Overview

Google Cloud Virtual Private Cloud (VPC) provides networking functionality to Compute Engine virtual machine (VM) instances, Kubernetes Engine containers, and App Engine flexible environment. In other words, without a VPC network you cannot create VM instances, containers, or App Engine applications. Therefore, each Google Cloud project has a default network to get you started.

You can think of a VPC network as similar to a physical network, except that it is virtualized within Google Cloud. A VPC network is a global resource that consists of a list of regional virtual subnetworks (subnets) in data centers, all connected by a global wide area network (WAN). VPC networks are logically isolated from each other in Google Cloud.

In this lab, you create an auto mode VPC network with firewall rules and two VM instances. Then, you explore the connectivity for the VM instances.

Objectives

In this lab, you learn how to perform the following tasks:

• Explore the default VPC network
• Create an auto mode network with firewall rules
• Create VM instances using Compute Engine
• Explore the connectivity for VM instances

Setup and requirements

For each lab, you get a new Google Cloud project and set of resources for a fixed time at no cost.

1. Click the Start Lab button. If you need to pay for the lab, a pop-up opens for you to select your payment method. On the left is the Lab Details panel with the following:

   • The Open Google Cloud console button
   • Time remaining
   • The temporary credentials that you must use for this lab
   • Other information, if needed, to step through this lab

2. Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).

   The lab spins up resources, and then opens another tab that shows the Sign in page.

   Tip: Arrange the tabs in separate windows, side-by-side.

   Note: If you see the Choose an account dialog, click Use Another Account.

3. If necessary, copy the Username below and paste it into the Sign in dialog.

   {{{user_0.username | "Username"}}}

   You can also find the Username in the Lab Details panel.

4. Click Next.

5. Copy the Password below and paste it into the Welcome dialog.

   {{{user_0.password | "Password"}}}

   You can also find the Password in the Lab Details panel.

6. Click Next.

   Important: You must use the credentials the lab provides you. Do not use your Google Cloud account credentials. Note: Using your own Google Cloud account for this lab may incur extra charges.

7. Click through the subsequent pages:

   • Accept the terms and conditions.
   • Do not add recovery options or two-factor authentication (because this is a temporary account).
   • Do not sign up for free trials.

After a few moments, the Google Cloud console opens in this tab.

Note: To view a menu with a list of Google Cloud products and services, click the Navigation menu at the top-left, or type the service or product name in the Search field.

Task 1. Explore the default network

Each Google Cloud project has a default network with subnets, routes, and firewall rules.

View the subnets

The default network has a subnet in each Google Cloud region.

1. In the Cloud Console, on the Navigation menu (), click VPC network > VPC networks.

2. Click default.

3. Click Subnets.

Notice the default network with its subnets.
Each subnet is associated with a Google Cloud region and a private RFC 1918 CIDR block for its internal IP addresses range and a gateway.

View the routes

Routes tell VM instances and the VPC network how to send traffic from an instance to a destination, either inside the network or outside Google Cloud. Each VPC network comes with some default routes to route traffic among its subnets and send traffic from eligible instances to the internet.

1. In the left pane, click Routes.

2. In Effective Routes click Network, and then select default.

3. Click Region and select the Lab Region assigned to you by Qwiklabs.

4. Click View.

   Notice that there is a route for each subnet.
   These routes are managed for you, but you can create custom static routes to direct some packets to specific destinations. For example, you can create a route that sends all outbound traffic to an instance configured as a NAT gateway.

View the Firewall rules

Each VPC network implements a distributed virtual firewall that you can configure. Firewall rules allow you to control which packets are allowed to travel to which destinations. Every VPC network has two implied firewall rules that block all incoming connections and allow all outgoing connections.

• In the left pane, click Firewall.
  Notice that there are 4 Ingress firewall rules for the default network:
  • default-allow-icmp
  • default-allow-rdp
  • default-allow-ssh
  • default-allow-internal

Delete the Firewall rules

1. Select all of the default network firewall rules.
2. Click Delete.
3. Click Delete to confirm the deletion of the firewall rules.

Delete the default network

1. In the Cloud Console, on the Navigation menu (), click VPC network > VPC networks.
2. Select the default network.
3. Click Delete VPC network.
4. Click Delete to confirm the deletion of the default network.
   Wait for the network to be deleted before continuing.
5. In the left pane, click Routes.
   Notice that there are no routes.
6. In the left pane, click Firewall.
   Notice that there are no firewall rules.

Try to create a VM instance

Verify that you cannot create a VM instance without a VPC network.

1. On the Navigation menu (), click Compute Engine > VM instances.
2. Click Create instance.
3. Accept the default values and click Create. An error is shown on the Networking tab.
4. Click Go to Issues.
5. In Network Interfaces, notice the no more networks and no network available errors.
6. Click Cancel.

Task 2. Create a VPC network and VM instances

Create a VPC network so that you can create VM instances.

Create an auto mode VPC network with Firewall rules

Replicate the default network by creating an auto mode network.

