Network intelligence tools in GCP - Commands & Configuration

Introduction

Network intelligence tools help you understand and troubleshoot your cloud network. They show how data moves and where problems might be, so you can fix issues faster and keep your apps running smoothly.

When you want to check if your cloud servers can talk to each other without problems

When you need to find out why your app is slow or not connecting

When you want to see the path your data takes across the network

When you want to monitor network health and spot unusual traffic

When you need to verify firewall rules and network settings

Commands

This command lists all subnets in the us-east1 region to understand your network layout.

Terminal

gcloud compute networks subnets list --region us-east1

Expected Output

NAME           REGION    NETWORK         RANGE

default        us-east1  default         10.128.0.0/20

custom-subnet  us-east1  custom-network  10.10.0.0/16

→

--region - Specifies the region to list subnets from

This shows any network peerings for the default network, helping you see connections between networks.

Terminal

gcloud compute networks peerings list --network default

Expected Output

NAME           NETWORK        PEER_NETWORK   STATE

peering-1      default        peer-network   ACTIVE

→

--network - Specifies the network to check peerings for

This lists firewall rules for the default network so you can check what traffic is allowed or blocked.

Terminal

gcloud compute firewall-rules list --filter="network=default"

Expected Output

NAME                    NETWORK  DIRECTION  PRIORITY  ALLOW

default-allow-ssh        default  INGRESS    1000      tcp:22

default-allow-internal   default  INGRESS    65534     tcp:0-65535,udp:0-65535,icmp

→

--filter - Filters firewall rules by network

This command shows detailed info about the default subnet in us-east1, including IP ranges and flow logs.

Terminal

gcloud compute networks subnets describe default --region us-east1

Expected Output

name: default

region: us-east1

network: default

ipCidrRange: 10.128.0.0/20

privateIpGoogleAccess: false

flowLogsConfig:

  aggregationInterval: INTERVAL_5_SEC

  flowSampling: 0.5

  metadata: INCLUDE_ALL_METADATA

→

--region - Specifies the region of the subnet

This enables flow logs on the default subnet to collect network traffic data for analysis.

Terminal

gcloud compute networks subnets update default --region us-east1 --enable-flow-logs

Expected Output

Updated [https://www.googleapis.com/compute/v1/projects/my-project/regions/us-east1/subnetworks/default].

→

--enable-flow-logs - Turns on flow logs for the subnet

→

--region - Specifies the region of the subnet

Key Concept

If you remember nothing else from this pattern, remember: network intelligence tools let you see and understand your cloud network traffic and settings to find and fix problems.

Common Mistakes

Not specifying the region when listing or describing subnets

The command will fail or show no results because subnets are regional resources.

Always include the --region flag with the correct region name.

Trying to enable flow logs on a subnet without proper permissions

The command will fail with a permission error, blocking flow log setup.

Ensure you have the Compute Network Admin role or equivalent before enabling flow logs.

Filtering firewall rules without specifying the correct network name

You might get no results or rules from the wrong network, causing confusion.

Use the exact network name in the --filter flag to get accurate firewall rules.

Summary

Use gcloud commands to list and describe your networks and subnets to understand your cloud network layout.

Check network peerings and firewall rules to see how networks connect and what traffic is allowed.

Enable flow logs on subnets to collect detailed network traffic data for troubleshooting and monitoring.

Practice

1. What is the main purpose of GCP's Network Intelligence Tools?

easy

A. To manage user permissions

B. To create virtual machines

C. To check and understand cloud network connections

D. To store large amounts of data

Solution

1. Step 1: Understand the role of Network Intelligence Tools

   These tools are designed to help users check and understand how their cloud network connections work.

2. Step 2: Compare with other options

   Creating virtual machines, storing data, and managing permissions are handled by other GCP services, not Network Intelligence Tools.

