Network Service Tiers and Cloud Router are two separate but related tools that control how your data travels across Google Cloud and how your cloud network connects to on-premises networks. They matter for the PCNE exam because they directly affect the cost, performance, and reliability of your global network infrastructure, and the exam will test your ability to choose between the Standard and Premium tiers and to configure dynamic routing with BGP.
Jump to a section
A simple way to picture Network Service Tiers and Cloud Router
A two-bedroom flat on the third floor of a building in a busy city centre.
You need to move your furniture across town to a new flat that's five kilometres away. You have two service options for the moving van. The Standard tier is like the basic moving truck service. Your furniture shares the truck with other people's belongings, the van stops at multiple locations to pick up and drop off, and it might take an entire afternoon. It is the default choice, and for most trips across the city it works just fine. The Premium tier is like hiring a dedicated, smaller courier van that goes directly from your old flat to your new flat with only your furniture. It uses faster streets, makes no extra stops, and arrives in under forty-five minutes. The trade-off is that the Premium tier costs more than double the Standard tier.
Now imagine the moving company's dispatcher. That dispatcher is your Cloud Router. The dispatcher does not drive the van. Instead, the dispatcher constantly talks to the traffic coordination centre for the entire city. The traffic centre shares updates about road closures, accidents, and new shortcuts. When a street gets blocked, the dispatcher instantly reroutes the van using a different road. The dispatcher does this automatically, every thirty seconds, without you ever having to call the company and ask for a route change. Without the dispatcher, the van would follow a single, fixed map that could become useless the moment a road is closed. The dispatcher gives you dynamic, adaptable routing that responds to the live conditions of the city.
Let us start with Network Service Tiers. Google Cloud offers two tiers for how your virtual machine (VM) instances send and receive internet traffic. A virtual machine is essentially a computer that exists entirely in software inside Google's data centre. When your VM sends data to a user on the internet, that data must travel from Google's data centre to the user's device.
The standard tier (called Standard) sends your data over the public internet for most of the journey. Think of the public internet as a giant network of cables and routers owned by many different companies, like Comcast, Verizon, or BT. When your data enters the public internet, it competes with everyone else's traffic for space on those cables. This competition can cause delays, and the data may take a longer, less efficient path. Standard tier is cheaper, but your video calls might stutter more often and your webpage loads could be slower for users far from the Google data centre.
The premium tier (called Premium) keeps your data on Google's own private fibre-optic network for as much of the journey as possible. Google owns a massive global network of cables that connects its data centres. When you use Premium tier, your data leaves your VM, travels across Google's private network to the edge location that is physically closest to the end user, and only then hops onto the public internet for the very last short segment. Premium tier costs more, but it gives lower latency (less delay) and higher reliability because your data stays within Google's controlled environment for most of the trip.
Now for the second concept: Cloud Router. A Cloud Router is a managed Google Cloud service that lets you dynamically exchange routing information with your on-premises network using a protocol called BGP. BGP stands for Border Gateway Protocol. It is the standard protocol that different organisations use to tell each other about the networks they own and how to reach them. Instead of BGP, you could use static routes, which are manually typed-in rules that never change unless a human edits them. Static routes are simple but fragile. If your on-premises network adds a new subnet (a smaller section of your network), you must manually update the static route. If the connection between Google Cloud and your office goes down, static routes do not know about the problem and will keep trying to send traffic down a broken link.
Cloud Router solves this by establishing a BGP session over a VPN tunnel (a secure encrypted connection over the internet) or over a Dedicated Interconnect or Partner Interconnect (a private physical cable that connects your office directly to Google Cloud). Once the BGP session is up, Cloud Router automatically learns about all the network prefixes (ranges of IP addresses) that exist on your on-premises side. If your network administrator adds a new subnet in your office, the BGP session automatically announces that new subnet to Cloud Router, which then automatically adds a route in your Google Cloud VPC (Virtual Private Cloud — your isolated network inside Google Cloud).
