Book TOC · Previous · Chapter 8 of 8

Chapter 8: Master Look-Alike Tool Comparison & Decision Playbook

Chapter Focus: Side-by-side comparison of look-alike PCNE services, a 5-Step Architecture Decision Framework, cross-domain production patterns, and the Top 25 Golden Rules.

1. The PCNE Look-Alike Service Disambiguation Matrix

In complex Google Cloud Certified Professional Cloud Network Engineer architectures, multiple Google Cloud services often appear to solve similar problems. Use the matrix below to distinguish between closely related services based on latency, scale, security boundaries, and operational overhead.

2. The 5-Step Architecture Decision Framework

When evaluating a multi-service Google Cloud design, apply this structured 5-step architectural review:

1. Step 1 — Pinpoint Core Workload & Non-Functional Requirements: Identify the primary workload driver (e.g., sub-10ms OLTP vs. petabyte OLAP, synchronous REST vs. asynchronous event streaming, strict regional data residency vs. global active-active availability).
2. Step 2 — Prefer Managed, Cloud-Native Services First: Default to fully managed, serverless, or Google-curated services before introducing self-managed VMs, custom glue scripts, or unscalable manual operations.
3. Step 3 — Enforce Zero-Trust Identity & Keyless Authentication: Replace static credentials, long-lived service account JSON keys, and broad basic roles (Owner/Editor) with Workload Identity Federation, attached service accounts, and predefined IAM roles.
4. Step 4 — Verify Network Isolation & Data Perimeter Guardrails: Combine private connectivity (Private Service Connect, Private Google Access, IAP TCP forwarding) with VPC Service Controls and Organization Policy constraints.
5. Step 5 — Optimize for Cost, Observability, and Day-2 Reliability: Validate autoscaling boundaries, SLO burn-rate alerting, sink-level log filtering, and automated rollback pipelines before production rollout.

