No More Hybrid Cloud Headaches

Key Takeaways

You've got a hybrid cloud setup, right? Some on-prem stuff, some cloud stuff. Do you ever feel like it has a few blind spots? >> Yes. Especially when it comes to traffic flowing between my on premises environment and Google Cloud. >> Well, we're going to tackle a few challenges in hybrid network observability and how VPC flow logs are evolving to give you full visibility. >> Ooh, fantastic. >> Let's jump right into our first challenge. Imagine traffic flowing from your on- premises data center through a cloud interconnect or VPN and into a VM in Google Cloud. >> I don't have to imagine that hard. That's what I have going on now. >> VPC flow logs were generated only for traffic entering and exiting a VM. While these logs capture basic information like source IP and port, they don't tell you how that traffic arrived. Was it via cloud interconnect, cloudVPN? The current logs simply don't provide that hybrid metadata, leaving you to guess. >> Oh yeah, I'm fully aware. Tell me there's a solution. >> There's a solution. To fix this, VPC flow log coverage now includes hybrid traffic by adding new sampling points. This means you'll be able to generate flow logs directly for traffic passing through your interconnect attachments and VPN tunnels. Even better, these logs will include new gateway annotations that clearly indicate whether traffic arrived via an interconnect attachment or VPN tunnel. Well, this just made my day. What if your on premises traffic goes directly to a Google managed service like Google Cloud Storage, bypassing any VMs entirely? Since this traffic never touches a VM, it's not captured in VPC flow logs, right? This leaves you with zero visibility into the critical data flow. Well, more good news. Now you'll be able to generate flow logs for this traffic directly at the interconnect attachment or VPN tunnel level. Flow logs will include service name annotations for traffic to Google managed services. Instead of just a generic Google IP, your logs will tell you exactly which Google service like cloud storage or bitquery was accessed. That's some precise visibility. But what about traffic flowing between two different onremises data centers but using cloud interconnect as the backbone? This traffic also completely bypasses the VMs, meaning you currently have absolutely no visibility into these transit flows. In this scenario where your on premises data centers communicate via Google Cloud flow logs will now be captured at both the source interconnect attachment and the destination interconnect attachment. This means complete visibility into that transit traffic which was previously impossible. You'll see who's talking to whom across your entire hybrid network directly in your logs. >> Wow, these expanded VPC flow log capabilities are a gamecher for hybrid network observability. So much granular detail and context to help troubleshoot, optimize, and secure my entire network footprint. >> Yep. Say goodbye to those hybrid blind spots and hello to full visibility. [Music]