Question

A company runs three separate VPCs in the same Google Cloud project region: a 'production' VPC, a 'partner' VPC, and a 'shared-services' VPC that hosts internal DNS and monitoring tools. The networking team creates VPC Network Peering between production↔shared-services and between partner↔shared-services. Soon after, engineers report that resources in the production VPC cannot reach resources in the partner VPC, even though both can reach shared-services. What is the correct explanation and recommended fix?

Accepted Answer

VPC Network Peering is non-transitive; production and partner cannot communicate through shared-services, so establish direct peering (or use a Network Connectivity Center hub) between production and partner if that traffic is required.

Answer

Peering requires custom route advertisement to be enabled; turning on 'export custom routes' on the shared-services peering will allow production and partner to route through it.

Answer

The subnets overlap, so peering silently dropped the cross-VPC routes; re-IP one of the VPCs to enable transitive routing between all three.

Answer

Peering only works within the same subnet range; deploy a Cloud VPN tunnel between shared-services and both peers to enable full-mesh connectivity.