3. Review: Architecture Decision List

1. HA VPN uses BGP for dynamic routing and high availability.
2. By default, dual tunnels operate in Active/Active (ECMP) mode.
3. To configure Active/Passive mode, manipulate the Advertised Route Priority (MED).
4. A lower MED value indicates a higher preference (better route).
5. Internal Passthrough Network Load Balancers preserve the client IP address by design.
6. Proxy Load Balancers (Application or Proxy Network) mask the client IP and require headers (X-Forwarded-For or PROXY protocol) to pass that information.
7. Internal load balancers serve traffic on private IP addresses within a VPC.
8. SQL databases typically use TCP traffic, making Network Load Balancers a common choice over Application Load Balancers.
9. Routes in a VPC are global by default but can be scoped to specific instances using network tags.
10. When using virtual appliances or proxies as a next hop, ensure the route does not apply to the appliances themselves to avoid routing loops.
11. The default system route allows access to the internet gateway; custom routes override this if they have higher priority or are more specific.
12. VPC Flow Logs capture metadata (5-tuple) only, not payload.
13. Packet Mirroring captures full packet payload for inspection.
14. Use Packet Mirroring for IDS/IPS integration and malware detection.
15. Use Flow Logs for traffic analysis, billing, and connectivity troubleshooting.
16. VPC-native clusters treat Pod IPs as native VPC IP addresses.
17. Internal Pod-to-Pod traffic in VPC-native clusters is governed by VPC firewall rules.
18. Connectivity Tests provide a static configuration analysis to visualize packet paths and identify drop causes like firewall rules.
19. Cloud NAT is only for outbound internet traffic, not internal connectivity.
20. Cloud Interconnect traffic is unencrypted by default.
21. MACsec is only available for Dedicated Interconnect.
22. HA VPN over Cloud Interconnect is the standard encryption method for Partner Interconnect.
23. HA VPN provides IPsec encryption at Layer 3.
24. Private Service Connect (PSC) provides internal IP addresses for Google APIs.
25. Cloud DNS Private Zones are used to map hostnames to internal IPs within a VPC.
26. Cloud DNS Inbound Server Policies enable on-premises systems to resolve Cloud DNS zones via hybrid connectivity.
27. NCC VPC spokes automatically export subnet routes but require explicit configuration to export PSC routes.
28. Connectivity issues specific to PSC endpoints (when VMs work) usually indicate missing route propagation.
29. Hybrid spokes (VPN/Interconnect) rely on the Hub to learn routes from other spokes before they can advertise them to on-premises.
30. Network Connectivity Center (NCC) uses a Hub and Spoke topology to manage global connectivity.
31. To connect on-premises sites to NCC, use Cloud VPN or Cloud Interconnect as spokes.
32. To allow traffic between on-premises sites (spoke-to-spoke), you must explicitly enable 'site-to-site data transfer' on the Hub.
33. NCC Hubs are global resources; a single Hub can manage connectivity across multiple regions.
34. Traffic Mirroring (Shadowing) copies Layer 7 requests to a secondary backend service for inspection or testing.
35. Mirroring is configured in the URL map's route rule using the mirroredService field.
36. Mirroring is a fire-and-forget operation; the load balancer ignores the response from the mirrored service.
37. Mirroring does not affect the latency or response of the primary production traffic.
38. VPC Service Controls protect managed services (like Storage, BigQuery) using Service Perimeters.
39. VPC Firewall rules protect VMs, not managed APIs.
40. Access Levels (managed in Access Context Manager) allow specific external networks or identities to bypass perimeter blocks.
41. Access Levels must be explicitly attached to the Service Perimeter to take effect.
42. Secure Web Proxy is an explicit proxy service, not a transparent gateway.
43. Clients (VMs) require OS-level configuration (e.g., environment variables) to utilize the proxy.
44. VPC Routes define packet paths but cannot transform standard traffic into proxy requests.
45. VPC Service Controls protect managed Google services (like BigQuery and Cloud Storage) from unauthorized data exfiltration.
46. Access Context Manager is used to define Access Levels based on attributes like IP address or device status.
47. IAM roles control who can access a resource, while VPC Service Controls control where they can access it from.
48. To allow external access to a perimeter, create an Access Level and attach it to the perimeter's ingress policy.
49. Cloud NAT allows private instances to access the internet using shared public IPs.
50. Connection timeouts on private instances often indicate SNAT port exhaustion.
51. Use Cloud Monitoring to troubleshoot network issues.
52. The specific metric for NAT exhaustion is sent_packets_dropped_count with the reason OUT_OF_RESOURCES.
53. Cloud CDN allows up to 3 keys per backend service to enable key rotation.
54. Always add the new key to the infrastructure before updating the application to use it.
55. Maintain the old key until the Time-to-Live (TTL) of all issued signed URLs has expired.
56. Rotate keys regularly to limit the impact of a potential compromised key.
57. VPC Network Peering does not support overlapping IP address ranges.
58. Private NAT (Inter-VPC NAT) is the managed solution for connecting overlapping VPCs.
59. Re-addressing networks is complex and often avoided by using NAT.
60. Shared VPC consolidates networks but does not inherently solve connectivity between two existing conflicting networks without migration.
61. Use Application Load Balancers (Layer 7) when you need to route traffic based on HTTP headers, cookies, or URL paths.
62. Use Network Load Balancers (Layer 4) for non-HTTP traffic or when you need high-performance TLS offloading without content inspection.
63. Choose Internal Load Balancers to keep traffic private within the VPC network using internal IP addresses.
64. Choose External Load Balancers when you need to serve traffic to users on the public internet.
65. GKE Dataplane V2 uses eBPF for networking and security.
66. Dataplane V2 must be enabled during cluster creation; it cannot be toggled on existing clusters.
67. To move from V1 to V2, you must create a new cluster and migrate workloads.
68. Network Policy Logging is a feature specific to Dataplane V2.
69. In Layer 2 Partner Interconnect, the customer configures BGP on the Cloud Router.
70. In Layer 3 Partner Interconnect, the service provider configures the BGP session.
71. Cloud Interconnect always requires BGP; static routes are not supported for the attachment itself.
72. Cloud Functions operate outside the VPC by default.
73. To access private resources (in the VPC or via VPN/Interconnect), you must use a Serverless VPC Access connector.
74. Firewall rules and NAT gateways in the VPC do not automatically apply to serverless functions unless a connector bridges the traffic first.
75. Cloud DNS Forwarding Zones are used to send queries for specific private domains to external name servers (like on-premises Bind).
76. Forwarding works over private connections like Cloud VPN or Cloud Interconnect.
77. Peering zones are strictly for VPC-to-VPC DNS sharing, not for external targets.
78. Avoid manual record duplication (split-brain) when an authoritative source already exists.
79. Use restricted.googleapis.com (199.36.153.4/30) when VPC Service Controls compliance is required.
80. Use private.googleapis.com (199.36.153.8/30) for general private access to most Google APIs.
81. On-premises access to these VIPs requires BGP custom route advertisements on the Cloud Router.
82. DNS configuration (CNAME records) is also required to map API hostnames to these VIPs.
83. Use Dedicated Interconnect only when you can physically reach a Google PoP.
84. Use Partner Interconnect when you need private connectivity but cannot reach a Google PoP directly.
85. Cloud VPN is a cost-effective backup but lacks dedicated bandwidth guarantees.
86. Use Service Accounts for firewall filtering in dynamic or autoscaling environments to ensure security policies scale automatically.
87. Avoid using IP addresses for firewall rules when instances are ephemeral.
88. Service Accounts offer better security for micro-segmentation compared to network tags because they are governed by IAM.
89. VPC subnet routes (local routes) are automatically generated and have high priority; they generally cannot be overridden by static routes.
90. If you use public IP addresses privately (PUPI), you lose access to those specific public IPs on the internet.
91. Always check for critical service overlaps (like public DNS or third-party APIs) when planning non-RFC1918 address allocations.
92. VPC Network Peering is non-transitive; traffic cannot pass through a peered network to reach another.
93. To connect two spokes in a hub-and-spoke topology using only peering, you must peer the spokes directly.
94. Cloud NAT is strictly for internet egress, not internal routing.
95. Cloud Armor provides Layer 7 filtering capabilities, allowing you to match specific URL paths.
96. Rate limiting rules in Cloud Armor are effective against brute-force and volumetric attacks.
97. VPC Firewall rules operate at Layer 3/4 and cannot distinguish between URL paths.
98. Throttling is preferable to denying when you want to control the rate of usage rather than blocking access entirely.
99. VPC Dynamic Routing mode controls the scope of route advertisement (Regional vs. Global).
100. Set routing mode to Global to enable cross-region access via Cloud VPN or Interconnect.

Book TOC · Previous · Chapter 8 of 8