The most important thing to understand is that Cloud Router is not a physical device. It is a piece of software that runs inside Google Cloud and handles BGP with your on-premises routers. It supports multiple interfaces, meaning you can connect one Cloud Router to multiple VPN tunnels or interconnect attachments for high availability. If one tunnel fails, Cloud Router automatically switches to the other tunnel because it has learned the same routes through multiple BGP sessions. This is called active-active or active-passive failover, and it happens automatically without any manual intervention.
The combination of Network Service Tiers and Cloud Router is powerful. You can use Premium tier for your VM-to-internet traffic to give fast performance to global users, and you can use Cloud Router to dynamically connect your Google Cloud VPC to your on-premises data centre, ensuring that any new network changes in either location are automatically shared. Google Cloud also supports custom route advertisements from Cloud Router, which allows you to advertise your on-premises networks to other VPCs across a hub-and-spoke topology using shared VPC or VPC Network Peering.
Create the Cloud Router
In the Google Cloud Console, navigate to Hybrid Connectivity and select Cloud Routers. Click Create Router. You must provide a name, a region (which should match the region of your VPN gateway or Interconnect), and a Google ASN (for most cases, use a private ASN like 65000). The ASN is the unique identifier for your side of the BGP peering. This step creates the logical router that will manage BGP sessions.
Create a VPN gateway and tunnel (for VPN scenarios)
If you are connecting over the internet, create a Cloud VPN gateway in the same region as your Cloud Router. Then create a VPN tunnel that connects the Cloud VPN gateway to your on-premises VPN device. During tunnel creation, you specify the peer IP address (your on-premises router's public IP), the shared secret (pre-shared key), and you attach the tunnel to the Cloud Router interface. The tunnel provides the encrypted link; the Cloud Router provides the BGP routing over that link.
Configure BGP on the Cloud Router interface
For each VPN tunnel or Interconnect attachment, you must create a BGP interface on the Cloud Router. This interface holds the BGP configuration: the IP address of the BGP peer on Google's side, the IP address of the BGP peer on your on-premises side, and the ASN of your on-premises router. You also set whether this interface should advertise routes from your VPC to the peer. This step establishes the logical point where BGP messages are exchanged.
Verify the BGP session is established
After both sides (Cloud Router and your on-premises router) are configured, they attempt to establish a TCP connection on port 179 (the BGP port). When the session state changes to 'Established', the two routers begin exchanging route information. You can check the session status in the Cloud Router's monitoring tab. If it says 'Established', the dynamic routing is live. If it says 'Idle' or 'Active', there is a configuration mismatch (IP addresses, ASN, or firewall blocking port 179).
Configure custom route advertisements (optional)
By default, Cloud Router advertises the subnets in your VPC to the on-premises network. However, you may want to advertise additional prefixes, such as a summary of your VPC's IP range, or advertise routes for a specific service that is hosted elsewhere. In the Cloud Router settings, you can add custom route advertisements under the Router Advertisements section. You can also set an Advertised Route Priority (MED) to influence which path your on-premises router prefers when multiple paths exist.
Monitor and maintain the configuration
Use Cloud Monitoring to set up alerts for BGP session drops. Create a dashboard showing the number of established sessions and the volume of routes learned. If you add new subnets to your VPC, Cloud Router automatically advertises them — you do not need to reconfigure BGP. If your on-premises network adds new subnets, the on-premises router automatically advertises them to Cloud Router. This step is about ensuring ongoing visibility and troubleshooting capability.
Imagine you are the network engineer for a growing e-commerce company called ShopNest. ShopNest runs its web servers in a Google Cloud VPC in the us-central1 region. The company also has a physical data centre in London that hosts its inventory database. There are 250 employees working in the London office, and they all access the cloud applications over a VPN connection.
