Cloud Router Study Notes

Cloud Router is a fully managed BGP speaker that dynamically exchanges routes between your VPC network and on-premises or peer networks connected by Cloud VPN or Cloud Interconnect. It removes the need to maintain static routes for hybrid environments, automatically learning and advertising prefixes as networks change on either side.

Key facts

• A Cloud Router is a regional resource associated with one VPC network, and a single router can manage BGP sessions for multiple VPN tunnels or Interconnect attachments in its region.
• Cloud Router uses BGP with autonomous system numbers; Google Cloud side uses a private ASN you choose, commonly 65001, and the peer side uses your on-premises ASN.
• In dynamic routing mode, VPC subnet routes are advertised automatically, and routes learned from peers are installed in the VPC route table with priorities derived from BGP metrics.
• The VPC dynamic routing mode can be regional, advertising only same-region subnets, or global, advertising all subnets and learning routes in every region of the VPC.
• Custom advertised routes let a Cloud Router announce additional ranges beyond its subnets, such as routes to another connected network or a NAT or proxy range.
• Cloud Router supports BGP graceful restart and BFD in supported configurations, reducing disruption during peer maintenance or failover between redundant tunnels.
• Route priorities for learned routes are influenced by MED and base priorities you configure per BGP peer, letting you prefer one tunnel or attachment over another.
• Cloud Router itself does not forward user traffic or encrypt anything; it only exchanges control-plane routing information while the VPN or Interconnect data plane carries packets.
• For HA VPN, each interface and tunnel has its own BGP session on the Cloud Router, and redundant sessions are what deliver the high-availability routing behaviour.

What the exam expects you to know

• Know Cloud Router is required for dynamic routing with HA VPN, Cloud Interconnect, and Network Connectivity Center style hybrid designs tested on the ACE exam.
• Choose global dynamic routing mode when on-premises must reach subnets in all regions through one connection; choose regional mode to limit advertisement scope.
• Identify ASN conflicts or mismatched BGP peer addresses as causes when a VPN tunnel is up at IPsec level but no routes are exchanged.
• Recognise custom advertised routes as the fix when a peer must reach a range that is not a VPC subnet, such as a peered or proxied destination.
• Understand a Cloud Router can serve multiple attachments and tunnels, so one router per region per VPC is the normal design pattern.
• Distinguish static routes for simple VPC-only designs from Cloud Router dynamic routes for hybrid networks that change or require failover.

Cloud Router vs Static Routes: when to use which

Use Cloud Router with BGP when routes must change automatically, when redundant VPN tunnels or Interconnect attachments need failover, or when on-premises prefixes are numerous and evolving. Use static routes for simple, stable destinations inside Google Cloud, such as a fixed next-hop appliance or a single unchanging on-premises range behind a Classic VPN. Exam hybrid scenarios mentioning failover, learned routes, many prefixes, or HA VPN almost always require Cloud Router, because manually maintaining static routes cannot react when a tunnel fails or a new subnet is created. See also the Static Routes notes.

Useful gcloud commands

gcloud compute routers create my-router --network=my-vpc --region=us-central1 --asn=65001
gcloud compute routers list
gcloud compute routers get-status my-router --region=us-central1
gcloud compute routers describe my-router --region=us-central1

Common exam traps

• Trap: Thinking Cloud Router forwards or encrypts traffic itself. It is control plane only; tunnels and attachments carry the data and provide any encryption.
• Trap: Leaving the VPC in regional dynamic routing mode while expecting on-premises to reach subnets in other regions through a single-region connection.
• Trap: Reusing the same ASN on both sides of an external BGP session incorrectly. Google Cloud and peer ASNs must be planned so sessions establish and loop prevention works.
• Trap: Creating a separate Cloud Router for every tunnel by habit. One router per region normally manages all sessions, and extra routers complicate route policy.

Frequently asked questions

What does Cloud Router actually do?

Cloud Router runs BGP sessions with your on-premises or peer routers over Cloud VPN tunnels or Cloud Interconnect attachments. It advertises your VPC subnet routes to the peer and learns on-premises routes into your VPC route table automatically. It is a control-plane service only and does not forward, inspect, or encrypt the user traffic itself.

What is the difference between regional and global dynamic routing?

In regional mode, a Cloud Router advertises only subnets in its own region and applies learned routes only in that region. In global mode, routers advertise all subnets in the VPC and learned routes are propagated to all regions. Global mode suits a single hybrid connection serving an entire VPC, while regional mode limits scope and blast radius deliberately.

Do I need Cloud Router for Cloud NAT?

Yes, a Cloud NAT gateway is configured on a Cloud Router resource even though NAT does not use BGP. The router acts as the regional container for the NAT configuration in that VPC and region. This surprises many candidates, but creating the Cloud Router does not force you to configure BGP sessions unless you also use VPN or Interconnect.

Study aid disclaimer: Cloud Cert Notes is an independent educational study aid. It is not affiliated with, endorsed by, or sponsored by Google, Microsoft, Amazon, Oracle, or Alibaba. Google Cloud, Associate Cloud Engineer, and Cloud Digital Leader are trademarks of Google LLC; all other certification names and product names are trademarks of their respective owners. Always confirm service details against the official provider documentation before sitting an exam.