Networking in GCP: Defining and Implementing Networks

Content

• • Section 1: Designing, Planning, and Prototyping a GCP Network
  • 1.1 Designing the overall network architecture. Considerations include:
  • Failover and disaster recovery strategy
  • Options for high availability
  • DNS strategy (e.g., on-premises, Cloud DNS, GSLB)
  • Meeting business requirements
  • Meeting availability SLAs
  • Choosing the appropriate load balancing options
  • Optimizing for latency (e.g., MTU size, caches, CDN)
  • Understanding how quotas are applied per project and per VPC
  • Hybrid connectivity (e.g., Google private access for hybrid connectivity)
  • Container networking
  • IAM and security
  • SaaS, PaaS, and IaaS services
  • Microsegmentation for security purposes (e.g., using metadata, tags)
  • 1.2 Designing a Virtual Private Cloud (VPC). Considerations include:
  • CIDR range for subnets
  • IP addressing (e.g., static, ephemeral, private)
  • Standalone or shared
  • Multiple vs. single
  • Multi-zone and multi-region
  • Peering
  • Firewall (e.g., service account–based, tag-based)
  • Routes
  • Differences between Google Cloud Networking and other cloud platforms
  • 1.3 Designing a hybrid network. Considerations include:
  • Using Interconnect (e.g., dedicated vs. partner)
  • Peering options (e.g., direct vs. carrier)
  • IPsec VPN
  • Cloud Router
  • Failover and disaster recovery strategy (e.g., building high availability with BGP using cloud router)
  • Shared vs. standalone VPC Interconnect access
  • Cross-organizational access
  • Bandwidth
  • 1.4 Designing a Container IP Addressing plan for Google Kubernetes Engine

  • ---

    Section 2: Implementing a GCP Virtual Private Cloud (VPC)
  • 2.1 Configuring VPCs. Considerations include:
  • Configuring GCP VPC resources (CIDR range, subnets, firewall rules, etc.)
  • Configuring VPC Peering
  • Creating a shared VPC and explaining how to share subnets with other projects
  • Configuring API access (Private, Public, NAT GW, Proxy)
  • Configuring VPC flow logs
  • 2.2 Configuring routing. Tasks include:
  • Configuring internal static/dynamic routing
  • Configuring routing policies using tags and priority
  • Configuring NAT (e.g., CloudNAT, instance-based NAT)
  • 2.3 Configuring and maintaining Google Kubernetes Engine clusters. Considerations include:
  • VPC-native Clusters using Alias IPs
  • Clusters with Shared VPC
  • Private Clusters
  • Cluster Network policy
  • Adding authorized networks for Cluster Master Access
  • 2.4 Configuring and managing firewall rules. Considerations include:
  • Target network tags and service accounts
  • Priority
  • Network protocols
  • Ingress and egress rules
  • Firewall logs

  • ---

    Section 3: Configuring Network Services
  • 3.1 Configuring load balancing. Considerations include:
  • Creating backend services
  • Firewall and security rules
  • HTTP(S) load balancer: including changing URL maps, backend groups, health checks, CDN, and SSL certs
  • TCP and SSL Proxy Load Balancers
  • Network load balancer
  • Internal load balancer
  • Session affinity
  • Capacity scaling
  • 3.2 Configuring Cloud CDN. Considerations include:
  • Enabling and disabling Cloud CDN
  • Using cache keys
  • Cache invalidation
  • Signed URLs
  • 3.3 Configuring and maintaining Cloud DNS. Considerations include:
  • Managing zones and records
  • Migrating to Cloud DNS
  • DNS Security (DNSSEC)
  • Global serving with Anycast
  • Cloud DNS
  • Internal DNS
  • Integrating on-premises DNS with GCP
  • 3.4 Enabling other network services. Considerations include:
  • Health checks for your instance groups
  • Canary (A/B) releases
  • Distributing backend instances using regional managed instance groups
  • Enabling private API access
  • Section 4: Implementing Hybrid Interconnectivity

  • ---

    Section 4: Implementing Hybrid Interconnectivity
  • 4.1 Configuring Interconnect. Considerations include:
  • Partner (e.g., Layer 2 vs. Layer 3 connectivity)
  • Virtualizing using Vlan attachments
  • Bulk storage uploads
  • 4.2 Configuring a site-to-site IPsec VPN (e.g., route-based, policy-based, dynamic or static routing).
  • 4.3 Configuring Cloud Router for reliability.

  • ---

    Section 5: Implementing Network Security
  • 5.1 Configuring Identity and Access Management (IAM). Tasks include:
  • Viewing account IAM assignments
  • Assigning IAM roles to accounts or Google Groups
  • Defining custom IAM roles
  • Using pre-defined IAM roles (e.g., network admin, network viewer, network user)
  • 5.2 Configuring Cloud Armor policies. Considerations include:
  • IP-based access control
  • 5.3 Configuring third-party device insertion into VPC using multi-nic (NGFW)
  • 5.4 Managing keys for SSH access

  • ---

    Section 6: Managing and Monitoring Network Operations
  • 6.1 Logging and monitoring with Stackdriver or GCP Console
  • 6.2 Managing and maintaining security. Considerations include:
  • Firewalls (e.g., cloud-based, private)
  • Diagnosing and resolving IAM issues (shared VPC, security/network admin)
  • 6.3 Maintaining and troubleshooting connectivity issues. Considerations include:
  • Identifying traffic flow topology (e.g., load balancers, SSL offload, network endpoint groups)
  • Draining and redirecting traffic flows
  • Cross-connect handoff for Interconnect
  • Monitoring ingress and egress traffic using flow logs
  • Monitoring firewall logs
  • Managing and troubleshooting VPNs
  • Troubleshooting Cloud Router BGP peering issues
  • 6.4 Monitoring, maintaining, and troubleshooting latency and traffic flow. Considerations include:
  • Network throughput and latency testing
  • Routing issues
  • Tracing traffic flow

  • ---

    Section 7: Optimizing Network Resources
  • 7.1 Optimizing traffic flow. Considerations include:
  • Load balancer and CDN location
  • Global vs. Regional dynamic routing
  • Expanding subnet CIDR ranges in service
  • Accommodating workload increases (e.g., autoscaling vs. manual scaling)
  • 7.2 Optimizing for cost and efficiency. Considerations include:
  • Cost optimization (Network Service Tiers, Cloud CDN, autoscaler (max instances))
  • Automation
  • VPN vs. Interconnect
  • Bandwidth utilization (e.g., kernel sys tuning parameters)