Troubleshoot VPC Network Peering

Key Takeaways

foreign [Music] Google Cloud virtual private cloud or VPC Network peering allows private connectivity across two VPC networks so that workloads in different VPC networks can communicate with each other since VPC Network pairing uses Andromeda Google's implementation of sdn and Google infrastructure for private IP connectivity it offers several advantages like better security low Network latency and low Network address cost you may encounter errors with VPC peering if not configured correctly or if certain considerations are not followed today I'll walk you through how to troubleshoot and resolve some common issues with BBC Network peering and share some key points to be considered while creating or managing VPC Network period for today's demo consider the following topology VPC a and vpcb created in the same project vpca has subnet a with IP range 10.0.1.0 24 and subnet x with iprange 10.0.10.0 24. it also has instance a and a static route route a for 4.2.2.2 associated with subnet a similarly vpcb has subnet p with an IP range 10.0.2.0 24 and subnet y with IP range 10.0.10.0 24. it also has instance b and a static route route B for 8.8.8.8 associated with subnet B let's start with the first issue unable to create VPC Network peering I'll set up a VPC Network appearing from VPC a to vpcb and from vpcb to VPC a in the Google Cloud console go to VPC Network select VPC Network peering click create connection click continue setup VPC Network peering from VPC a to vpcb Import and Export subnet routes with privately used public ipv4 addresses click create the network pairing will be an inactive State until we configure Network peering from vpcb to vpca use the same process and create network pairing from vpcb to vpca click create peering connection click continue oops we are getting an error while creating the pairing it says an IP range in the peer Network 10.0.10.0 24 overlaps with an IP range in the local network the subnet IP ranges in peer VPC networks cannot overlap in our example subnet X in VPC a and subnet Y in vpcb I have overlapping IP ranges to fix this issue I'll remove subnet y from vpcb and try again there you go both the VPC Network keyrings are created and are in active State another common issue is all or some custom static or dynamic routes are not imported to the pr VPC Network this can happen due to various reasons let's check one by one static routes in a peer Network that use Network tags are never imported as peering custom routes in our case we don't have static routes with network tags static routes in peer Network that use default internet gateway as the next hub are never imported as peering custom routes let's go to each bearing and check imported and exported custom routes yeah subnet routes have been exported to the peer Network and have been imported from the peer Network custom route route a for 4.2.2.2 is neither exported by the network nor imported by the peer this is because custom routes are imported by a peer Network only if export custom routes option on the VPC peering is selected in the Network that has the custom routes and the import custom routes option on the VPC peering is selected in the peer Network that should be receiving the custom routes both these options are unselected in our setup let's enable the options and check again yeah the custom routes are exported by the network and accepted by the peer apart from this keep in mind that when a network reaches the per peering group limit of dynamic routes no more routes can be imported in such cases peering Dynamic routes might be dropped however it is not possible to determine which routes are omitted you need to contact Google Cloud support in this case now in our setup let's have another VPC vpcc which is paired with vpcb and vice versa so effectively we have a VPC Network pairing between VPC a and vpcb as well as between vpcb and vpcc one common issue that can be seen with this setup is vpca and vpcc cannot communicate with each other in fact this is not an issue but a constraint only directly peered networks can communicate because transitive peering is not supported with VPC peer to resolve this issue and have connectivity between VPC a and vpcc we need to configure separate VPC Network peering from VPC a to TCC and from vpcc to vpca to conclude I would like to share some key points to be considered while configuring VPC Network peering and troubleshooting any issues a VPC Network can pair with multiple VPC networks but there is a limit review VPC Network peering results you cannot bear two different auto mode VPC networks because all Automotive VPC networks have the exact same subnets each side of a peering connection is set up independently peering will become active only when configuration matches on both sides only directly peered networks can communicate transitive peering is not supported you can't disable the subnet route exchange or select which subnet routes are exchanged the subnet IP ranges in peered VPC networks cannot overlap VPC players always export subnet routes for more information on VPC Network pairing check out this documentation thanks for watching foreign [Music]