GCP Networking Services: Architecture and Best Practices

Google Cloud Platform provides a comprehensive suite of networking services to build secure, scalable, and high-performance applications. This guide covers key networking services and their implementation.

Network Architecture Overview

Virtual Private Cloud (VPC)

1. Network Design

# Create VPC network
gcloud compute networks create my-vpc \
  --subnet-mode=custom \
  --bgp-routing-mode=regional

# Create subnets
gcloud compute networks subnets create subnet-1 \
  --network=my-vpc \
  --region=us-central1 \
  --range=10.0.1.0/24 \
  --secondary-range=services=192.168.1.0/24,pods=172.16.0.0/20

# Create firewall rules
gcloud compute firewall-rules create allow-internal \
  --network=my-vpc \
  --allow=tcp,udp,icmp \
  --source-ranges=10.0.0.0/8

2. Network Architecture

# network-config.yaml
vpc:
  name: my-vpc
  subnets:
    - name: subnet-1
      region: us-central1
      primary: 10.0.1.0/24
      secondary:
        - range_name: services
          ip_range: 192.168.1.0/24
        - range_name: pods
          ip_range: 172.16.0.0/20
    - name: subnet-2
      region: europe-west1
      primary: 10.0.2.0/24
  firewall_rules:
    - name: allow-internal
      direction: INGRESS
      priority: 1000
      source_ranges: ["10.0.0.0/8"]
      allow:
        - protocol: tcp
        - protocol: udp
        - protocol: icmp

Load Balancing

1. Global Load Balancer

# load-balancer.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: "gce"
    kubernetes.io/ingress.global-static-ip-name: "my-static-ip"
spec:
  rules:
  - host: my-app.example.com
    http:
      paths:
      - path: /*
        pathType: ImplementationSpecific
        backend:
          service:
            name: my-service
            port:
              number: 80

2. SSL Configuration

# Create SSL certificate
gcloud compute ssl-certificates create my-cert \
  --domains=my-app.example.com

# Configure SSL proxy
gcloud compute target-ssl-proxies create my-ssl-proxy \
  --ssl-certificates=my-cert \
  --backend-service=my-backend-service

Cloud CDN

1. CDN Configuration

# cdn-config.yaml
backends:
  - name: my-backend
    balancing_mode: UTILIZATION
    capacity_scaler: 1.0
    cdn_policy:
      cache_mode: CACHE_ALL_STATIC
      client_ttl: 3600
      default_ttl: 3600
      max_ttl: 86400
      negative_caching: true
      serve_while_stale: 86400

2. Cache Configuration

# Enable Cloud CDN
gcloud compute backend-services update my-backend-service \
  --enable-cdn \
  --global

# Configure cache key
gcloud compute backend-services update my-backend-service \
  --global \
  --cache-key-policy-include-host \
  --cache-key-policy-include-protocol \
  --cache-key-policy-include-query-string

Cloud Interconnect

1. Dedicated Interconnect

# Create interconnect
gcloud compute interconnects dedicated create my-interconnect \
  --customer-name="My Company" \
  --interconnect-type=IT_PRIVATE \
  --location=my-location

# Create VLAN attachment
gcloud compute interconnects attachments dedicated create my-attachment \
  --region=us-central1 \
  --interconnect=my-interconnect \
  --router=my-router \
  --vlan=1234

2. Cloud VPN

# vpn-config.yaml
vpn_tunnel:
  name: my-vpn
  region: us-central1
  peer_ip: "203.0.113.1"
  shared_secret: "your-secret-key"
  router: my-router
  ike_version: 2
  local_traffic_selector: ["10.0.1.0/24"]
  remote_traffic_selector: ["192.168.1.0/24"]

Network Security

1. Cloud Armor

# security-policy.yaml
securityPolicies:
  - name: my-policy
    rules:
      - action: allow
        priority: 1000
        match:
          versionedExpr: SRC_IPS_V1
          config:
            srcIpRanges: ["10.0.0.0/8"]
      - action: deny(403)
        priority: 2000
        match:
          versionedExpr: EXPR_V1
          expr:
            xss: {}

2. Firewall Rules

# Create hierarchical firewall policy
gcloud compute firewall-policies create my-policy \
  --organization=123456789

# Add rules to policy
gcloud compute firewall-policies rules create 1000 \
  --firewall-policy=my-policy \
  --action=allow \
  --direction=INGRESS \
  --enable-logging \
  --target-service-accounts=my-sa@my-project.iam.gserviceaccount.com \
  --layer4-configs=tcp:80,tcp:443

Network Monitoring

1. VPC Flow Logs

# flow-logs.yaml
flowLogs:
  enabled: true
  aggregationInterval: "INTERVAL_5_SEC"
  flowSampling: 0.5
  metadata: "INCLUDE_ALL_METADATA"

2. Network Intelligence

# Enable network intelligence
gcloud services enable \
  networkmanagement.googleapis.com

# Create connectivity test
gcloud network-management connectivity-tests create my-test \
  --source=projects/my-project/zones/us-central1-a/instances/source-vm \
  --destination=projects/my-project/zones/us-central1-b/instances/dest-vm \
  --protocol=TCP \
  --port=80

Performance Optimization

1. Network Tier Selection

# Set network tier
gcloud compute addresses create my-address \
  --network-tier=PREMIUM \
  --region=us-central1

# Configure instance network interface
gcloud compute instances create my-instance \
  --network-interface=network-tier=PREMIUM,subnet=subnet-1

2. Load Balancer Optimization

# lb-optimization.yaml
backendConfig:
  timeoutSec: 30
  connectionDraining:
    drainingTimeoutSec: 300
  sessionAffinity:
    type: CLIENT_IP
    cookieTtlSec: 3600
  customRequestHeaders:
    - "X-Client-Region: {client_region}"
    - "X-Client-IP: {client_ip}"

Cost Optimization

1. Network Design

   • Use appropriate network tiers
   • Optimize egress traffic
   • Implement caching strategies
   • Right-size load balancers

2. Traffic Management

   • Use Cloud CDN effectively
   • Optimize routing paths
   • Monitor usage patterns
   • Clean up unused resources

Best Practices

1. Network Security

   • Implement defense in depth
   • Use Cloud Armor
   • Enable flow logs
   • Regular security audits

2. Performance

   • Use Global Load Balancing
   • Implement Cloud CDN
   • Optimize routing
   • Monitor latency

3. Reliability

   • Design for high availability
   • Use multiple regions
   • Implement health checks
   • Plan for disaster recovery

Conclusion

GCP provides comprehensive networking services for building secure and scalable applications. Key takeaways:

• Design secure VPC networks
• Implement proper load balancing
• Use Cloud CDN effectively
• Monitor and optimize performance
• Follow security best practices

For more information, refer to the official documentation:

• VPC Documentation
• Load Balancing Documentation
• Cloud CDN Documentation
• Cloud Interconnect Documentation