{"id":1360,"date":"2023-04-07T16:04:16","date_gmt":"2023-04-07T21:04:16","guid":{"rendered":"https:\/\/cloudlearning365.com\/?p=1360"},"modified":"2023-04-10T13:52:44","modified_gmt":"2023-04-10T18:52:44","slug":"gcp-interconnect","status":"publish","type":"post","link":"https:\/\/cloudlearning365.com\/?p=1360","title":{"rendered":"Learning GCP Interconnect: Step-by-Step Guide for Configuring BGP with ISR and Cloud Router."},"content":{"rendered":"\n

This blog serves as a guide to configure GCP Interconnect, Cloud Router to form an BGP session with on-premise BGP capable devices. With VPC peering and import and export routes on the peering, it’s possible to connect up to 25 spoke VPCs to the interconnect VPC.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n\n\n\n\n

GCP Console<\/h2>\n\n\n\n

In order to set up the Interconnect, you must first create a VPC that will serve as the landing point for the Interconnect Cloud Router.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Under Hybrid Connectivity, try to create Interconnect. Following example shows VLAN attachment:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Chose Partner Interconnect connection<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We already have a service provider Equinix<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"
To add VLAN attachment, it requires a new or existing Cloud Router<\/figcaption><\/figure>\n\n\n\n

Create a Cloud Router for the VLAN attachment<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Obtain the VLAN attachment pairing key<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Service provider side – Equinix shown below<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Back to GCP console<\/h2>\n\n\n\n

The attachment is now waiting for activation<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

After click on Activate<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now we need to configure BGP with customer side router<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Enter on-prem router BGP ASN and note down BGP IPs<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

It doesn’t provide the mask of the BGP IP, also makes no mention of the Cloud Router ASN<\/p>\n\n\n\n

You may obtain Cloud Router ASN number for the Interconnect:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Or click on Troubleshoot on the VLAN attachment<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

There, much more straightforward, just a catch: Local means on-prem router, remote means Cloud Router in this sentence.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Configure ISR for the VLAN interface and confirm L2 connecitivy<\/p>\n\n\n\n

