arrow_back

VPC Networking Fundamentals

加入 登录

VPC Networking Fundamentals

1 个小时 1 个积分

GSP210

Google Cloud self-paced labs logo

Overview

Google Cloud Virtual Private Cloud (VPC) provides networking functionality to Compute Engine virtual machine (VM) instances, Kubernetes Engine containers and App Engine Flex. In other words, without a VPC network you cannot create VM instances, containers or App Engine applications. Therefore, each Google Cloud project has a default network to get you started.

You can think of a VPC network the same way you would think of a physical network, except that it is virtualized within Google Cloud. A VPC network is a global resource which consists of a list of regional virtual subnetworks (subnets) in data centers, all connected by a global wide area network (WAN). VPC networks are logically isolated from each other in Google Cloud.

In this lab, you create an auto mode VPC network with firewall rules and two VM instances. Then, you explore the connectivity for the VM instances.

Objectives

In this lab, you learn how to perform the following tasks:

  • Explore the default VPC network

  • Create an auto mode network with firewall rules

  • Create VM instances using Compute Engine

  • Explore the connectivity for VM instances

Setup and Requirements

Before you click the Start Lab button

Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources will be made available to you.

This hands-on lab lets you do the lab activities yourself in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials that you use to sign in and access Google Cloud for the duration of the lab.

To complete this lab, you need:

  • Access to a standard internet browser (Chrome browser recommended).
Note: Use an Incognito or private browser window to run this lab. This prevents any conflicts between your personal account and the Student account, which may cause extra charges incurred to your personal account.
  • Time to complete the lab---remember, once you start, you cannot pause a lab.
Note: If you already have your own personal Google Cloud account or project, do not use it for this lab to avoid extra charges to your account.

How to start your lab and sign in to the Google Cloud Console

  1. Click the Start Lab button. If you need to pay for the lab, a pop-up opens for you to select your payment method. On the left is the Lab Details panel with the following:

    • The Open Google Console button
    • Time remaining
    • The temporary credentials that you must use for this lab
    • Other information, if needed, to step through this lab
  2. Click Open Google Console. The lab spins up resources, and then opens another tab that shows the Sign in page.

    Tip: Arrange the tabs in separate windows, side-by-side.

    Note: If you see the Choose an account dialog, click Use Another Account.
  3. If necessary, copy the Username from the Lab Details panel and paste it into the Sign in dialog. Click Next.

  4. Copy the Password from the Lab Details panel and paste it into the Welcome dialog. Click Next.

    Important: You must use the credentials from the left panel. Do not use your Google Cloud Skills Boost credentials. Note: Using your own Google Cloud account for this lab may incur extra charges.
  5. Click through the subsequent pages:

    • Accept the terms and conditions.
    • Do not add recovery options or two-factor authentication (because this is a temporary account).
    • Do not sign up for free trials.

After a few moments, the Cloud Console opens in this tab.

Note: You can view the menu with a list of Google Cloud Products and Services by clicking the Navigation menu at the top-left. Navigation menu icon

Explore the default network

Each Google Cloud project has a default network with subnets, routes, and firewall rules.

View the subnets

The default network has a subnet in each Google Cloud region.

In the Console, navigate to Navigation menu (mainmenu.png) > VPC network > VPC networks.

VPC_networks.png

Notice the default network with its subnets.

View the routes

Routes tell VM instances and the VPC network how to send traffic from an instance to a destination, either inside the network or outside of Google Cloud. Each VPC network comes with some default routes to route traffic among its subnets and send traffic from eligible instances to the Internet.

In the left pane, click on Routes.

RoutesMenu.png

Notice that there is a route for each subnet and one for the Default internet gateway (0.0.0.0./0).

View the firewall rules

Each VPC network implements a distributed virtual firewall that you can configure. Firewall rules allow you to control which packets are allowed to travel to which destinations. Every VPC network has two implied firewall rules that block all incoming connections and allow all outgoing connections.

In the left pane, click on Firewall.

