Question

Your company runs an HA VPN connection between an on-premises data center and a Google Cloud VPC named prod-vpc. The Cloud Router uses BGP to exchange routes. The on-premises router currently learns the subnet ranges in prod-vpc. You have now enabled Private Google Access and want the on-premises hosts to also reach Google APIs through the tunnel using the restricted.googleapis.com range (199.36.153.4/30), which is NOT a subnet in your VPC. What is the correct way to make the on-premises router learn this range via BGP?

Accepted Answer

Switch the Cloud Router (or the BGP session) to custom route advertisement mode and add 199.36.153.4/30 as a custom advertised IP range.

Answer

Keep the Cloud Router in base advertisement mode; subnet routes and the restricted VIP range are advertised automatically.

Answer

Add a custom static route for 199.36.153.4/30 in prod-vpc, which the Cloud Router will automatically redistribute into BGP in base mode.

Answer

Enable route exchange via VPC Network Peering so the restricted VIP range propagates to the on-premises router.