About This Edition: A clean, intermediate-level architectural guide covering all 22 Subsections and 133 Official Considerations of the Google Cloud Certified Professional Cloud Network Engineer curriculum, illustrated with Mermaid architecture blueprints and 266 custom-designed concept & architecture diagrams.
Chapter Plan at a Glance
Ch # | Chapter Title | Subsections | Considerations | Custom Diagrams | Core Focus |
|---|---|---|---|---|---|
00 | Overview | — | Mermaid | The Architectural Planes, plain-English guide to in-scope services, and the 10 Core Architectural Principles. | |
01 | 1.1, 1.2, 1.3 | 25 | 50 | HA/DR network topologies, DNS architecture, Global vs. Regional Load Balancer selection, RFC 1918/non-RFC 1918 IPAM, Shared VPC vs. Peering vs. NCC vs. PSC, and hybrid connectivity design. | |
02 | 2.1, 2.2, 2.3 | 19 | 38 | Subnet expansion, Private Google Access, Private Service Connect (Endpoints, Backends, Service Automation), VPC Peering custom route exchange, Policy-Based Routing, and NCC star/mesh hubs. | |
03 | 1.4, 2.4 | 18 | 36 | VPC-native alias IPs, Pod/Service secondary CIDR sizing, GKE Dataplane V2 (eBPF/Cilium), NetworkPolicies, Private Clusters, Connect Gateway, Container-Native Load Balancing (NEGs), and Cloud DNS for GKE. | |
04 | 3.1, 3.2, 3.3 | 18 | 36 | External/Internal Application & Proxy/Passthrough Network Load Balancers, Cross-Region LB, Traffic Director, Cloud CDN cache modes/signed URLs, Cloud DNS peering/forwarding, Split-Horizon DNS, and DNSSEC. | |
05 | 4.1, 4.2, 4.3, 4.4 | 16 | 32 | Dedicated vs. Partner vs. Cross-Cloud Interconnect, 99.9% vs. 99.99% SLA topologies, MACsec, HA VPN, Cloud Router BGP (MED, AS-Path prepending, Custom Advertised Routes, BFD), and Hybrid NCC spokes. | |
06 | 5.1, 5.2, 5.3 | 13 | 26 | VPC Flow Logs sampling/filtering, Firewall Rules Logging, Cloud NAT logging, BGP/VPN/MTU troubleshooting, Network Topology, Connectivity Tests, Performance Dashboard, and Firewall Insights. | |
07 | 6.1, 6.2, 6.3, 6.4 | 24 | 48 | Cloud Armor WAF/Adaptive Protection/rate limiting, Hierarchical & Global Network Firewall Policies, IAM Secure Tags, Cloud NGFW Enterprise (IPS), Cloud NAT (Public/Private), Secure Web Proxy, and NVAs/Packet Mirroring. | |
08 | All Sections | — | — | Side-by-side Look-Alike Tool Comparison Matrix, 5-Step Architecture Decision Checklist, and Top 25 Golden Rules. |
Detailed Table of Contents
Chapter 0: The PCNE Reference Stack & 10 Core Principles
- 0.1 The Master Architectural Map: All In-Scope Services of the PCNE Stack
- 0.2 The 10 Core Architectural Principles
Chapter 1: Enterprise Network Architecture, VPC Topology, IPAM Strategy & Multi-Cloud Design
- Subsection 1.1: Designing an overall network architecture (Section 1: Designing and Planning a Google Cloud VPC Network)
- Consideration 1.1a: Designing for high availability, failover, disaster recovery, and scale (Diagrams:
pcne-1.1a-1-eliminate-single-points.jpg,pcne-1.1a-2-global-dynamic-routing.jpg) - Consideration 1.1b: Designing the DNS topology (on-premises, Cloud DNS) (Diagrams:
pcne-1.1b-1-split-horizon-dns-dns.jpg,pcne-1.1b-2-hybrid-resolution.jpg) - Consideration 1.1c: Choosing a load balancer for an application or solution (Diagrams:
pcne-1.1c-1-axis-traffic-protocol.jpg,pcne-1.1c-2-axis-client-access.jpg) - Consideration 1.1d: Designing for hybrid connectivity including Private Google Access (Diagrams:
pcne-1.1d-1-private-access-pga-is.jpg,pcne-1.1d-2-private-googleapis-com.jpg) - Consideration 1.1e: Planning GKE networking including secondary ranges and control plane access (Diagrams:
