# Cloud VPN and Cloud Interconnect

> Chapter 10 of the Courseiva GOOGLE-PCNE curriculum — https://courseiva.com/learn/google-pcne/cloud-vpn-and-cloud-interconnect

**Official objective:** 6.2 — Configure Cloud VPN and Dedicated/Partner Interconnect

## Introduction

Without a secure, reliable connection between your own data centre and the cloud, your entire hybrid cloud strategy is just wishful thinking. Your data can't move, your applications can't scale, and your disaster recovery plan is nothing but a paperweight. For the PCNE exam, you need to master exactly how Google Cloud provides these connections, because the exam will test your ability to choose and configure the right one for a given scenario.

## The Two-City Factory Analogy

Picture two factory buildings: one is your main factory in London, and the other is a new factory you've just built in Manchester. They both need to share the same central database and inventory system to stay in sync. You have two ways to connect them. The first is like renting a dedicated, private motorway lane between the two factories. That lane is only used by your trucks, no other traffic. It's fast, reliable, and has a fixed capacity. This is Dedicated Interconnect – a direct, physical cable connection from your on-premises network to Google's network. The second way is like using the public motorway system but with a special secure container on each of your trucks. Your trucks still travel on the same roads as everyone else, but the container is locked and encrypted. Only your two factories have the keys. This is Cloud VPN – it uses the public internet to connect your networks, but it wraps all your data in encryption tunnels. The motorway lane costs more but gives you guaranteed performance and reliability. The secure container is cheaper and can be set up quickly, but it's subject to the ups and downs of public motorway traffic. You might choose one, or both, depending on how much data you're shipping and how fast it needs to get there.

## Core explanation

Cloud VPN and Cloud Interconnect are two distinct services that solve the same fundamental problem: how do you connect a network you control (like your office or data centre) to Google's Virtual Private Cloud (VPC) network? A VPC is your own private, isolated section of Google Cloud where you run your virtual machines and other resources. It's like your own gated community inside the vast city of Google's infrastructure.

Without either service, your on-premises network (the network in your physical building) and your VPC are completely separate. They cannot talk to each other. Cloud VPN and Cloud Interconnect build a bridge. The key difference is what the bridge is made of and how much traffic it can carry.

**Cloud VPN** stands for Virtual Private Network. It creates a secure, encrypted tunnel over the public internet. Think of it as a secure pipe that runs through the public internet. Your data is encrypted before it leaves your data centre, sent through the internet, and then decrypted when it arrives at Google Cloud. This is done using a protocol called IPsec (Internet Protocol Security). IPsec is a standard set of rules for encrypting data sent over an IP network. Cloud VPN supports two main configurations:
- **Classic VPN:** The older method, which uses a single tunnel. It is being phased out in favour of HA VPN.
- **High-Availability (HA) VPN:** The newer, recommended method. It uses two tunnels from two different gateways in Google Cloud to ensure that if one connection fails, the other takes over automatically. This provides 99.99% service level agreement (SLA) – a guarantee of uptime.

Cloud VPN is relatively quick to set up and cheap, because you are only paying for the VPN gateway and the egress traffic (data leaving Google Cloud). But its performance is limited by the capacity of your internet connection and the shared nature of the internet.

**Cloud Interconnect** provides a direct, physical connection between your on-premises network and Google's network. This connection does not travel over the public internet at all. It is a private, dedicated link. There are two types:
- **Dedicated Interconnect:** You directly connect your own router to a Google point of presence (PoP) – a facility where Google's network meets the outside world. This requires you to have equipment in a co-location facility (a data centre where many companies house their servers). You get a physical cable from your server rack directly to Google's equipment. This is the fastest, most reliable option, but it requires significant upfront work and a contract for a specific bandwidth (e.g., 10 Gbps or 100 Gbps).
- **Partner Interconnect:** If you cannot or do not want to connect directly to Google, you can go through a supported third-party service provider (a telecom company). They already have a connection to Google. You buy a VLAN (Virtual Local Area Network – a way to segment a physical network into multiple logical networks) from them, and they connect you. It is still private and does not go over the public internet, but you share the provider's connection.

Both forms of Interconnect offer higher bandwidth, lower latency (delay in data transmission), and more consistent performance than Cloud VPN. They also allow you to use your own IP addresses in Google Cloud without needing to translate them (using NAT – Network Address Translation). They are the choice for high-volume, latency-sensitive workloads like real-time data replication or streaming video processing.