Your job is to make the website fast for customers and to keep the cloud-to-data-centre connection reliable. Here is what you would actually do with Network Service Tiers and Cloud Router:
First, you evaluate the performance of your web servers. Customers in Tokyo are complaining that the site is slow. You check the network telemetry and discover that your VM instances are using the Standard tier by default. That means traffic from Japan is travelling across the public internet for most of the route, bouncing through many different ISP networks before reaching Google's infrastructure. You decide to switch the web server VM instances to Premium tier. This costs more per gigabyte of egress (data leaving Google Cloud), but it reduces the latency for Tokyo customers because their traffic now stays on Google's private cable network until it reaches Google's edge point in Tokyo, then hops off locally. The page load times drop by 40% for Asia-Pacific customers.
Second, you set up connectivity between the London data centre and the Google Cloud VPC. You create a Cloud VPN gateway in your VPC, and you configure a Cloud Router in the same region as your VPC (us-central1). You then establish two VPN tunnels from the Cloud Router to the on-premises router in London. Each tunnel uses a separate Cloud Router interface for redundancy. You configure BGP on both sides: the on-premises router peers with the Cloud Router.
Once the BGP sessions are up, the on-premises router tells Cloud Router about the IP ranges used in the London data centre: 10.0.1.0/24 for the inventory database servers, 10.0.2.0/24 for employee desktops, and 10.0.3.0/24 for the finance systems. Cloud Router automatically installs these routes into your VPC. Your web servers in Google Cloud can now reach the inventory database at 10.0.1.10 without you ever typing a static route.
Three weeks later, the London office adds a new subnet for a guest Wi-Fi network: 10.0.4.0/24. The on-premises router automatically advertises this new prefix over the existing BGP session. Cloud Router receives the advertisement and automatically adds the route to your VPC. You did nothing. No ticket, no manual route update, no downtime.
Six months later, one of the two VPN tunnels fails due to an internet outage at the London ISP. Cloud Router detects that the BGP session on that tunnel has gone down. It has another BGP session still active on the second tunnel, and it has already learned the same routes through both sessions. Without any manual intervention, traffic immediately shifts to the remaining tunnel. The on-premises database remains reachable. The employees notice nothing.
Finally, you monitor the whole setup using Cloud Logging and Cloud Monitoring. You set up alerts for BGP session state changes. If a BGP session drops, you get an email within five minutes. You also monitor the egress volume per VM to track how much Premium tier traffic you are sending, so you can forecast your monthly networking costs accurately.
The PCNE exam tests Network Service Tiers and Cloud Router heavily, and the questions are designed to trick you on specific details. Here is exactly what to expect.
For Network Service Tiers, the exam will ask you to choose between Standard and Premium tier based on a scenario. The trap is that many beginners assume Premium tier is always better. Google wants you to recognise that Standard tier is perfectly acceptable for low-cost, non-latency-sensitive workloads like batch data processing or backups. The exam will give you a business requirement like 'Company wants to reduce networking costs for nightly data syncs' and expect you to pick Standard tier.
Common question patterns for Network Service Tiers:
Which tier supports Google Cloud's global VPC? The answer is Premium tier. Standard tier only supports regional VPC resources. This is a favourite exam point.
Which tier uses Google's private backbone? Premium tier.
Which tier is the default for VMs with external IP addresses? Standard tier. If you create a VM without specifying a tier, it gets Standard.
Can you change the tier of an existing VM? Yes, you can update the network tier of a VM instance, but the change takes effect immediately and applies to all traffic leaving that VM.
For Cloud Router, the exam is obsessed with BGP. You must memorise the following:
Cloud Router supports only eBGP (external BGP), not iBGP. You will peer with your on-premises router or with another AS (Autonomous System).
Cloud Router requires you to specify a Google ASN (Autonomous System Number) when you create it. For most cases, you use the private ASN range 64512-65534.
Cloud Router can be used with Cloud VPN, Dedicated Interconnect, and Partner Interconnect. It cannot be used with Direct Peering. The exam loves to ask 'Which connectivity method supports dynamic routing with Cloud Router?' and the answer excludes Direct Peering.
Cloud Router supports route advertisements. You can configure custom route advertisements to advertise specific IP ranges from your VPC to your on-premises network.