3. Final Answer:

   To check and understand cloud network connections -> Option C

4. Quick Check:

   Network Intelligence Tools = Check network connections [OK]

Hint: Network tools check connections, not create or store [OK]

Common Mistakes:

• Confusing network tools with VM creation
• Thinking network tools manage data storage
• Assuming network tools handle user permissions

2. Which gcloud command is used to run a connectivity test with Network Intelligence Tools?

easy

A. gcloud network-intelligence connectivity-tests create

B. gcloud compute instances create

C. gcloud storage buckets list

D. gcloud iam roles describe

Solution

1. Step 1: Identify the command for running connectivity tests

   The correct command to run a connectivity test is gcloud network-intelligence connectivity-tests create.

2. Step 2: Eliminate unrelated commands

   Other commands relate to creating instances, listing storage buckets, or describing IAM roles, which are unrelated to network tests.

3. Final Answer:

   gcloud network-intelligence connectivity-tests create -> Option A

4. Quick Check:

   Run connectivity test = gcloud network-intelligence connectivity-tests create [OK]

Hint: Look for 'network-intelligence connectivity-tests create' command [OK]

Common Mistakes:

• Using compute or storage commands instead
• Confusing IAM commands with network tests
• Missing 'network-intelligence' in the command

3. What will be the output of this command?

gcloud network-intelligence connectivity-tests describe test-1

Assuming test-1 exists and ran successfully.

medium

A. Error: test-1 not found

B. Details of the connectivity test including source, destination, and result

C. List of all connectivity tests

D. Command to create a new test

Solution

1. Step 1: Understand the describe command

   The describe command shows detailed information about a specific connectivity test.

2. Step 2: Confirm test existence and success

   Since test-1 exists and ran successfully, the output will include its details like source, destination, and test result.

3. Final Answer:

   Details of the connectivity test including source, destination, and result -> Option B

4. Quick Check:

   Describe test = show test details [OK]

Hint: Describe shows details of one test, not list or errors [OK]

Common Mistakes:

• Expecting a list of tests instead of details
• Assuming error if test exists
• Confusing describe with create command

4. You run gcloud network-intelligence connectivity-tests describe test-2 but get an error saying the test does not exist. What is the likely cause?

medium

A. Network Intelligence Tools are not enabled in the project

B. The command syntax is incorrect

C. The source VM is down

D. The test test-2 was not created

Solution

1. Step 1: Analyze the error message

   The error says the test does not exist, meaning it was never created.

2. Step 2: Check command and environment

   The command syntax is correct, and the error is specific to the test name, not the service or VM status.

3. Final Answer:

   The test test-2 was not created -> Option D

4. Quick Check:

   Describe error = test missing [OK]

Hint: Create test before describing it to avoid 'not exist' error [OK]

Common Mistakes:

• Assuming syntax error without checking test existence
• Blaming service enablement without error details
• Thinking VM status causes test not found error

5. You want to check if a VM in one region can connect to a Cloud SQL instance in another region. Which Network Intelligence Tool and approach should you use?

hard

A. Create and run a connectivity test specifying the VM as source and Cloud SQL as destination

B. Use Cloud Storage to transfer data between regions

C. Run a firewall rule audit to check permissions only

D. Create a new VM in the same region as Cloud SQL

Solution

1. Step 1: Identify the tool for cross-region connectivity checks

   Network Intelligence Tools allow creating connectivity tests between source and destination resources across regions.

2. Step 2: Choose the correct approach

   Creating and running a connectivity test with the VM as source and Cloud SQL as destination directly tests network reachability.

3. Step 3: Eliminate other options

   Cloud Storage is unrelated to connectivity tests, firewall audits check rules but not actual connectivity, and creating a new VM does not test existing network paths.

4. Final Answer:

   Create and run a connectivity test specifying the VM as source and Cloud SQL as destination -> Option A

5. Quick Check:

   Connectivity test = VM to Cloud SQL check [OK]

Hint: Use connectivity test for cross-region VM to Cloud SQL checks [OK]

Common Mistakes:

• Confusing storage transfer with network testing
• Thinking firewall audit alone confirms connectivity
• Creating new VM instead of testing existing connection