Connecting on-prem to GCP. The choice is driven by bandwidth, latency, SLA, and cost/lead-time. Everything except Direct Peering can carry BGP routes via Cloud Router.
The cleaner mental model for the exam: Interconnect services reach the private RFC 1918 IPs inside your VPC and carry an SLA; Peering services only reach Google public IPs and have no SLA.
Every Cloud Interconnect and Peering service is classified on two axes: Dedicated vs Shared (do you connect straight into Google, or through a partner?) and Layer 2 vs Layer 3 (a private VLAN into your VPC, or public IP access to Google's services?).
Every connection service classified two ways: Dedicated (straight into Google) vs Shared (through a partner), and Layer 3 (public IPs to Google/Workspace/Cloud APIs) vs Layer 2 (a VLAN into your VPC on internal RFC 1918 IPs). Partner Interconnect spans both layers; Cloud VPN adds an encrypted internet path.#NumbersLayer 2 vs Layer 3
Layer 2 connections use a VLAN that pipes directly into your GCP environment, giving connectivity to internal IP addresses in the RFC 1918 private address space.
Layer 3 connections provide access to Google Workspace, YouTube, and Google Cloud APIs using public IP addresses - not your VPC's internal IPs.
Dedicated = a direct connection to Google's network; Shared = a connection to Google's network through a partner.
Partner Interconnect supports both Layer 2 and Layer 3.
Cloud VPN rides the public internet but encrypts traffic and reaches internal IPs - a useful add-on to Direct Peering and Carrier Peering.
Cloud VPN links on-premises to your VPC over an IPsec tunnel across the public internet. Because the VPC is global, that one regional gateway reaches VMs in every region (blue) - and those VMs talk to each other over internal IPs (green).#NumbersHA VPN SLA
HA VPN offers a 99.99% availability SLA - but only when configured with two interfaces / two tunnels to two peer devices.
Classic VPN (single tunnel) is legacy and offers 99.9%.
Each tunnel: up to ~3 Gbps; add tunnels to scale.
Traffic is IPsec-encrypted over the internet.
For the Classic vs HA split, the peer/AWS/GCP-to-GCP topologies, and Cloud Router BGP details, see Cloud VPN.
Dedicated vs Partner Interconnect: the split is who owns the physical link. Dedicated is a direct cross-connect you run into Google in a colocation facility (10 Gbps floor). Partner puts a supported service provider in the middle, so you skip the colo and start smaller (from 50 Mbps).
Dedicated Interconnect: a physical cross-connect in a colocation facility joins your Cloud Router (via the Google Peering Edge) to your on-premises router. Cloud Router and the on-prem router run BGP over it using link-local addresses.#NumbersDedicated Interconnect capacity & SLA
Per-link capacity: 10 Gbps or 100 Gbps; 10 Gbps is the minimum.
Scale with multiple links: up to 8 x 10 Gbps links, or up to 2 x 100 Gbps links.
Configurable for a 99.9% or 99.99% uptime SLA (redundancy determines which).
Requires a physical cross-connect in a Google-supported colocation facility; a BGP session on the Cloud Router exchanges routes with the on-prem router.
Partner Interconnect: instead of a direct cross-connect, a supported service provider bridges your Cloud Router and on-premises router. The cloud peering edge and service-provider peering edge meet in the colocation facility, and BGP runs end to end.#NumbersPartner Interconnect facts
Per-connection capacity: 50 Mbps to 50 Gbps (options depend on the service provider).
Also configurable for a 99.9% or 99.99% SLA - covering the segment between Google and the service provider.
Use when your data center cannot reach a colocation facility, or you need less than 10 Gbps of private connectivity.
⚠GotchaInterconnect is private, not encrypted by default
Dedicated/Partner Interconnect gives a private low-latency link but does not encrypt traffic. If you need encryption over it, layer HA VPN on top. VPN encrypts but rides the public internet.