pcne-1.1e-1-distinct-ip-ranges-in.jpg,pcne-1.1e-2-mandatory-2x-pod-cidr.jpg) - Consideration 1.1f: Planning IAM roles including Shared VPC (Diagrams:
pcne-1.1f-1-shared-vpc-setup.jpg,pcne-1.1f-2-roles-compute-xpnadmin.jpg) - Consideration 1.1g: Planning connectivity to managed services (Private Service Connect, PSA, Serverless VPC Access) (Diagrams:
pcne-1.1g-1-private-services-access.jpg,pcne-1.1g-2-it-works-networking-vpc.jpg) - Consideration 1.1h: Differentiating between network tiers (Premium and Standard) (Diagrams:
pcne-1.1h-1-premium-tier-default.jpg,pcne-1.1h-2-routing-path-vpc-network.jpg) - Quick Decision Cheat Sheet (Subsection 1.1)
- Subsection 1.2: Designing VPC networks (Section 1: Designing and Planning a Google Cloud VPC Network)
- Consideration 1.2a: Choosing VPC type and quantity (standalone or Shared VPC) (Diagrams:
pcne-1.2a-1-shared-vpc-is-default.jpg,pcne-1.2a-2-separate-host-projects.jpg) - Consideration 1.2b: Determining interconnect approach (VPC Peering, NCC mesh/star, Private Service Connect) (Diagrams:
pcne-1.2b-1-vpc-network-peering.jpg,pcne-1.2b-2-hard-constraints.jpg) - Consideration 1.2c: Planning IP strategy including IPv6, BYOIP, Private NAT, managed services (Diagrams:
pcne-1.2c-1-subnet-sizing-reserved.jpg,pcne-1.2c-2-solving-rfc-1918.jpg) - Consideration 1.2d: Planning global versus regional environments (Diagrams:
pcne-1.2d-1-global-vpc-regional.jpg,pcne-1.2d-2-to-use-one-global.jpg) - Consideration 1.2e: Determining MTU sizing (Diagrams:
pcne-1.2e-1-supported-vpc-mtu-values.jpg,pcne-1.2e-2-default-vpc-mtu.jpg) - Consideration 1.2f: Planning third-party device insertion and custom routing (Diagrams:
pcne-1.2f-1-multi-nic-vm-planning.jpg,pcne-1.2f-2-availability-via.jpg) - Quick Decision Cheat Sheet (Subsection 1.2)
- Subsection 1.3: Designing a resilient and performant hybrid and multi-cloud network (Section 1: Designing and Planning a Google Cloud VPC Network)
- Consideration 1.3a: Designing hybrid connectivity (Interconnect, Partner Interconnect, VPN, SD-WAN) (Diagrams:
pcne-1.3a-1-dedicated-interconnect.jpg,pcne-1.3a-2-partner-interconnect.jpg) - Consideration 1.3b: Designing multi-cloud connectivity (Cloud VPN, Cross-Cloud Interconnect) (Diagrams:
pcne-1.3b-1-ha-vpn-to-aws.jpg,pcne-1.3b-2-cross-interconnect-cci.jpg) - Consideration 1.3c: Choosing Direct Peering or Verified Peering Provider (Diagrams:
pcne-1.3c-1-peering-does-does-not.jpg,pcne-1.3c-2-golden-architectures.jpg) - Consideration 1.3d: Designing HA and DR connectivity with regional/global dynamic routing (Diagrams:
pcne-1.3d-1-regional-vs-global.jpg,pcne-1.3d-2-preventing-suboptimal.jpg) - Consideration 1.3e: Accessing multiple VPCs from on-prem (Shared VPC, peering, NCC) (Diagrams:
pcne-1.3e-1-accessing-multiple-vpcs.jpg,pcne-1.3e-2-vpc-shared-vpc.jpg) - Consideration 1.3f: Private access to Google services like Vertex AI using PSC (Diagrams:
pcne-1.3f-1-option-private-service.jpg,pcne-1.3f-2-option-private-access.jpg) - Consideration 1.3g: Accessing managed services via PSC or VPC Peering (Diagrams:
pcne-1.3g-1-psa-transitivity-trap.jpg,pcne-1.3g-2-fix-psa-custom-route.jpg) - Consideration 1.3h: Designing non-overlapping IP space across environments (Diagrams:
pcne-1.3h-1-proactive-overlap.jpg,pcne-1.3h-2-reactive-overlap.jpg) - Consideration 1.3i: Designing DNS peering and forwarding strategy (Diagrams:
pcne-1.3i-1-dns-peering-forwarding.jpg,pcne-1.3i-2-dns-vpn-compute-vm.jpg) - Consideration 1.3j: Determining correct MTU sizing for hybrid connections (Diagrams:
pcne-1.3j-1-interconnect-unencrypted.jpg,pcne-1.3j-2-ha-vpn-over-internet.jpg) - Consideration 1.3k: Understanding encryption options (MACsec, HA VPN over Interconnect) (Diagrams:
pcne-1.3k-1-option-macsec.jpg,pcne-1.3k-2-supported-on.jpg) - Quick Decision Cheat Sheet (Subsection 1.3)
- Subsection 2.1: Configuring VPCs (Section 2: Implementing a VPC Network)
- Consideration 2.1a: Creating VPC resources including networks, subnets, firewall rules, PSA subnet, private pools (Diagrams:
pcne-2.1a-1-vpc-subnet-creation-vpc.jpg,pcne-2.1a-2-private-services-access.jpg) - Consideration 2.1b: Configuring VPC Peering (Diagrams:
pcne-2.1b-1-way-handshake.jpg,pcne-2.1b-2-controlling-route.jpg) - Consideration 2.1c: Creating Shared VPC and sharing subnets (Diagrams:
pcne-2.1c-1-step-shared-vpc.jpg,pcne-2.1c-2-service-agent-activation.jpg) - Consideration 2.1d: Configuring access to Google APIs and services (PGA, public interfaces) (Diagrams:
pcne-2.1d-1-ways-vm-reaches-apis.jpg,pcne-2.1d-2-firewall-requirement-pga.jpg) - Consideration 2.1e: Configuring Vertex AI access (Diagrams:
pcne-2.1e-1-vertex-ai-private.jpg,pcne-2.1e-2-vertex-ai-workbench.jpg) - Consideration 2.1f: Expanding subnet ranges (Diagrams:
pcne-2.1f-1-expand-ip-range-gcloud.jpg,pcne-2.1f-2-vpc-vpc-subnet-compute.jpg) - Consideration 2.1g: Configuring VPC Service Controls (Diagrams:
pcne-2.1g-1-vpc-sc-protects-vpc.jpg,pcne-2.1g-2-dry-run-mode-vs.jpg) - Quick Decision Cheat Sheet (Subsection 2.1)
- Subsection 2.2: Configuring VPC routing (Section 2: Implementing a VPC Network)
- Consideration 2.2a: Configuring static and dynamic routing with Cloud Router (Diagrams:
pcne-2.2a-1-system-generated-routes.jpg,pcne-2.2a-2-subnet-routes-networking.jpg) - Consideration 2.2b: Configuring global or regional dynamic routing (Diagrams:
pcne-2.2b-1-vpc-wide-global-or.jpg,pcne-2.2b-2-exact-behavior.jpg) - Consideration 2.2c: Implementing route priorities and tags (Diagrams:
pcne-2.2c-1-network-tags-on-static.jpg,pcne-2.2c-2-vpc-routes-vpn-compute.jpg) - Consideration 2.2d: Designing priorities with global dynamic routing (Diagrams:
pcne-2.2d-1-router-calculates.jpg,pcne-2.2d-2-precedence-of-policy.jpg) - Consideration 2.2e: Using internal load balancer as next hop (Diagrams:
pcne-2.2e-1-next-hop-ilb-is.jpg,pcne-2.2e-2-configuration.jpg) - Consideration 2.2f: Configuring custom route import/export over VPC Peering (Diagrams:
pcne-2.2f-1-vpc-network-peering.jpg,pcne-2.2f-2-can-be-exchanged-vpc.jpg) - Consideration 2.2g: Configuring policy-based routing (Diagrams:
pcne-2.2g-1-makes-policy-based.jpg,pcne-2.2g-2-policy-based-routes-pbr.jpg) - Quick Decision Cheat Sheet (Subsection 2.2)
- Subsection 2.3: Configuring Network Connectivity Center (Section 2: Implementing a VPC Network)
- Consideration 2.3a: Differentiating spoke types (Diagrams:
pcne-2.3a-1-vpc-spoke-vpc-network.jpg,pcne-2.3a-2-producer-spoke-peering.jpg) - Consideration 2.3b: Managing topology (star, hub-spoke, mesh) (Diagrams:
pcne-2.3b-1-mesh-topology-preset.jpg,pcne-2.3b-2-star-topology-preset.jpg) - Consideration 2.3c: Configuring Private NAT and PSC propagation (Diagrams:
pcne-2.3c-1-private-nat-network.jpg,pcne-2.3c-2-configuration-steps.jpg) - Consideration 2.3d: Configuring CIDR filters (Diagrams:
pcne-2.3d-1-granular-subnet-route.jpg,pcne-2.3d-2-network-connectivity.jpg) - Consideration 2.3e: Monitoring and troubleshooting NCC (Diagrams:
pcne-2.3e-1-common-root-causes-of.jpg,pcne-2.3e-2-network-connectivity.jpg) - Quick Decision Cheat Sheet (Subsection 2.3)
Chapter 3: Google Kubernetes Engine (GKE) Networking: VPC-Native IPAM, Dataplane V2, Gateway API & DNS
- Subsection 1.4: Designing for Google Kubernetes Engine (GKE) (Section 1: Designing and Planning a Google Cloud VPC Network)