Notice that there are 4 Ingress firewall rules for the default network:

  • default-allow-icmp
  • default-allow-internal
  • default-allow-rdp
  • default-allow-ssh

Delete the default network

  1. In the left pane, click on Firewall.

  2. Select all firewall rules and click DELETE. Then click DELETE to confirm the deletion.

  3. In the left pane, click on VPC networks.

  4. Click on the default network.

  5. Click Delete VPC network at the top of the page, then click DELETE to confirm the deletion of the default network.

    Wait for the network to be deleted before moving on.

  6. In the left pane, click on Routes.

    Notice that there are no routes. You may need to click the Refresh button at the top of the page.

Try to create a VM instance

Verify that you cannot create a VM instance without a VPC network.

  1. In the Console, navigate to Navigation menu (mainmenu.png) > Compute Engine > VM instances, and then click +CREATE INSTANCE to create a VM instance.

  2. Leave all the values at their default and click Create.

    Notice the error.

  3. Under the Firewall section, click Advanced Options, and then click Networking.

    networking.png

  4. Notice the error under Network interfaces.

  5. Click Cancel.

Create a VPC network and VM instances

Create a VPC network so that you can create VM instances.

Create an auto mode VPC network with Firewall rules

Replicate the default network by creating an auto mode network.

  1. In the Console, navigate to Navigation menu (mainmenu.png) > VPC network > VPC networks, and then click +CREATE VPC NETWORK.

  2. Set the Name to mynetwork.

  3. For Subnet creation mode, click Automatic.

    Auto mode networks create subnets in each region automatically.

  4. For Firewall rules, check all available rules.

    These are the same standard firewall rules that the default network had.

  1. Click CREATE, then wait for mynetwork to be created.

    Notice that a subnet was created for each region.

  2. Click on the mynetwork name and record the IP address range for the subnets in and europe-west1. You will refer to these in the next steps.

Test Completed Task

Click Check my progress to verify your performed task. If you have completed the task successfully, you will be granted with an assessment score.

Create a VPC network.

Create a VM instance

Create a VM instance in the us-central1 region. Selecting a region and zone determines the subnet and assigns the internal IP address from the subnet's IP address range.

  1. In the Console, navigate to Navigation menu (mainmenu.png) > Compute Engine > VM instances, and then click +CREATE INSTANCE.

  2. Set the following values, leaving all others at their defaults:

    Property Value (type value or select option as specified)
    Name mynet-us-vm
    Region
    Zone
    Series E2
    Machine type e2-micro
  3. Click Create, then wait for the instance to be created.

  4. Verify that the Internal IP was assigned from the IP address range for the subnet in .

Test Completed Task

Click Check my progress to verify your performed task. If you have completed the task successfully, you will be granted with an assessment score.

Create a VM instance in .

Create a VM instance in europe-west1

Create a VM instance in the europe-west1 region.

  1. Click +CREATE INSTANCE.

  2. Set the following values, leaving all others at their defaults:

    Property Value (type value or select option as specified)
    Name mynet-eu-vm
    Region europe-west1
    Zone europe-west1-b
    Series E2
    Machine type e2-micro
  3. Click Create, then wait for the instance to be created.

If you receive an error stating that this zone does not have enough resources to fulfill the request, try re-running steps 1-3 with a different zone.
  1. Verify that the Internal IP was assigned from the IP address range for the subnet in europe-west1 (10.132.0.0/20).

    The Internal IP should be 10.132.0.2 as 10.132.0.1 is reserved for the gateway and you have not configured any other instances in that subnet.

Test Completed Task

Click Check my progress to verify your performed task. If you have completed the task successfully, you will be granted with an assessment score.

Create a VM instance in europe-west1.

Explore the connectivity for VM instances

Explore the connectivity for the VM instances. Specifically, SSH to your VM instances using tcp:22 and ping both the internal and external IP addresses of your VM instances using ICMP. Then, explore the effects of the firewall rules on connectivity by removing the firewall rules one-by-one.

Verify connectivity for the VM instances

The firewall rules that you created with mynetwork allow ingress SSH and ICMP traffic from within mynetwork (internal IP) and outside of that network (external IP).

  1. In the Console, navigate to Navigation menu (mainmenu.png) > Compute Engine > VM instances.

    Note the external and internal IP addresses for mynet-eu-vm.

  2. For mynet-us-vm, click SSH to launch a terminal and connect. You may have to click SSH twice.

    You are able to SSH because of the allow-ssh firewall rule, which allows incoming traffic from anywhere (0.0.0.0/0) for tcp:22.