Cross-Cloud Interconnect establishes a high-bandwidth dedicated physical connection between Google Cloud and another cloud provider. Google provisions the link, then you peer your VPC with your network hosted on the other cloud - the basis for a multi-cloud strategy with site-to-site data transfer and encryption.
You buy primary + redundant ports on both the Google side and the other cloud's side.
Unlike the other options, this connects cloud-to-cloud, not on-prem to VPC.
⚠GotchaGoogle only supports its half of Cross-Cloud Interconnect
Google supports the connection up to the point it reaches the other cloud's network. Google does not guarantee uptime from the other cloud provider and cannot open a support ticket on your behalf with them.
Cloud Router provides dynamic routing using BGP. It exchanges routes between your VPC and on-prem so new subnets propagate automatically - no manual static routes. HA VPN and both Interconnects use Cloud Router. It is regional, but can advertise routes for the whole VPC (global routing mode).
Both peering options give public-IP access to all of Google and Google Cloud services - they differ only in capacity and how you connect: Direct straight into a Google Edge PoP, Carrier through a service-provider partner.Peering reaches Google and Google Cloud public services over public IPs at a Google Edge PoP - Direct Peering connects your network straight to Google via BGP, Carrier Peering goes through a service-provider partner. Neither reaches your VPC and neither has an SLA.
Peering gives your network public-IP access to all of Google's services - Workspace, public APIs, and the full suite of Google Cloud products - at one of Google's Edge Points of Presence (PoPs), where Google's network meets the rest of the internet. It is not a private path into your VPC.
?DECISIONDirect or Carrier Peering?
Direct Peering connects your network straight to Google's edge (you must meet Google's peering requirements). Carrier Peering reaches the same public services through a partner when you can't peer directly.
#NumbersDirect Peering
Establishes a direct connection between your business network and Google's, at a Google Edge PoP.
Routes are exchanged via BGP between Google and the peering entity.
Reaches all of Google's services, including the full Google Cloud suite.
Capacity: 10 Gbps per link.
No SLA (unlike Dedicated Interconnect).
You must satisfy Google's peering requirements and have a presence in an Edge PoP.
#NumbersEdge Points of Presence (PoPs)
Where Google's network connects to the rest of the internet via peering.
Present on 90+ internet exchanges and at 100+ interconnection facilities worldwide.
Locations are published in Google's PeeringDB entries.
≡FactsCarrier Peering
For when you cannot satisfy Google's direct peering requirements (e.g. nowhere near an Edge PoP).
Connects through a supported service-provider partner to Google's public network.
Reaches all of Google's services.
Capacity and requirements vary by partner - work directly with the provider.
No SLA.
⚠GotchaPeering doesn't reach your VPC and has no SLA
Both peering options give public-IP access to Google's services only - they do not attach to your VPC and give no private RFC 1918 reachability, and neither has an SLA. For private on-prem to VPC connectivity use VPN or Interconnect (which carry BGP routes via Cloud Router; Direct/Carrier Peering do not).
If you only need to reach Google Workspace or public Google APIs from on-premises, pick a Peering service: Direct Peering if you meet Google's peering requirements, Carrier Peering (through a partner) if you do not.
Connect Google Cloud with another cloud service
To connect your VPC to another cloud provider: need high, dedicated bandwidth with Google-managed routing? Cross-Cloud Interconnect. Otherwise pick by whether you want Google-managed encryption - Cloud VPN if yes.
Connect on-premises with Google Cloud
The main on-premises decision. Don't need dedicated high bandwidth? Cloud VPN (or your own tunnels). Need it? Dedicated Interconnect if you can hit 10 Gbps and reach a colo; otherwise Partner Interconnect, then L2 vs L3 by whether you run BGP peering yourself.?DECISIONHow do I connect on-prem to my VPC?
The four ways to reach a VPC over private IP, compared. VPN tunnels ride the public internet; the three Interconnect options give dedicated bandwidth, differing by who owns the physical link and where it lands.