Question

Your company must route all east-west traffic between two application VPCs (VPC-A and VPC-B) through a self-managed firewall virtual appliance running on a Compute Engine VM for deep packet inspection. The appliance VM has two network interfaces: nic0 in VPC-A and nic1 in VPC-B. During testing, traffic reaches the appliance VM but the appliance cannot forward packets destined to the other VPC's subnets, and the packets are dropped. What must you configure to enable the appliance to forward traffic between the two VPCs?

Accepted Answer

Enable IP forwarding (canIpForward) on the appliance VM and create custom static routes in each VPC pointing to the appropriate appliance interface as the next hop.

Answer

Enable VPC Network Peering between VPC-A and VPC-B so subnet routes are automatically exchanged through the appliance.

Answer

Add both VPC networks to the same subnet and assign the appliance VM an alias IP range spanning both subnets.

Answer

Configure a Cloud NAT gateway on the appliance VM's subnet so it can translate and forward inter-VPC traffic.