Why advanced networking matters in GCP - See It in Action

Why advanced networking matters

📖 Scenario: You are working for a company that wants to improve its cloud network setup on Google Cloud Platform (GCP). The company needs to organize its network resources to ensure secure, fast, and reliable communication between its cloud services and users.

🎯 Goal: Build a simple Google Cloud Virtual Private Cloud (VPC) network with subnets and firewall rules to understand why advanced networking matters for cloud infrastructure.

📋 What You'll Learn

Create a VPC network named company-vpc

Add two subnets named frontend-subnet and backend-subnet with specified IP ranges

Create a firewall rule named allow-internal to allow internal communication between instances

Create a firewall rule named allow-ssh to allow SSH access from any IP

💡 Why This Matters

🌍 Real World

Companies use advanced networking in cloud to separate workloads, secure communication, and control access between services and users.

💼 Career

Cloud engineers and network administrators need to design and manage VPCs, subnets, and firewall rules to ensure secure and efficient cloud environments.

1

Create the VPC network

Create a VPC network called company-vpc using the gcloud command with the --subnet-mode=custom option.

GCP

# Your code here to create the VPC network

Hint

Use the gcloud compute networks create command with the --subnet-mode=custom flag to create a VPC network that allows you to define your own subnets.

2

Add subnets to the VPC network

Add two subnets to the company-vpc network: create frontend-subnet in region us-central1 with IP range 10.0.1.0/24, and create backend-subnet in region us-central1 with IP range 10.0.2.0/24. Use the gcloud compute networks subnets create command for each subnet.

GCP

gcloud compute networks create company-vpc --subnet-mode=custom
# Your code here to create frontend-subnet and backend-subnet

Hint

Use the gcloud compute networks subnets create command twice, once for each subnet, specifying the network, region, and IP range.

3

Create firewall rule to allow internal communication

Create a firewall rule named allow-internal on the company-vpc network that allows all protocols and ports for traffic between instances with IP ranges 10.0.0.0/16. Use the gcloud compute firewall-rules create command with --allow all and --source-ranges=10.0.0.0/16.

GCP

gcloud compute networks create company-vpc --subnet-mode=custom
gcloud compute networks subnets create frontend-subnet --network=company-vpc --region=us-central1 --range=10.0.1.0/24
gcloud compute networks subnets create backend-subnet --network=company-vpc --region=us-central1 --range=10.0.2.0/24
# Your code here to create allow-internal firewall rule

Hint

Use gcloud compute firewall-rules create with --allow all and --source-ranges=10.0.0.0/16 to allow all internal traffic.

4

Create firewall rule to allow SSH access

Create a firewall rule named allow-ssh on the company-vpc network that allows TCP port 22 from any IP address. Use the gcloud compute firewall-rules create command with --allow tcp:22 and --source-ranges=0.0.0.0/0.

GCP

gcloud compute networks create company-vpc --subnet-mode=custom
gcloud compute networks subnets create frontend-subnet --network=company-vpc --region=us-central1 --range=10.0.1.0/24
gcloud compute networks subnets create backend-subnet --network=company-vpc --region=us-central1 --range=10.0.2.0/24
gcloud compute firewall-rules create allow-internal --network=company-vpc --allow all --source-ranges=10.0.0.0/16
# Your code here to create allow-ssh firewall rule

Hint

Use gcloud compute firewall-rules create with --allow tcp:22 and --source-ranges=0.0.0.0/0 to allow SSH from anywhere.

Practice

1. Why is advanced networking important in Google Cloud Platform (GCP)?

easy

A. It helps connect cloud resources securely and efficiently.

B. It automatically fixes all software bugs.

C. It increases the size of virtual machines.

D. It reduces the cost of cloud storage.

Solution

1. Step 1: Understand the role of networking in cloud

   Networking connects different cloud resources so they can communicate.

2. Step 2: Recognize the benefits of advanced networking

   Advanced networking adds security and efficiency to these connections.