Why do these services exist? They replace the old model of buying expensive, long-term leased lines directly from telecom companies. Google has built its own massive, high-speed global network. Cloud Interconnect lets you tap into that network from your own premises. Cloud VPN gives you a cheaper, faster-to-deploy alternative for less demanding needs. In practice, many enterprises use both: Cloud Interconnect for their critical, steady-state traffic, and Cloud VPN as a backup (failover) connection in case the Interconnect goes down.

## Real-world context

An IT professional responsible for connecting a company's on-premises data centre to Google Cloud goes through a deliberate, scenario-driven decision process. Consider a global e-commerce company that processes 50,000 orders per hour.

**The Scenario:** The company's main database is in an on-premises data centre in Frankfurt. They are building a new customer-facing application in Google Cloud (us-central1 region) that needs to read the product catalogue from that Frankfurt database in real-time. If the database connection is slow, customers see 'out of stock' errors or the page takes too long to load, costing millions in lost sales.

**Step-by-Step what the IT Pro does:**

1. **Assessment:** The engineer first quantifies the need. The application needs to transfer 500 MB of inventory data per second with less than 5 milliseconds of latency. This immediately rules out Cloud VPN because the public internet is too unpredictable and often introduces higher latency.

2. **Choosing the Service:** The engineer selects Dedicated Interconnect because it provides the lowest latency and highest bandwidth. They check Google Cloud's locations and find a Google PoP co-located with their existing data centre facility in Frankfurt. This makes the physical connection easier.

3. **Ordering the Connection:** The engineer works with the procurement team to order a 10 Gbps Dedicated Interconnect from Google Cloud. This involves signing a contract and configuring the cross-connect – a physical cable run from their router to Google's router within the co-location facility.

4. **Configuring BGP:** Once the physical cable is in place, the engineer configures BGP (Border Gateway Protocol) on both the on-premises router and the Google Cloud router. BGP is the 'postal system' of the internet – it's a protocol that tells routers which network paths are available. The engineer advertises the company's on-premises IP address ranges to Google, and Google advertises its VPC IP ranges back. This allows traffic to find its way correctly.

5. **Setting up Redundancy:** To meet the company's high-availability requirements, the engineer orders a second Dedicated Interconnect connection on a different physical cable and a different router. This ensures that if one cable is accidentally cut or one router fails, traffic automatically switches to the second connection with no downtime.

6. **Testing and Monitoring:** After configuration, the engineer runs connectivity tests, checking that the application can reach the database with sub-5ms latency. They also set up alerts in Cloud Monitoring to watch for increased latency or packet loss (data that never arrives) on the Interconnect.

7. **Documentation and Handover:** The engineer documents all the configuration, including the BGP peers, the VLAN attachments, and the routing policies, and hands it over to the operations team for ongoing management.

**What the IT Pro Uses:**
- Google Cloud Console for ordering and initial setup.
- `gcloud` command-line tool for scripting configuration.
- Cloud Monitoring dashboards to track utilisation and health.
- Third-party network monitoring tools (like SolarWinds or PRTG) for comprehensive visibility.

## Exam focus

The PCNE exam tests your ability to design and configure these connectivity options, not just memorise definitions. Expect scenario-based multiple-choice questions where you are given a set of business requirements and must choose the correct service, protocol, or configuration.

**What the exam loves to test:**

- **Differentiating Cloud VPN vs Cloud Interconnect:** This is the most common trap. The exam will present a scenario with specific latency, bandwidth, or reliability requirements. You must choose the appropriate service. If the scenario mentions 'consistent low latency' or 'high throughput', the answer is Cloud Interconnect (usually Dedicated). If it mentions 'cost-effective' or 'quick to set up', the answer is Cloud VPN.

- **HA VPN vs Classic VPN:** The exam expects you to know that HA VPN is the recommended and modern approach. Classic VPN is legacy. If a question asks about '99.99% SLA', the answer is HA VPN. Classic VPN has no SLA.

- **Dynamic Routing vs Static Routing:** Cloud VPN and Cloud Interconnect use different routing methods. Dynamic routing uses BGP (Border Gateway Protocol), which automatically learns routes. Static routing requires you to manually enter every IP range. The exam wants you to know that HA VPN and Cloud Interconnect support dynamic routing via BGP. Classic VPN supports both, but dynamic is preferred for resilience.

- **VLAN Attachments:** For Cloud Interconnect (Dedicated and Partner), you create VLAN attachments. These are logical connections within a single physical Interconnect that connect to specific VPC networks. The exam tests that a single Dedicated Interconnect can support multiple VLAN attachments to connect to multiple VPC networks.

