Console
Start free

Create a Cloud Router to connect a VPC network to a peer network

This page outlines the Cloud Router configuration process necessary to exchange routes between a Virtual Private Cloud (VPC) network or NCC Gateway and a peer network. The peer network can be an on-premises network, a network hosted by another cloud provider such as AWS or Azure, or even another VPC network in Google Cloud.

The Cloud Router configuration process consists of these three high-level tasks:

  1. Create a Cloud Router.
  2. Set up a network connectivity product in Google Cloud.
  3. Establish Border Gateway Protocol (BGP) sessions with a router on the peer network.

Before you begin

gcloud

If you want to use the command-line examples in this guide, do the following:

  1. Install or update to the latest version of the Google Cloud CLI.
  2. Set a default region and zone.

API

If you want to use the API examples in this guide, set up API access.

Autonomous system number (ASN)

When you create a Cloud Router, you choose the Google-side ASN for all BGP sessions used by the Cloud Router. Directions for each product and how they use ASN are listed in Google Cloud products that use Cloud Router.

Create a Cloud Router

To create a Cloud Router, follow these steps.

If you want to create a Cloud Router that's associated with an NCC Gateway spoke, you must use either the Google Cloud CLI or the Cloud Router API instructions in this section. For more information, see Add hybrid connections to NCC Gateway.

Console

  • In the Google Cloud console, go to the Create a Cloud Router page.

    Go to Create a Cloud Router

    • Specify the Cloud Router's details:

  • Optional: To specify custom advertised routes, go to the Advertised routes section. For more information, see Advertised routes.
    1. To specify custom Routes, select Create custom routes.
    2. Choose whether to advertise the subnets visible to the Cloud Router. Enabling this option mimics the Cloud Router's default behavior.
    3. To add an advertised route, select Add a custom route, and then configure it.
  • To save your settings and create a Cloud Router, click Create. Your new Cloud Router appears on the Cloud Router listing page. To view its details and to configure a BGP session, select it.

    • gcloud

    The gcloud compute routers create command creates a new Cloud Router. A Cloud Router is associated either with a VPC network or an NCC Gateway spoke. Once created, you can't change the region, the associated VPC network, or the associated NCC Gateway spoke.

    The --set-advertisement-groups=ALL_SUBNETS flag is valid only when the --advertisement-mode=CUSTOM flag is set. When this flag and value are specified, the router-level advertisements include local subnet ranges according to the dynamic routing mode of the VPC network.

    For more information, see Subnet range advertisement.

    Include the --encrypted-interconnect-router flag only if the Cloud Router manages BGP sessions for HA VPN over Cloud Interconnect.

    Terraform

    Use the Google Cloud Terraform module for Cloud Router.

    module "cloud_router" {
  source = "../.."

  name   = "my-router"
  region = "us-central1"

  bgp = {
    # The ASN (16550, 64512 - 65534, 4200000000 - 4294967294) can be any private ASN
    # not already used as a peer ASN in the same region and network or 16550 for Partner Interconnect.
    asn = "65001"
  }

  project_id = var.project_id
  network    = module.vpc.network_name
}

    To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

    API

    The routers.insert method creates a new Cloud Router. A Cloud Router is associated either with a VPC network or an NCC Gateway spoke. Once created, you can't change the region, the associated VPC network, or the associated NCC Gateway spoke.

    The "advertisedGroups": [ALL_SUBNETS] flag is valid only when bgp.advertiseMode: CUSTOM, when bgp.advertisedGroups: [ALL_SUBNETS], the router-level advertisements include local subnet ranges according to the dynamic routing mode of the VPC network. For more information, see Subnet range advertisement.

    The encryptedInterconnectRouter flag is a boolean parameter to indicate whether the Cloud Router manages BGP sessions for HA VPN over Cloud Interconnect.

    Set up the network connectivity product

    A Cloud Router that's associated with a region of a VPC network can manage BGP sessions for the following connectivity products:

    A Cloud Router that's associated with an NCC Gateway spoke can manage BGP sessions for VLAN attachments associated with the NCC Gateway spoke.

    Cloud Interconnect

    To connect a VPC network to an on-premises network by using Cloud Interconnect and Cloud Router, you must first provision a Cloud Interconnect connection.

    You configure Cloud Router and its BGP sessions when you create the VLAN attachments for your Cloud Interconnect connection. See Create VLAN attachments for Dedicated Interconnect and Create VLAN attachments for Partner Interconnect.

    If you are deploying HA VPN over Cloud Interconnect, you must deploy two Cloud Routers:

  • A special Cloud Router for Cloud Interconnect that you configure for the VLAN attachments. This Cloud Router makes sure that only traffic encrypted by the HA VPN gateways can be sent to the VLAN attachment.

    • A regular Cloud Router that you configure for HA VPN tunnels.

    Cloud VPN

    To connect a VPC network to an on-premises or multicloud network by using HA VPN and Cloud Router, see Create an HA VPN gateway to a peer VPN gateway.

    To connect a VPC network to another VPC network by using HA VPN and Cloud Router, see Create an HA VPN between Google Cloud networks .

    You configure Cloud Router and its BGP sessions when you create the HA VPN tunnels to the peer network.

    Router appliances

    To connect a VPC network to a peer network by using Router appliances in a NCC hybrid spoke, see Create Router appliance instances.

    NCC Gateway spokes

    To configure VLAN attachments on an NCC Gateway spoke, see Add hybrid connections to NCC Gateway.

    Establish BGP sessions

    When you set up a network connectivity product with Cloud Router, you establish Border Gateway Protocol (BGP) sessions between the Cloud Router and the router on the peer network.

    You can reuse the same Cloud Router with different network connectivity products. However, each BGP session is unique to the network connectivity product (VLAN attachment, Cloud VPN tunnel, or Router appliance instance) that you configure to use with Cloud Router. Different network connectivity products cannot use the same BGP session. Sometimes, you might need to set up multiple BGP sessions for a network connectivity product to achieve sufficient redundancy. For example, you set up multiple BGP sessions when using Cloud Router with HA VPN.

    To establish BGP sessions between your Cloud Router and the router on your peer network, see Establish BGP sessions.

    What's next