3. Final Answer:

   It helps connect cloud resources securely and efficiently. -> Option A

4. Quick Check:

   Advanced networking = secure, efficient connections [OK]

Hint: Think about how cloud parts talk safely and fast [OK]

Common Mistakes:

• Confusing networking with software debugging
• Mixing networking with storage or VM sizing
• Assuming networking reduces costs directly

2. Which of the following is the correct way to create a custom VPC network in GCP using gcloud CLI?

easy

A. gcloud compute networks new my-network --subnet-mode=auto

B. gcloud compute networks create my-network --subnet-mode=custom

C. gcloud network create my-network --subnet=custom

D. gcloud compute create network my-network --mode=auto

Solution

1. Step 1: Recall gcloud command syntax for creating networks

   The correct command uses 'gcloud compute networks create' with '--subnet-mode=custom' to specify custom subnets.

2. Step 2: Check each option for correct syntax

   gcloud compute networks create my-network --subnet-mode=custom matches the correct syntax; others have wrong commands or flags.

3. Final Answer:

   gcloud compute networks create my-network --subnet-mode=custom -> Option B

4. Quick Check:

   Correct gcloud network create syntax = gcloud compute networks create my-network --subnet-mode=custom [OK]

Hint: Remember 'gcloud compute networks create' plus subnet mode [OK]

Common Mistakes:

• Using 'create network' instead of 'networks create'
• Mixing 'subnet-mode' with wrong flags
• Using 'new' instead of 'create'

3. Given this firewall rule configuration in GCP, what will happen if you try to connect to a VM on port 22 (SSH)?

gcloud compute firewall-rules create allow-ssh --network=my-network --allow=tcp:22 --source-ranges=10.0.0.0/24

medium

A. SSH connections from IPs outside 10.0.0.0/24 will be blocked.

B. SSH connections from any IP address will be allowed.

C. All traffic to port 22 will be blocked.

D. SSH connections from 0.0.0.0/0 will be allowed.

Solution

1. Step 1: Analyze the firewall rule source range

   The rule allows TCP port 22 only from IPs in 10.0.0.0/24 subnet.

2. Step 2: Understand effect on SSH connections

   SSH from IPs outside 10.0.0.0/24 will be blocked because no rule allows them.

3. Final Answer:

   SSH connections from IPs outside 10.0.0.0/24 will be blocked. -> Option A

4. Quick Check:

   Firewall source range limits access = SSH connections from IPs outside 10.0.0.0/24 will be blocked. [OK]

Hint: Check source-ranges to see who can connect [OK]

Common Mistakes:

• Assuming all IPs can connect
• Confusing source-ranges with destination
• Ignoring firewall rule specificity

4. You created a custom subnet in GCP but your VM instances cannot reach the internet. What is the most likely cause?

medium

A. The VM instances have static internal IPs.

B. Firewall rules allow all outbound traffic.

C. The subnet is set to auto mode.

D. No Cloud NAT or external IP assigned to the VM instances.

Solution

1. Step 1: Understand internet access requirements

   VMs in custom subnets need either external IPs or Cloud NAT to access the internet.

2. Step 2: Identify missing component

   If VMs lack external IPs and no Cloud NAT is configured, they cannot reach the internet.

3. Final Answer:

   No Cloud NAT or external IP assigned to the VM instances. -> Option D

4. Quick Check:

   Internet access needs NAT or external IP [OK]

Hint: Check if VMs have external IP or Cloud NAT [OK]

Common Mistakes:

• Assuming firewall rules block outbound by default
• Confusing auto and custom subnet modes
• Thinking static internal IPs block internet

5. You want to design a GCP network architecture that isolates sensitive workloads but allows secure communication between them and public-facing services. Which advanced networking features should you combine?

hard

A. Assign public IPs to all VMs and disable firewall rules.

B. Use a single auto mode VPC with no firewall rules.

C. Use separate custom VPCs with VPC peering and firewall rules to control traffic.

D. Use default network and rely on default firewall rules.

Solution

1. Step 1: Identify isolation and secure communication needs

   Separate VPCs isolate workloads; VPC peering allows controlled communication.

2. Step 2: Apply firewall rules for traffic control

   Firewall rules restrict and allow only needed traffic between workloads and public services.

3. Final Answer:

   Use separate custom VPCs with VPC peering and firewall rules to control traffic. -> Option C

4. Quick Check:

   Isolation + secure communication = VPC peering + firewall [OK]

Hint: Combine VPC peering and firewall rules for isolation and access [OK]

Common Mistakes:

• Using auto mode VPCs without control
• Assigning public IPs to sensitive workloads
• Relying on default network without customization