- **Redundancy Requirements:** The exam frequently tests the requirement for redundant connections. If a scenario demands high availability, you must have at least two separate connections (two Cloud VPN tunnels or two Dedicated Interconnect links) on different routers or in different locations.

- **Traps to watch for:**
    - **Confusing Partner Interconnect with Cloud VPN:** Partner Interconnect is a private connection (no public internet), while Cloud VPN is over the public internet. The exam might describe Partner Interconnect as 'using a service provider' but still being a private connection. Do not confuse it with a VPN.
    - **Assuming Interconnect is always the answer:** Even though Interconnect is better in performance, it is more expensive and takes longer to set up. If the question's budget is limited or the requirement is low bandwidth, Cloud VPN is the correct answer.
    - **Forgetting about throughput limits:** Cloud VPN tunnels have a theoretical limit (around 3 Gbps per tunnel for HA VPN). Interconnect can go up to 100 Gbps per connection. The exam will test this threshold.

- **Key definitions to memorise:**
    - **SLA (Service Level Agreement):** The uptime guarantee. HA VPN: 99.99%. Cloud Interconnect: 99.99% available.
    - **Latency:** The time it takes for data to travel from source to destination.
    - **Throughput:** The amount of data that can be transferred in a given time (bits per second).
    - **BGP (Border Gateway Protocol):** The protocol used to exchange routing information between your on-premises router and Google's router.

## Step by step

1. **Assess Requirements** — Determine the bandwidth, latency, and reliability your application needs. This dictates whether you use Cloud VPN or Cloud Interconnect.
2. **Choose Connection Type** — Select between Cloud VPN (for cost-effective, quick setup) or Cloud Interconnect (for high performance). Within Interconnect, choose Dedicated or Partner based on your physical proximity to a Google PoP.
3. **Order and Provision** — For Dedicated Interconnect, order the connection in the Google Cloud Console and arrange the physical cross-connect at the co-location facility. For Cloud VPN, create a VPN gateway and tunnel in the console.
4. **Configure BGP Routing** — Set up BGP (Border Gateway Protocol) on both your on-premises router and the Google Cloud router to exchange routing information. This allows traffic to find the correct path automatically.
5. **Establish Redundancy** — Create a second connection (another VPN tunnel or another Interconnect link) on a different router or physical path. This ensures continuous operation if one link fails.
6. **Test and Monitor** — Verify connectivity by pinging resources across the connection. Set up alerts in Cloud Monitoring for latency, packet loss, and throughput to detect issues early.

## Comparisons

### Cloud VPN vs Cloud Interconnect

**Cloud VPN:**
- Traffic travels over the public internet
- Uses IPsec encryption for security
- Lower cost, quick to deploy

**Cloud Interconnect:**
- Traffic travels over a private, dedicated link
- No encryption needed because the link is private
- Higher cost, longer deployment time

### Dedicated Interconnect vs Partner Interconnect

**Dedicated Interconnect:**
- Direct physical connection to Google PoP
- You manage your own router and cross-connect
- Higher bandwidth options (10/100 Gbps)

**Partner Interconnect:**
- Connection through a third-party provider
- Provider manages the physical link
- Bandwidth limited by provider's offering

### HA VPN vs Classic VPN

**HA VPN:**
- Uses two tunnels for redundancy
- Supports dynamic routing (BGP)
- 99.99% uptime SLA available

**Classic VPN:**
- Uses a single tunnel
- Supports static and dynamic routing
- No SLA offered

## Diagram

_This diagram shows the two main paths from an on-premises data centre to a Google Cloud VPC: Cloud VPN via the public internet and Cloud Interconnect via a private physical link._

```mermaid
flowchart TD
    A[On-Premises Data Centre] --> B{Connection Type}
    B -->|Over Public Internet| C[Cloud VPN Tunnel]
    B -->|Private Physical Link| D[Cloud Interconnect]
    C --> E[Google Cloud VPC]
    D --> F[VLAN Attachment]
    F --> E
    D --> G[Dedicated Direct Link]
    D --> H[Partner Service Provider]
    H --> I[Partner's Connection to Google]
    I --> E
```

