Question

A retail company runs multiple applications across several Google Cloud projects, all attached as service projects to a single Shared VPC in a host project. Security requires that all traffic destined for the on-premises data center flow through a single, centrally managed HA VPN connection, and that individual application teams cannot create their own VPN tunnels or manage routing to on-premises networks. Which approach best meets these requirements?

Accepted Answer

Create the HA VPN gateway and Cloud Router in the Shared VPC host project, and configure custom route advertisements there so all service projects inherit routes to on-premises.

Answer

Have each service project create its own HA VPN gateway to the on-premises data center and use VPC peering to share routes.

Answer

Deploy the HA VPN gateway in one service project and configure VPC Network Peering from that project to all other service projects to propagate on-premises routes.

Answer

Create a standalone VPC in each service project with its own Cloud VPN, then use a Cloud NAT gateway in the host project to consolidate egress to on-premises.