    The SSH connection works seamlessly because Compute Engine generates an SSH key for you and stores it in one of the following locations:

    * By default, Compute Engine adds the generated key to project or instance metadata.

    * If your account is configured to use OS Login, Compute Engine stores the generated key with your user account.

    Alternatively, you can control access to Linux instances by creating SSH keys and editing public SSH key metadata.
  3. To test connectivity to mynet-eu-vm's internal IP, run the following command using mynet-eu-vm's internal IP:

    ping -c 3 <Enter mynet-eu-vm's internal IP here>

    You are able to ping mynet-eu-vm's internal IP because of the allow-custom firewall rule.

  4. To test connectivity to mynet-eu-vm's external IP, run the following command using mynet-eu-vm's external IP:

    ping -c 3 <Enter mynet-eu-vm's external IP here>

Test your Understanding

Below are a multiple choice questions to reinforce your understanding of this lab's concepts. Answer them to the best of your abilities.

Remove the allow-icmp firewall rules

Remove the allow-icmp firewall rule and try to ping the internal and external IP address of mynet-eu-vm.

  1. In the Console, navigate to Navigation menu (mainmenu.png) > VPC network > Firewall.

  2. Check the mynetwork-allow-icmp rule.

  3. Click DELETE, then click DELETE to confirm the deletion.

    Wait for the firewall rule to be deleted.

  4. Return to the mynet-us-vm SSH terminal.

  5. To test connectivity to mynet-eu-vm's internal IP, run the following command using mynet-eu-vm's internal IP:

ping -c 3 <Enter mynet-eu-vm's internal IP here>

You are able to ping mynet-eu-vm's internal IP because of the allow-custom firewall rule.

  1. To test connectivity to mynet-eu-vm's external IP, run the following command using mynet-eu-vm's external IP:

    ping -c 3 <Enter mynet-eu-vm's external IP here>

Remove the allow-custom firewall rules

Remove the allow-custom firewall rule and try to ping the internal IP address of mynet-eu-vm.

  1. In the Console, navigate to Navigation menu (mainmenu.png) > VPC network > Firewall.

  2. Check the mynetwork-allow-custom rule and then click DELETE. Click DELETE to confirm the deletion.

    Wait for the firewall rule to be deleted.

  3. Return to the mynet-us-vm SSH terminal.

  4. To test connectivity to mynet-eu-vm's internal IP, run the following command using mynet-eu-vm's internal IP:

    ping -c 3 <Enter mynet-eu-vm's internal IP here>
  1. Close the SSH terminal:

    exit

Remove the allow-ssh firewall rules

Remove the allow-ssh firewall rule and try to SSH to mynet-us-vm.

  1. In the Console, navigate to Navigation menu (mainmenu.png) > VPC network > Firewall.

  2. Check the mynetwork-allow-ssh rule and then click DELETE. Click DELETE to confirm the deletion.

    Wait for the firewall rule to be deleted.

  3. In the Console, navigate to Navigation menu (mainmenu.png) > Compute Engine > VM instances.

  4. For mynet-us-vm, click SSH to launch a terminal and connect.

Congratulations!

In this lab, you explored the default network along with its subnets, routes, and firewall rules. You deleted the default network and determined that you cannot create any VM instances without a VPC network. Thus, you created a new auto mode VPC network with subnets, routes, firewall rules and two VM instances. Then, you tested the connectivity for the VM instances and explored the effects of the firewall rules on connectivity.

Networking_125.png

Finish Your Quest

This self-paced lab is part of the Qwiklabs Quest, Networking in the Google Cloud. A Quest is a series of related labs that form a learning path. Completing this Quest earns you the badge above to recognize your achievement. You can make your badge (or badges) public and link to them in your online resume or social media account. Enroll in this Quest and get immediate completion credit if you've taken this lab. See other available Qwiklabs Quests.

Take Your Next Lab

Continue your Quest with Multiple VPC Networks, or check out these suggestions:

Next Steps / Learn More

Learn more about Google VPCs:

Manual last updated October 03, 2022
Lab last tested October 03, 2022

Copyright 2022 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.