Focus

VM-Series Deployment Guide

Network Connectivity Center

Table of Contents

Network Connectivity Center

Network Connectivity Center (NCC) utilizes a hub-and-spoke model for managing global connectivity across diverse networks. By integrating VM-Series with NCC, a full mesh networking model is created between VM-Series and connected spokes. VM-Series connects to the hub as a router appliance, exchanging routes with Cloud Routers via BGP. This integration enables VPC-to-VPC connectivity across projects and organizations, secure remote network connections to Google Cloud, global WAN network creation, and cross-region failover. Two key topologies include VPC-to-VPC, facilitating route exchange between separate VPCs, and Global VPC, enabling regional failover and dynamic route propagation for continuous service across multiple regions.

Network Connectivity Center (NCC) leverages a hub-and-spoke model to provide a place to manage global connectivity across various networks. The hub is a global resource that connects attached spokes with a simple and singular connectivity model. Integrating Google Cloud Network Connectivity Center with VM-Series creates a full mesh networking model between the VM-Series and all other connected spokes.

The VM-Series connects to the hub as a router appliance, enabling you to exchange routes with Cloud Routers using BGPUsing the VM-Series firewall with NCC, enables you to achieve the following:

Connect multiple VPC networks to one another across projects and organizations within GCP. See VPC-to-VPC topologies for more information.
Connect remote networks to Google Cloud while providing full BGP route exchange. See site-to-cloud connectivity for more information.
Create a global WAN network secured with VM-Series deployed in Google Cloud. See site-to-site connectivity for more information.
Facilitate cross-region failover across regionally distributed firewalls.

Topology 1: VPC-to-VPC Topology

In this topology, two VM-Series firewalls are deployed, each with a network interface (NIC) in separate VPC networks (VPC 1 and VPC 2). Each NIC is configured as a router appliance spoke connected to an NCC hub and has established BGP peering with a cloud router in each VPC. In this scenario, the VM-Series firewalls and the Cloud Routers facilitate a full route exchange between VPC 1 and VPC 2. As a result, the workloads in VPC 1 have routes to reach the workloads in VPC 2 through the propagated routes. In the event of a zone or firewall failure, BGP route convergence propagates routes to the secondary VM-Series firewall, ensuring continuity.

Topology 2: Global VPC

Three VPCs have been created — mgmt, untrust, and vpc1 — with each containing subnets in the regions us-east1 and us-west1. Additionally, one VM-Series firewall has been deployed in each region (named us-east1-vmseries and us-west1-vmseries), with a network interface card (NIC) in each VPC. Specifically, the firewall's NIC in vpc1 is configured as a router appliance connected to an NCC hub. Within each region, the firewalls are configured as BGP neighbors with Cloud Routers, facilitating end-to-end route propagation. Should there be a regional failure, egress traffic from the affected region in vpc1 is automatically rerouted to the firewall in the remaining healthy region through dynamic route propagation, ensuring continuity of service.For more information, see Google Cloud NCC & VM-Series Tutorial.

VPC network peering model

Configuring GCP Load Balancer