ISR-2(config)#interface GigabitEthernet0\/0.832\nISR-2(config-subif)#\nISR-2(config-subif)#ip address 169.254.83.194 255.255.255.248\nISR-2(config-subif)#end\nISR-2#ping 169.254.83.193 source 169.254.83.194\nType escape sequence to abort.\nSending 5, 100-byte ICMP Echos to 169.254.83.193, timeout is 2 seconds:\nPacket sent with a source address of 169.254.83.194 \n!!!!!\nSuccess rate is 100 percent (5\/5), round-trip min\/avg\/max = 40\/40\/44 ms\n<\/code><\/pre>\n\n\n\n
Configure BGP<\/p>\n\n\n\n
ISR-2(config)#router bgp 65300\nISR-2(config-router)#neighbor 169.254.83.193 remote-as 16550\nISR-2(config-router)#end\n<\/code><\/pre>\n\n\n\n
Check BGP status<\/p>\n\n\n\n
ISR-2#show ip bgp summary\nBGP router identifier 10.1.88.88, local AS number 65300\nBGP table version is 8, main routing table version 8\n1 network entries using 140 bytes of memory\n1 path entries using 56 bytes of memory\n1\/1 BGP path\/bestpath attribute entries using 128 bytes of memory\n1 BGP extended community entries using 24 bytes of memory\n0 BGP route-map cache entries using 0 bytes of memory\n0 BGP filter-list cache entries using 0 bytes of memory\nBGP using 348 total bytes of memory\nBGP activity 105\/103 prefixes, 164\/162 paths, scan interval 60 secs\n\nNeighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up\/Down  State\/PfxRcd\n169.254.83.193  4        16550      10      14        8    0    0 00:02:53<\/mark>        0\n<\/code><\/pre>\n\n\n\n
The VLAN attachment shows up on GCP console<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Cloud Router also shows BGP session up<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
On-prem router is advertising 10.1.13.0\/24:<\/p>\n\n\n\n
router bgp 65300\n bgp log-neighbor-changes\n neighbor 169.254.83.193 remote-as 16550\n !\n address-family ipv4\n  network 10.1.13.0 mask 255.255.255.0<\/mark>\n  neighbor 169.254.83.193 activate\n exit-address-family<\/code><\/pre>\n\n\n\n
Switch back to the interconnect VPC, note it doesn’t have any subnet yet<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Exam route table of interconnect VPC, we can observe the advertised route from on-prem<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
On the ISR side, now we only see local route<\/p>\n\n\n\n
ISR-2#show ip bgp\nBGP table version is 8, local router ID is 10.1.88.88\nStatus codes: s suppressed, d damped, h history, * valid, > best, i - internal,\n              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter\nOrigin codes: i - IGP, e - EGP, ? - incomplete\n\n   Network          Next Hop            Metric LocPrf Weight Path\n*> 10.1.13.0\/24     0.0.0.0                  0         32768 i\n<\/code><\/pre>\n\n\n\n
Try to add a subnet to the interconnect VPC: (NOTE, this subnet isn’t required for the Interconnect to work, but with it we can see the CIDR of the subnet gets advertised to on-prem via Cloud Router by default.)<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now check on-prem router, and it does indeed received the added subnet prefix from Cloud Router:<\/p>\n\n\n\n
ISR-2#show ip bgp\nBGP table version is 9, local router ID is 10.1.88.88\nStatus codes: s suppressed, d damped, h history, * valid, > best, i - internal,\n              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter\nOrigin codes: i - IGP, e - EGP, ? - incomplete\n\n   Network          Next Hop            Metric LocPrf Weight Path\n*> 10.1.13.0\/24     0.0.0.0                  0         32768 i\n*> 10.16.0.0\/24     169.254.83.193         100             0 16550 ?\n<\/code><\/pre>\n\n\n\n
If you edit the cloud router, you can see the default setting is to Advertise all subnets visible to the Cloud Router<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
To test how Cloud Router propagate routes, let’s create a spoke VPC, also with no subnets.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Add a subnet to spoke1<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Peer this spoke1 VPC with interconnect VPC, and check import\/export routes<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The peering status shows as inactive, need to create peering from interconnect VPC towards spoke1 VPC<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Create peering from interconnect VPC to spoke1, also enable import\/export routes<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now the peering from both sides are active<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check spoke1 route table, it learned route 10.16.0.0\/24 to interconnect VPC. But we don’t see on-prem route 10.113.0\/24 via interconnect VPC. Notice the banner explained that imported custom dynamic routes are omitted from the list.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
To see the imported route, go to VPC peering -> Click on the peering connection<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We can see 10.1.13.0\/24 has been imported as dynamic peering route, and status is accepted. If there’s any conflict, the status will not be accepted.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
To test, deploy an instance in the spoke1 subnet and try to reach on-prem router 10.1.13.1<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
ping is failing, though the route to on-prem is there.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check on-prem router routes, it only learned the interonnect VPC prefix 10.16.0.0\/24, not the spoke1 VPC prefix 10.32.0.0\/24<\/p>\n\n\n\n
ISR-2#show ip bgp \nBGP table version is 11, local router ID is 10.1.88.88\nStatus codes: s suppressed, d damped, h history, * valid, > best, i - internal,\n              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter\nOrigin codes: i - IGP, e - EGP, ? - incomplete\n\n   Network          Next Hop            Metric LocPrf Weight Path\n*> 10.1.13.0\/24     0.0.0.0                  0         32768 i\n*> 10.16.0.0\/24     169.254.83.193         100             0 16550 ?\n<\/code><\/pre>\n\n\n\n
Remember Cloud Router is default to: Advertise all subnets visible to the Cloud Router. Currently Cloud Router only knows about the prefixes of the VPC it’s associated with. It’s not aware of prefixes coming from the VPC peering, as there’s no BGP connection. So we must use custom routes feature of the Cloud Router<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
After this is done, on-prem router receives the spoke1 route from Cloud Router<\/p>\n\n\n\n
ISR-2#show ip bgp \nBGP table version is 12, local router ID is 10.1.88.88\nStatus codes: s suppressed, d damped, h history, * valid, > best, i - internal,\n              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter\nOrigin codes: i - IGP, e - EGP, ? - incomplete\n\n   Network          Next Hop            Metric LocPrf Weight Path\n*> 10.1.13.0\/24     0.0.0.0                  0         32768 i\n*> 10.16.0.0\/24     169.254.83.193         100             0 16550 ?\n*> 10.32.0.0\/24     169.254.83.193         100             0 16550 ?\n<\/code><\/pre>\n\n\n\n
Ping started to work from spoke1 to on-prem router.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Summary<\/h2>\n\n\n\n