Cloud Router supports less specific routes, which means you can advertise a summary route (like 10.0.0.0/8) instead of many smaller subnets.
The exam will present a scenario where a VPN tunnel goes down, and they ask what happens to traffic. The correct answer is that Cloud Router automatically reroutes traffic through the remaining healthy tunnel if a BGP session on the other tunnel is still up. If both tunnels are down, traffic is dropped.
Traps around naming:
Cloud Router is not the same as a router appliance. A router appliance is a VM running a third-party router OS like Cisco CSR. Cloud Router is Google-managed and only handles BGP.
Cloud Router does not perform NAT (Network Address Translation).
Cloud Router does not handle firewall rules. Those are separate in VPC firewall rules.
Key definitions to memorise:
BGP: Border Gateway Protocol, the protocol for exchanging routing information between autonomous systems.
ASN: Autonomous System Number, a unique identifier for your network in BGP.
VPN tunnel: An encrypted connection over the internet using IPsec.
Interconnect: A direct physical connection between your on-premises network and Google Cloud.
Route advertisement: The BGP message that tells the peer about a network prefix.
Mediation: Cloud Router supports BGP MED (Multi-Exit Discriminator) to influence which path should be preferred when multiple paths exist.
The exam will also test that Cloud Router supports both active-active and active-passive failover modes. In active-active, both tunnels carry traffic simultaneously. In active-passive, one tunnel is used, and the other is idle until the primary fails. You configure this by adjusting BGP metrics (like MED or local preference).
The Premium network tier uses Google's private global backbone to reduce latency and improve reliability for internet traffic from your VMs.\n\nThe Standard network tier sends traffic over the public internet and is suitable for cost-sensitive, regional workloads.\n\nCloud Router is a managed BGP service that dynamically exchanges routes between your Google Cloud VPC and your on-premises network.\n\nCloud Router supports active-active and active-passive failover by maintaining BGP sessions over multiple VPN tunnels or Interconnect attachments.\n\nYou can customise the routes Cloud Router advertises to your on-premises network, including summary routes, using custom route advertisements.\n\nCloud Router works with Cloud VPN, Dedicated Interconnect, and Partner Interconnect, but it does not work with Direct Peering.\n\nThe default network tier for a new VM with an external IP is Standard tier unless you explicitly change it to Premium.\n\nBGP MED and AS path prepending are two tools you can use on your on-premises router to influence which path Cloud Router prefers for incoming traffic.
These come up on the exam all the time. Here's how to tell them apart.
Standard Network Tier
Traffic travels over the public internet for most of the route.
Lower cost per gigabyte of egress traffic.
Default for VMs with external IPs unless changed explicitly.
Premium Network Tier
Traffic stays on Google's private backbone for most of the route.
Higher cost per gigabyte of egress traffic.
Supports global VPC resources; Standard only supports regional.
Cloud Router
Automatically learns and installs routes via BGP from on-premises.
Supports failover across multiple tunnels without manual intervention.
Requires BGP-capable on-premises router.
Static Routes
Routes are manually typed and fixed until changed by an administrator.
No automatic failover; an admin must update routes if a tunnel fails.
Works with any on-premises device regardless of BGP support.
Cloud VPN with Cloud Router
Traffic travels over the public internet inside an encrypted tunnel.
Bandwidth limited by internet connection capacity (usually 1-3 Gbps per tunnel).
Lower initial cost (no physical infrastructure setup fee).
Dedicated Interconnect with Cloud Router
Traffic travels over a private physical cable directly to Google.
Bandwidth can be 10 Gbps or higher per circuit.
Higher initial cost due to colocation facility and cross-connect fees.
BGP MED (Multi-Exit Discriminator)
A numeric value (0-65535) sent in BGP updates to influence inbound path selection.
Lower MED value is preferred by the receiving router.
Only affects path selection when multiple paths from the same AS exist.
AS Path Prepending
Artificially lengthens the AS path by repeating the same AS number.
Longer AS path is less preferred by BGP best-path algorithm.
