Question

Your company runs a hub VPC that hosts a Cloud VPN tunnel to an on-premises data center. A separate analytics VPC is connected to the hub via VPC Network Peering. Engineers in the analytics VPC report that they cannot reach on-premises subnets, even though the hub VPC has the correct dynamic routes learned from Cloud Router and can reach on-premises resources itself. The peering connection is established and shows as ACTIVE. What change is required so the analytics VPC can reach the on-premises subnets?

Accepted Answer

On the hub-side peering configuration, enable 'Export custom routes', and on the analytics-side peering configuration, enable 'Import custom routes'.

Answer

Create a static route in the analytics VPC with the on-premises CIDR as the destination and the peering connection as the next hop.

Answer

Reconfigure the peering as a Network Connectivity Center spoke so that transitive routing to on-premises is automatically enabled.

Answer

Enable Private Google Access on the analytics VPC subnets so traffic can traverse the peering to on-premises.