## Common misconceptions

- **Misconception:** Cloud VPN and Cloud Interconnect are essentially the same thing, just with different names. **Reality:** Cloud VPN uses the public internet with encryption. Cloud Interconnect uses a private, physical connection that bypasses the internet entirely. They differ fundamentally in performance, cost, and use case. (Both services connect on-premises networks to Google Cloud, so beginners assume they are interchangeable. The exam explicitly tests their differences.)
- **Misconception:** You always need Cloud Interconnect for any connection to be secure. **Reality:** Cloud VPN is also highly secure because it uses IPsec encryption. The security of the connection is not the differentiator; the public vs. private nature of the underlying network is. (The word 'private' in 'private connection' leads people to think public equals insecure. The encryption in VPN makes it very secure, just subject to public internet variability.)
- **Misconception:** Once you set up Cloud Interconnect, your on-premises network is automatically part of your VPC and can access any resource. **Reality:** You must still configure proper routing (using BGP) and firewall rules (VPC firewall rules) to allow traffic. The Interconnect is just a physical link; you still need to tell the network what traffic can flow over it. (It feels like plugging in a cable should just work. But networking requires explicit policies for security and traffic management.)
- **Misconception:** Partner Interconnect is a type of Cloud VPN because it goes through a third-party provider. **Reality:** Partner Interconnect is a type of Cloud Interconnect. It provides a private, direct connection, not an internet-based VPN. The partner provides the physical link to Google, but your traffic never touches the public internet. (Beginners see 'partner' and 'third-party' and incorrectly associate it with the public internet model of VPNs. The key distinction is the private vs. public path.)

## Key takeaways

- Cloud VPN is an encrypted connection over the public internet, best for low-bandwidth or backup scenarios.
- Cloud Interconnect provides a private, dedicated physical connection that bypasses the internet for high-performance needs.
- HA VPN (High-Availability VPN) uses two tunnels for redundancy and offers a 99.99% uptime SLA; Classic VPN does not.
- Cloud Interconnect does not automatically connect you to your VPC; you must configure BGP routing and firewall rules.
- Dedicated Interconnect requires direct physical attachment to a Google point of presence, while Partner Interconnect uses a service provider.
- For high-availability designs, always use at least two separate Interconnect connections or two VPN tunnels on different gateways.

## FAQ

**Is Cloud VPN or Cloud Interconnect cheaper?**

Cloud VPN is cheaper because it uses the public internet and you only pay for the gateway and egress traffic. Cloud Interconnect costs more because it involves a dedicated physical connection and often longer-term contracts.

**Can I use Cloud VPN as a backup for Cloud Interconnect?**

Yes, this is a common design pattern. You use Cloud Interconnect for your primary, high-bandwidth traffic and configure Cloud VPN as a failover connection if the Interconnect goes down. BGP routing can automatically switch traffic.

**What is a VLAN attachment in Cloud Interconnect?**

A VLAN attachment is a logical connection on a physical Interconnect that links to a specific VPC network. One physical Interconnect can have multiple VLAN attachments to connect to multiple VPCs.

**Do I need to manage the physical cable for Partner Interconnect?**

No. With Partner Interconnect, you buy a connection from a supported service provider who manages the physical link to Google. You only configure the logical VLAN attachment in Google Cloud.

**What is the main difference between Dedicated and Partner Interconnect?**

With Dedicated Interconnect, you directly connect your own router to Google's equipment. With Partner Interconnect, you connect through a third-party service provider who already has a connection to Google.

**Is Cloud VPN secure for sensitive data?**

Yes, Cloud VPN uses IPsec encryption, which is a strong, industry-standard encryption protocol. Your data is secure in transit, but the path over the public internet can introduce latency and variability.

## Check your understanding

1. **A company needs a connection to Google Cloud with consistent low latency for real-time data replication. Which service should they choose?**

   Answer: Cloud Interconnect, because it provides a private, dedicated connection that bypasses the public internet and offers predictable performance.

2. **What is the main difference between HA VPN and Classic VPN?**

   Answer: HA VPN uses two tunnels and supports dynamic routing with a 99.99% SLA, while Classic VPN uses a single tunnel and has no SLA.

3. **What protocol is used to exchange routing information between an on-premises router and Google Cloud when using Cloud Interconnect?**

   Answer: BGP (Border Gateway Protocol) is used to dynamically exchange IP route information.

4. **Can you connect multiple VPC networks to a single Dedicated Interconnect link?**

   Answer: Yes, by creating multiple VLAN attachments, each pointing to a different VPC network, on the same physical Interconnect.

5. **Why would an organisation choose Cloud VPN over Cloud Interconnect for a production workload?**

   Answer: If the workload requires low bandwidth and the organisation prioritises lower cost and faster setup over the highest possible performance and consistency.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/google-pcne/cloud-vpn-and-cloud-interconnect