Works across different ASNs and is widely accepted by ISP peers.
Mistake
Cloud Router is a physical router that you install in your data centre, similar to a Cisco device.
Correct
Cloud Router is a fully managed Google Cloud service that runs as software inside Google's infrastructure. You do not install or manage any hardware for it.
The name 'router' suggests a tangible device, and many beginners come from on-premises networking backgrounds where routers are physical boxes.
Mistake
The Premium network tier means Google guarantees no packet loss whatsoever.
Correct
Premium tier reduces latency and improves reliability by using Google's private backbone, but it does not eliminate packet loss entirely. Packet loss can still occur on the final hop to the end user over the public internet.
Marketing materials emphasise the benefits of Premium tier, leading beginners to assume it is a perfect solution, but real-world networking has unavoidable variables.
Mistake
Standard tier is always slower than Premium tier for every type of traffic.
Correct
Standard tier uses the public internet, but for traffic that originates and terminates within the same region, the performance difference may be negligible. Premium tier's advantage is most significant for global traffic crossing continents.
Beginners overgeneralise. They hear 'Premium is faster' and assume Standard is always bad, missing the nuance of geographical distance.
Mistake
Cloud Router automatically creates VPN tunnels for you.
Correct
Cloud Router only handles BGP routing. You must first create the VPN tunnels (using Cloud VPN) or Interconnect attachments separately, and then attach them to the Cloud Router's interfaces.
Because Cloud Router manages the routing logic, beginners incorrectly assume it also handles the underlying connectivity creation, mixing up the separate services.
Mistake
If you use Cloud Router with two VPN tunnels, traffic is always load-balanced equally across both tunnels by default.
Correct
Cloud Router does not load-balance by default. It uses BGP route selection, which by default prefers the route with the lowest MED or the shortest AS path. Equal load-sharing requires manual BGP configuration of equal-cost multipath (ECMP).
Many beginners assume 'two tunnels' automatically means 'double the bandwidth', but BGP is a path-vector protocol that typically picks one best path unless specifically configured for ECMP.
Mistake
You can use only one Cloud Router per VPC.
Correct
You can create multiple Cloud Routers in the same VPC, each with its own BGP sessions, allowing you to manage connectivity to different on-premises locations or different ISPs independently.
The name 'Cloud Router' sounds singular, and beginners imagine a single logical router per network, but Google Cloud allows multiple instances for complex topologies.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A regular router is a physical or virtual device that forwards packets and makes routing decisions. Cloud Router is a Google-managed service that only handles BGP routing — it does not forward packets itself. It learns routes from your on-premises network and installs them into your VPC's route table, but the actual packet forwarding is done by the VPC's implicit router.
No. Cloud Router is exclusively for dynamic routing via BGP. If you want to use static routes, you manually add them in the VPC network's route table without using Cloud Router at all.
Yes, technically you can, but for production environments Google recommends at least two tunnels for high availability. With a single tunnel, if the tunnel fails, all connectivity to your on-premises network is lost.
The default limit varies by project, but you can support up to hundreds of BGP sessions per Cloud Router. You can also request higher quotas from Google. Each session requires a separate VPN tunnel or Interconnect attachment.
You cannot use Cloud Router in that case. Cloud Router requires BGP-capable on-premises equipment. If your device only supports static routing, you must manually add static routes in your VPC and use static routes on-premises — you cannot use dynamic routing with Cloud Router.
Standard tier is cheaper per gigabyte. If your application is not sensitive to latency (for example, a nightly batch job that sends data to a centralised server in the same region), Standard tier saves money with negligible performance impact. Premium tier is only worth the extra cost when you need low-latency performance for global users.
Yes. You can modify the network tier of an existing VM instance at any time by editing its network interface settings. The change takes effect immediately for all new outbound traffic. Existing active connections may not be affected, but subsequent traffic uses the new tier.
You've finished Network Service Tiers and Cloud Router. Continue through the PCNE study guide to build a complete picture of the exam.
Done with this chapter?