1. On the Navigation menu (), click VPC network > VPC networks.
2. Click Create VPC network.
3. For Name, type mynetwork.
4. For Subnet creation mode, click Automatic. Auto mode networks create subnets in each region automatically.
5. For Firewall rules, select all available rules. These are the same standard firewall rules that the default network had. The deny-all-ingress and allow-all-egress rules are also displayed, but you cannot check or uncheck them because they are implied. These two rules have a lower Priority (higher integers indicate lower priorities) so that the allow ICMP, custom, RDP and SSH rules are considered first.
6. Click Create. When the new network is ready, notice that a subnet was created for each region.
7. Explore the IP address range for the subnets in and .

Create a VM instance in

Create a VM instance in the region. Selecting a region and zone determines the subnet and assigns the internal IP address from the subnet's IP address range.

1. On the Navigation menu (), click Compute Engine > VM instances.

2. Click Create Instance.

3. Specify the following:

   Property	Value (type value or select option as specified)
   Name	mynet-us-vm
   Region
   Zone

4. For Series, select E2.

5. For Machine type, select e2-micro (2 vCPU, 1 GB memory).

6. Click Create.

Create a VM instance in

Create a VM instance in the region.

1. Click Create Instance.

2. Specify the following, and leave the remaining settings as their defaults:

   Property	Value (type value or select option as specified)
   Name	mynet-r2-vm
   Region
   Zone

3. For Series, select E2.

4. For Machine type, select e2-micro (2 vCPU, 1 GB memory).

5. Click Create.

Click Check my progress to verify the objective. Create a VPC network and VM instance

Task 3. Explore the connectivity for VM instances

Explore the connectivity for the VM instances. Specifically, try to SSH to your VM instances using tcp:22, and ping both the internal and external IP addresses of your VM instances using ICMP. Then explore the effects of the firewall rules on connectivity by removing the firewall rules individually.

Verify connectivity for the VM instances

The firewall rules that you created with mynetwork allow ingress SSH and ICMP traffic from within mynetwork (internal IP) and outside that network (external IP).

1. On the Navigation menu (), click Compute Engine > VM instances.
   Note the external and internal IP addresses for mynet-r2-vm.

2. For mynet-us-vm, click SSH to launch a terminal and connect.

3. If an Authorize popup appears, click on Authorize

3. To test connectivity to mynet-r2-vm's internal IP, run the following command, replacing mynet-r2-vm's internal IP:

You can ping mynet-r2-vm's internal IP because of the allow-custom firewall rule.

4. To test connectivity to mynet-r2-vm's external IP, run the following command, replacing mynet-r2-vm's external IP:

Remove the allow-icmp firewall rules

Remove the allow-icmp firewall rule and try to ping the internal and external IP address of mynet-r2-vm.

1. On the Navigation menu (), click VPC network > Firewall.

2. Select the mynetwork-allow-icmp rule.

3. Click Delete.

4. Click Delete to confirm the deletion.
   Wait for the firewall rule to be deleted.

5. Return to the mynet-us-vm SSH terminal.

6. To test connectivity to mynet-r2-vm's internal IP, run the following command, replacing mynet-r2-vm's internal IP:

You can ping mynet-r2-vm's internal IP because of the allow-custom firewall rule.

7. To test connectivity to mynet-r2-vm's external IP, run the following command, replacing mynet-r2-vm's external IP:

Remove the allow-custom firewall rules

Remove the allow-custom firewall rule and try to ping the internal IP address of mynet-r2-vm.

1. On the Navigation menu (), click VPC network > Firewall.
2. Select the mynetwork-allow-custom rule.
3. Click Delete.
4. Click Delete to confirm the deletion.
   Wait for the firewall rule to be deleted.
5. Return to the mynet-us-vm SSH terminal.
6. To test connectivity to mynet-r2-vm's internal IP, run the following command, replacing mynet-r2-vm's internal IP:

7. Close the SSH terminal:

Remove the allow-ssh firewall rules

Remove the allow-ssh firewall rule and try to SSH to mynet-us-vm.

1. On the Navigation menu (), click VPC network > Firewall.
2. Select the mynetwork-allow-ssh rule.
3. Click Delete.
4. Click Delete to confirm the deletion.
5. Wait for the firewall rule to be deleted.
6. On the Navigation menu, click Compute Engine > VM instances.
7. For mynet-us-vm, click SSH to launch a terminal and connect.

Task 4. Review

In this lab, you explored the default network along with its subnets, routes, and firewall rules. You deleted the default network and determined that you cannot create any VM instances without a VPC network.

Thus, you created a new auto mode VPC network with subnets, routes, firewall rules, and two VM instances. Then you tested the connectivity for the VM instances and explored the effects of the firewall rules on connectivity.

End your lab

When you have completed your lab, click End Lab. Google Cloud Skills Boost removes the resources you’ve used and cleans the account for you.

You will be given an opportunity to rate the lab experience. Select the applicable number of stars, type a comment, and then click Submit.

The number of stars indicates the following:

• 1 star = Very dissatisfied
• 2 stars = Dissatisfied
• 3 stars = Neutral
• 4 stars = Satisfied
• 5 stars = Very satisfied

You can close the dialog box if you don't want to provide feedback.

For feedback, suggestions, or corrections, please use the Support tab.

Copyright 2022 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.