- Consideration 1.4a: Choosing public or private cluster nodes and node pools (Diagrams:
pcne-1.4a-1-private-nodes-enable.jpg,pcne-1.4a-2-mandatory-companion.jpg) - Consideration 1.4b: Choosing public or private control plane endpoints (Diagrams:
pcne-1.4b-1-public-endpoint-enabled.jpg,pcne-1.4b-2-private-endpoint-only.jpg) - Consideration 1.4c: Planning primary and secondary subnet ranges (Diagrams:
pcne-1.4c-1-primary-vs-secondary.jpg,pcne-1.4c-2-primary-subnet-cidr-gke.jpg) - Consideration 1.4d: Selecting RFC1918, non-RFC1918, or PUPI addresses (Diagrams:
pcne-1.4d-1-keep-node-ips-in.jpg,pcne-1.4d-2-pods-in-non-rfc.jpg) - Consideration 1.4e: Planning for IPv6 (Diagrams:
pcne-1.4e-1-dual-stack-ipv4-ipv6.jpg,pcne-1.4e-2-gke-cluster-virtual.jpg) - Consideration 1.4f: Designing load balancing for GKE (Diagrams:
pcne-1.4f-1-always-use-container.jpg,pcne-1.4f-2-right-gke-load-balancer.jpg) - Consideration 1.4g: Adding and managing node pool configuration (Diagrams:
pcne-1.4g-1-discontiguous-multi-pod.jpg,pcne-1.4g-2-right-sizing-node-pools.jpg) - Quick Decision Cheat Sheet (Subsection 1.4)
- Subsection 2.4: Configuring and maintaining GKE clusters (Section 2: Implementing a VPC Network)
- Consideration 2.4a: Creating VPC-native clusters with alias IPs (Diagrams:
pcne-2.4a-1-vpc-native-enable-ip.jpg,pcne-2.4a-2-vpc-native-default.jpg) - Consideration 2.4b: Configuring Shared VPC clusters (Diagrams:
pcne-2.4b-1-shared-vpc-clusters.jpg,pcne-2.4b-2-gke-cluster-virtual.jpg) - Consideration 2.4c: Configuring private clusters and private control planes (Diagrams:
pcne-2.4c-1-flavors-of-private.jpg,pcne-2.4c-2-gke-cluster-private.jpg) - Consideration 2.4d: Adding authorized networks (Diagrams:
pcne-2.4d-1-control-plane-authorized.jpg,pcne-2.4d-2-important-nuance-private.jpg) - Consideration 2.4e: Enabling Dataplane V2 (Diagrams:
pcne-2.4e-1-gke-dataplane-v2-enable.jpg,pcne-2.4e-2-architectural-benefits.jpg) - Consideration 2.4f: Configuring SNAT and IP masquerade (Diagrams:
pcne-2.4f-1-case-you-want-to.jpg,pcne-2.4f-2-arch-gke-networking-vpn.jpg) - Consideration 2.4g: Creating network policies (Diagrams:
pcne-2.4g-1-zero-trust-pod-micro.jpg,pcne-2.4g-2-common-common-pitfalls.jpg) - Consideration 2.4h: Configuring Pod and service ranges (Diagrams:
pcne-2.4h-1-explicit-named-secondary.jpg,pcne-2.4h-2-gke-networking-virtual.jpg) - Consideration 2.4i: Deploying additional Pod ranges (Diagrams:
pcne-2.4i-1-step-workflow-to-add.jpg,pcne-2.4i-2-gke-vpc-subnets-gke.jpg) - Consideration 2.4j: Using DNS-based endpoint for control plane access (Diagrams:
pcne-2.4j-1-dns-based-endpoint.jpg,pcne-2.4j-2-kubernetes-engine.jpg) - Consideration 2.4k: Configuring DNS (local DNS cache, Cloud DNS, and kube-dns) (Diagrams:
pcne-2.4k-1-cluster-scope-cluster.jpg,pcne-2.4k-2-vpc-scope-cluster-dns.jpg) - Quick Decision Cheat Sheet (Subsection 2.4)
Chapter 4: Managed Application Delivery: Cloud Load Balancing, Cloud CDN & Cloud DNS
- Subsection 3.1: Configuring load balancing (Section 3: Configuring Managed Network Services)
- Consideration 3.1a: Determining load balancer type (Diagrams:
pcne-3.1a-1-proxy-vs-passthrough.jpg,pcne-3.1a-2-proxy-load-balancers.jpg) - Consideration 3.1b: Configuring backend services (Diagrams:
pcne-3.1b-1-managed-instance-groups.jpg,pcne-3.1b-2-zonal-negs-gce-vm.jpg) - Consideration 3.1c: Configuring balancing methods, session affinity, URL maps, health checks (Diagrams:
pcne-3.1c-1-balancing-modes.jpg,pcne-3.1c-2-common-pitfalls-load.jpg) - Consideration 3.1d: Optimizing traffic scalability (Diagrams:
pcne-3.1d-1-global-anycast-capacity.jpg,pcne-3.1d-2-autoscaling-vs-load.jpg) - Consideration 3.1e: Understanding GKE load balancing (Diagrams:
pcne-3.1e-1-container-native-load.jpg,pcne-3.1e-2-benefits-gke-networking.jpg) - Consideration 3.1f: Traffic management including splitting and mirroring (Diagrams:
pcne-3.1f-1-envoy-data-plane.jpg,pcne-3.1f-2-weight-based-traffic.jpg) - Quick Decision Cheat Sheet (Subsection 3.1)
- Subsection 3.2: Configuring Cloud CDN (Section 3: Configuring Managed Network Services)
- Consideration 3.2a: Configuring CDN for supported origins (Diagrams:
pcne-3.2a-1-supported-origins-cdn.jpg,pcne-3.2a-2-cdn-cache-modes-cache.jpg) - Consideration 3.2b: Configuring CDN for internet NEGs and third-party storage (Diagrams:
pcne-3.2b-1-global-internet-negs-as.jpg,pcne-3.2b-2-global-internet-neg-is.jpg) - Consideration 3.2c: Invalidating cache (Diagrams:
pcne-3.2c-1-customizing-cache.jpg,pcne-3.2c-2-query-string-pollution.jpg) - Consideration 3.2d: Configuring signed URLs (Diagrams:
pcne-3.2d-1-cdn-signed-requests-work.jpg,pcne-3.2d-2-signed-urls-vs-signed.jpg) - Quick Decision Cheat Sheet (Subsection 3.2)
- Subsection 3.3: Configuring Cloud DNS (Section 3: Configuring Managed Network Services)
- Consideration 3.3a: Managing zones and records (Diagrams:
pcne-3.3a-1-dns-name-resolution.jpg,pcne-3.3a-2-nxdomain-non-fallthrough.jpg) - Consideration 3.3b: Migrating to Cloud DNS (Diagrams:
pcne-3.3b-1-step-zero-downtime.jpg,pcne-3.3b-2-dns-dns.jpg) - Consideration 3.3c: Configuring routing policies (Diagrams:
pcne-3.3c-1-weighted-round-robin-wrr.jpg,pcne-3.3c-2-geolocation-routing.jpg) - Consideration 3.3d: Enabling DNSSEC (Diagrams:
pcne-3.3d-1-dnssec-protects-against.jpg,pcne-3.3d-2-dns-security-extensions.jpg) - Consideration 3.3e: Integrating self-hosted DNS (Diagrams:
pcne-3.3e-1-on-premises-querying.jpg,pcne-3.3e-2-querying-on-premises.jpg) - Consideration 3.3f: Configuring public/private split horizon zones (Diagrams:
pcne-3.3f-1-is-split-horizon-split.jpg,pcne-3.3f-2-split-horizon-in-dns.jpg) - Consideration 3.3g: Configuring DNS peering and cross-project binding (Diagrams:
pcne-3.3g-1-option-multi-vpc-cross.jpg,pcne-3.3g-2-option-dns-peering.jpg) - Consideration 3.3h: Configuring DNS for GKE (Diagrams:
pcne-3.3h-1-kube-dns-bottlenecks-in.jpg,pcne-3.3h-2-dns-gke-cluster-dns.jpg) - Quick Decision Cheat Sheet (Subsection 3.3)
Chapter 5: Hybrid & Multicloud Interconnectivity: Cloud Interconnect, HA VPN, Cloud Router BGP & NCC
- Subsection 4.1: Configuring Cloud Interconnect (Section 4: Configuring and Implementing Hybrid and Multicloud Network Interconnectivity)
- Consideration 4.1a: Creating Dedicated Interconnect and VLAN attachments (Diagrams:
pcne-4.1a-1-physical-link.jpg,pcne-4.1a-2-dedicated-interconnect.jpg) - Consideration 4.1b: Configuring Partner Interconnect (Diagrams:
pcne-4.1b-1-to-choose-partner.jpg,pcne-4.1b-2-pairing-provisioning.jpg) - Consideration 4.1c: Configuring Cross-Cloud Interconnect (Diagrams:
pcne-4.1c-1-is-cross-interconnect.jpg,pcne-4.1c-2-provisioning.jpg) - Consideration 4.1d: Configuring HA VPN over Interconnect (Diagrams:
pcne-4.1d-1-standard-interconnect.jpg,pcne-4.1d-2-option-ha-vpn-over.jpg) - Consideration 4.1e: Implementing SLA architectures (Diagrams:
pcne-4.1e-1-edge-availability.jpg,pcne-4.1e-2-architectures-network.jpg) - Quick Decision Cheat Sheet (Subsection 4.1)
- Subsection 4.2: Configuring a site-to-site IPSec VPN (Section 4: Configuring and Implementing Hybrid and Multicloud Network Interconnectivity)
- Consideration 4.2a: Configuring HA VPN to on-prem (Diagrams:
pcne-4.2a-1-dual-interface-if0-if1.jpg,pcne-4.2a-2-external-peer-vpn.jpg) - Consideration 4.2b: Configuring HA VPN between VPCs (Diagrams:
pcne-4.2b-1-to-use-ha-vpn.jpg,pcne-4.2b-2-vpc-to-vpc-ha.jpg) - Consideration 4.2c: Configuring Classic VPN (Diagrams:
pcne-4.2c-1-vpn-is-deprecated-most.jpg,pcne-4.2c-2-vpn-routing-options.jpg) - Quick Decision Cheat Sheet (Subsection 4.2)
- Subsection 4.3: Configuring Cloud Router (Section 4: Configuring and Implementing Hybrid and Multicloud Network Interconnectivity)
- Consideration 4.3a: Configuring BGP attributes (Diagrams:
pcne-4.3a-1-private-asn-on-router.jpg,pcne-4.3a-2-dedicated-interconnect.jpg) - Consideration 4.3b: Configuring BFD (Diagrams:
pcne-4.3b-1-bgp-timers-alone-are.jpg,pcne-4.3b-2-bfd-solves-sub-second.jpg) - Consideration 4.3c: Creating custom routes (Diagrams:
pcne-4.3c-1-default-vs-custom.jpg,pcne-4.3c-2-custom-learned-routes.jpg) - Consideration 4.3d: Choosing best path selection mode (Diagrams:
pcne-4.3d-1-problem-legacy-vpc-best.jpg,pcne-4.3d-2-real-world-consequence.jpg) - Quick Decision Cheat Sheet (Subsection 4.3)
- Subsection 4.4: Configuring Network Connectivity Center (Section 4: Configuring and Implementing Hybrid and Multicloud Network Interconnectivity)
- Consideration 4.4a: Creating hybrid spokes (Diagrams:
pcne-4.4a-1-ncc-core-primitives-hub.jpg,pcne-4.4a-2-supported-spoke-types.jpg) - Consideration 4.4b: Establishing site-to-site data transfer (Diagrams:
pcne-4.4b-1-is-ncc-site-to.jpg,pcne-4.4b-2-configuration.jpg) - Consideration 4.4c: Creating Router Appliances (Diagrams:
pcne-4.4c-1-is-an-ncc-router.jpg,pcne-4.4c-2-architectural.jpg) - Consideration 4.4d: Solving transitivity issues (Diagrams:
pcne-4.4d-1-vpc-network-peering.jpg,pcne-4.4d-2-ncc-limitations-common.jpg) - Quick Decision Cheat Sheet (Subsection 4.4)
Chapter 6: Network Operations: Flow Logs, Packet Troubleshooting & Network Intelligence Center
- Subsection 5.1: Logging and monitoring with Google Cloud Observability (Section 5: Managing, Monitoring, and Troubleshooting Network Operations)
- Consideration 5.1a: Enabling and reviewing logging for networking components (Diagrams:
pcne-5.1a-1-vpc-flow-logs-compute.jpg,pcne-5.1a-2-tuning-cost-volume-vpc.jpg) - Consideration 5.1b: Monitoring networking metrics (Diagrams:
pcne-5.1b-1-interconnect-physical.jpg,pcne-5.1b-2-physical-interconnect.jpg) - Quick Decision Cheat Sheet (Subsection 5.1)
- Subsection 5.2: Maintaining and troubleshooting connectivity issues (Section 5: Managing, Monitoring, and Troubleshooting Network Operations)
- Consideration 5.2a: Managing load balancer traffic draining (Diagrams:
pcne-5.2a-1-connection-draining.jpg,pcne-5.2a-2-evacuating-entire.jpg) - Consideration 5.2b: Troubleshooting VPN (Diagrams:
pcne-5.2b-1-phase-phase-ike.jpg,pcne-5.2b-2-firewall-blocks-on-peer.jpg) - Consideration 5.2c: Troubleshooting Interconnect (Diagrams:
pcne-5.2c-1-layer-physical-optical.jpg,pcne-5.2c-2-optical-alarms.jpg) - Consideration 5.2d: Troubleshooting Cloud Router (Diagrams:
pcne-5.2d-1-link-local-ip-169.jpg,pcne-5.2d-2-dedicated-interconnect.jpg) - Consideration 5.2e: Troubleshooting with VPC Flow Logs, firewall logs, and Packet Mirroring (Diagrams:
pcne-5.2e-1-vpc-flow-logs-compute.jpg,pcne-5.2e-2-capture-location-vpc.jpg) - Quick Decision Cheat Sheet (Subsection 5.2)
- Subsection 5.3: Using Network Intelligence Center to monitor and troubleshoot common networking issues (Section 5: Managing, Monitoring, and Troubleshooting Network Operations)
- Consideration 5.3a: Using Network Topology to visualize throughput and traffic flows (Diagrams:
pcne-5.3a-1-entities-visualized.jpg,pcne-5.3a-2-metrics-overlaid-on.jpg) - Consideration 5.3b: Using Connectivity Tests to diagnose route and firewall misconfigurations (Diagrams:
pcne-5.3b-1-complementary-engines-in.jpg,pcne-5.3b-2-supported-endpoints.jpg) - Consideration 5.3c: Using Performance Dashboard to identify packet loss and latency (Google-wide and project scoped) (Diagrams:
pcne-5.3c-1-project-specific.jpg,pcne-5.3c-2-global-backbone.jpg) - Consideration 5.3d: Using Firewall Insights to monitor, identify, and improve rules (Diagrams:
pcne-5.3d-1-shadowed-firewall-static.jpg,pcne-5.3d-2-overly-permissive-unused.jpg) - Consideration 5.3e: Using Network Analyzer to identify network failures, suboptimal configurations, and utilization warnings (Diagrams:
pcne-5.3e-1-ip-address-space.jpg,pcne-5.3e-2-broken-routing-hybrid.jpg) - Consideration 5.3f: Using Flow Analyzer and VPC Flow Logs to evaluate network traffic (Diagrams:
pcne-5.3f-1-prerequisites-flow.jpg,pcne-5.3f-2-interactive-drill-down.jpg) - Quick Decision Cheat Sheet (Subsection 5.3)
Chapter 7: Cloud Network Security: Cloud Armor, Cloud NGFW, Secure Web Proxy, Cloud NAT & NVAs
- Subsection 6.1: Configuring Google Cloud Armor policies (Section 6: Configuring, Implementing, and Managing a Cloud Network Security Solution)
- Consideration 6.1a: Configuring and attaching edge and backend security policies (Diagrams:
pcne-6.1a-1-backend-security.jpg,pcne-6.1a-2-they-attach-armor-cdn.jpg) - Consideration 6.1b: Implementing web application firewall (WAF) rules (SQL injection, cross-site scripting, remote file inclusion) (Diagrams:
pcne-6.1b-1-preconfigured-waf-syntax.jpg,pcne-6.1b-2-tuning-sensitivity.jpg) - Consideration 6.1c: Configuring advanced network distributed denial of service (DDoS) and Adaptive Protection (Diagrams:
pcne-6.1c-1-always-on-l3-l4.jpg,pcne-6.1c-2-armor-adaptive.jpg) - Consideration 6.1d: Configuring rate limiting (Diagrams:
pcne-6.1d-1-throttle-action-rate.jpg,pcne-6.1d-2-rate-based-ban-action.jpg) - Consideration 6.1e: Configuring bot management (Diagrams:
pcne-6.1e-1-integrated-defense.jpg,pcne-6.1e-2-armor-recaptcha.jpg) - Consideration 6.1f: Applying Google Threat Intelligence (Diagrams:
pcne-6.1f-1-managed-named-ip-lists.jpg,pcne-6.1f-2-iplist-tor-exit-nodes.jpg) - Quick Decision Cheat Sheet (Subsection 6.1)
- Subsection 6.2: Configuring and managing NGFW policies and VPC Firewall rules (Section 6: Configuring, Implementing, and Managing a Cloud Network Security Solution)
- Consideration 6.2a: Planning the firewall strategy (VPC firewall rules, Cloud NGFW, hierarchical firewall rules, and third-party integration) (Diagrams:
pcne-6.2a-1-hierarchical-firewall.jpg,pcne-6.2a-2-purpose-vpc-firewalls.jpg) - Consideration 6.2b: Understanding the effective policy rules for hierarchical firewall situations (Diagrams:
pcne-6.2b-1-terminal-actions-allow.jpg,pcne-6.2b-2-integration-pattern-vpc.jpg) - Consideration 6.2c: Configuring Cloud NGFW to support GKE and Cloud Load Balancing (Diagrams:
pcne-6.2c-1-load-balancer-health.jpg,pcne-6.2c-2-external-alb-internal.jpg) - Consideration 6.2d: Creating and troubleshooting VPC firewall rules and Cloud NGFW regional/global/hierarchical policies (Diagrams:
pcne-6.2d-1-stateful-connection.jpg,pcne-6.2d-2-idle-connection-timeout.jpg) - Consideration 6.2e: Enabling Layer 7 packet inspection with Cloud NGFW Enterprise (Diagrams:
pcne-6.2e-1-component-of-ngfw.jpg,pcne-6.2e-2-inline-tls-decryption.jpg) - Consideration 6.2f: Migrating from VPC firewall rules to Cloud NGFW policies (Diagrams:
pcne-6.2f-1-step-by-step-zero.jpg,pcne-6.2f-2-vpc-vpc-firewall-vpc.jpg) - Consideration 6.2g: Configuring VPC and NGFW rule criteria (rule priority, network protocols, direction, source, and destination) (Diagrams:
pcne-6.2g-1-address-groups-network.jpg,pcne-6.2g-2-fqdn-fully-qualified.jpg) - Consideration 6.2h: Configuring VPC and Firewall Rules Logging (Diagrams:
pcne-6.2h-1-connection-level.jpg,pcne-6.2h-2-per-enablement-vpc.jpg) - Consideration 6.2i: Incorporating micro-segmentation for security purposes (metadata, Secure Tags, service accounts, and network tags) (Diagrams:
pcne-6.2i-1-iam-governed-resource.jpg,pcne-6.2i-2-access-control-compute.jpg) - Consideration 6.2j: Differentiating between the different tiers of Cloud NGFW: Essentials, Standard, and Enterprise (Diagrams:
pcne-6.2j-1-ngfw-essentials.jpg,pcne-6.2j-2-ngfw-standard-advanced.jpg) - Quick Decision Cheat Sheet (Subsection 6.2)
- Subsection 6.3: Configuring and securing internet egress traffic using Public Cloud NAT and Secure Web Proxy (Section 6: Configuring, Implementing, and Managing a Cloud Network Security Solution)
- Consideration 6.3a: Configuring public Cloud NAT IP addressing and assigning automatic and manual Cloud NAT IP addresses (Diagrams:
pcne-6.3a-1-software-defined-at-vm.jpg,pcne-6.3a-2-regional-scope.jpg) - Consideration 6.3b: Configuring static and dynamic port allocation for Cloud NAT (Diagrams:
pcne-6.3b-1-golden-number-64-512.jpg,pcne-6.3b-2-formula-required-nat-ips.jpg) - Consideration 6.3c: Configuring Secure Web Proxy (Diagrams:
pcne-6.3c-1-secure-web-proxy-is.jpg,pcne-6.3c-2-deployment-modes-swp.jpg) - Quick Decision Cheat Sheet (Subsection 6.3)
- Subsection 6.4: Configuring self-managed network virtual appliance and Packet Mirroring (Section 6: Configuring, Implementing, and Managing a Cloud Network Security Solution)
- Consideration 6.4a: Routing and inspecting inter-VPC traffic using multi-network interface card (NIC) virtual machines (VMs) (Diagrams:
pcne-6.4a-1-every-vnic-must-attach.jpg,pcne-6.4a-2-vcpu-to-vnic-scaling.jpg) - Consideration 6.4b: Configuring an internal load balancer as a next hop for HA multi-NIC VM routing (Diagrams:
pcne-6.4b-1-multi-nic-ilb-an.jpg,pcne-6.4b-2-symmetric-hashing-is.jpg) - Consideration 6.4c: Configuring policy-based routes for HA multi-NIC VM routing (Diagrams:
pcne-6.4c-1-standard-static-routes.jpg,pcne-6.4c-2-policy-based-routes.jpg) - Consideration 6.4d: Developing a strategy for out-of-band Network Security Integration (Diagrams:
pcne-6.4d-1-inline-inspection-ngfw.jpg,pcne-6.4d-2-pros-vpc-packet.jpg) - Consideration 6.4e: Configuring Packet Mirroring for VPC traffic toward self-managed collectors (Diagrams:
pcne-6.4e-1-strictly-regional-scope.jpg,pcne-6.4e-2-collector-destination.jpg) - Quick Decision Cheat Sheet (Subsection 6.4)
Chapter 8: Master Look-Alike Tool Comparison & Decision Playbook
- 8.1 The Master Look-Alike Tool Comparison Matrix
- 8.2 The 5-Step Architecture Decision Checklist
- 8.3 Top 25 Golden Rules for Final Review
Generating the Custom Illustrations (pcne-image-prompts.json)
All 266 custom image prompts and output filenames for this book are stored in pcne-image-prompts.json (and mirrored in openai-image-gen/out/9007-openai-prompts-pcne-book.json). To generate the illustrations using openai-image-gen/images-from-prompts.py, run:
cd openai-image-gen uv run images-from-prompts.py -file ../books/pcne-architecture-takeaways/pcne-image-prompts.json -simple -quality medium
AwesomeGCP.com Learning
The approach taken is a question-led learning approach: you explore realistic project scenarios where you need to make decisions or take actions to achieve business goals within specific constraints. Instead of passive learning, you are challenged to think and work through the options to master the Professional Cloud Network Engineer (PCNE) certification!