts reach Cloud Storage through Private Google Access over the link.
How the exam asks about this
- "Site not near a Google colocation facility, provider already serves it." Partner Interconnect.
- "About 28 Gbps sustained from another cloud, no equipment in a colocation facility." Cross-Cloud Interconnect.
- "99.99% with HA VPN." Both gateway interfaces, each with tunnels, BGP on Cloud Router.
What to remember for the exam
- HA VPN: encrypted, quick, 99.99% with two interfaces in use.
- Interconnect: private and high bandwidth; 99.9% needs two edge availability domains in one metro, 99.99% needs two metros.
- Partner Interconnect when you cannot reach a Google colocation facility.
- Cross-Cloud Interconnect for private links to other clouds.
- Network Connectivity Center for hub-and-spoke and site-to-site transfer.
Interconnect is not encrypted by default. If the stem requires encryption in transit, add MACsec or HA VPN over Cloud Interconnect, or choose HA VPN.
Common mistakes
One Interconnect connection and expecting an SLA.
Using only one HA VPN interface. That does not meet the 99.99% topology.
Ordering Interconnect for a one-week deadline. Provisioning takes longer.
Check yourself
Which Interconnect topology gives a 99.9% SLA?
Two connections in different edge availability domains of the same metro.
What gives a private high-bandwidth link to another cloud provider without your own routers in a colocation facility?
Cross-Cloud Interconnect.
Which service lets plants send traffic to each other over Google's network through their links to Google Cloud?
Network Connectivity Center with hybrid spokes and site-to-site data transfer.
Topic 1 of 6 in Managing and provisioning a solution infrastructure
Test yourself on Managing and provisioning a solution infrastructure
The full Google Cloud Professional Cloud Architect question bank has 877 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.