Lesson 1: The Google Cloud Networking Map on One Page

Why start with a map?

Google Cloud ships over two dozen networking products, and several have been renamed in the last few years. You'll still meet the old names in blog posts, Terraform modules and old runbooks. Before you can pick the right service you need a mental map: what job does each one do, and what is it called today?

Think of it like a city map. Roads are the virtual networks. Bridges join one district to another. Tunnels run to the outside world, which here means your hybrid links. Then there are traffic lights and junctions (load balancers), the phone book (DNS), private side doors to services, police and gates (security) and traffic cameras (monitoring). That gives us eight groups.

The map: eight job groups

Gotcha: Cloud Router appears in group 3, but Cloud NAT also depends on it. One product can do work for several groups. File it under its main job and note the others.

Old names you will still see

Renames trip people up mostly in search results and old Terraform. Keep this translation table handy:

OLD NAME (docs, blogs, old code)         -> CURRENT NAME
HTTP(S) Load Balancing                   -> Application Load Balancer
TCP Proxy / SSL Proxy Load Balancing     -> proxy Network Load Balancer
Network Load Balancing / Internal TCP/UDP -> passthrough Network Load Balancer
Cloud Firewall (VPC firewall rules)      -> Cloud NGFW (Essentials / Standard / Enterprise tiers)
Cloud Firewall Plus                      -> Cloud NGFW Enterprise (renamed April 2024)
Traffic Director                         -> Cloud Service Mesh

The load balancer docs also list classic variants, such as the classic Application Load Balancer. These are the older deployment mode. In Terraform and gcloud they show up as load_balancing_scheme = "EXTERNAL". The newer global and regional modes use EXTERNAL_MANAGED, and Google recommends migrating to them. Look out for this in inherited code.

The three Cloud NGFW tiers in one line each:

• Essentials: no extra charge. Rules match on IPs, ports and protocols.
• Standard: adds FQDN objects and threat-intelligence lists.
• Enterprise: adds Layer 7 intrusion detection and prevention, URL filtering and TLS inspection.

Lifecycle status: what's limited or deprecated

A service being on the map doesn't mean you should build on it. Three examples:

1. Classic VPN dynamic routing (BGP): deprecated. From 31 March 2022 you could no longer create Classic VPN BGP tunnels to peers outside Google Cloud. From 1 August 2025 you can't create any Classic VPN BGP tunnels at all. Existing ones keep passing traffic but have no availability SLA, and a deleted one can't be recreated. Static-routed Classic VPN is still supported. If you need BGP, use HA VPN.
2. Serverless VPC Access: still supported, but for Cloud Run Google now recommends Direct VPC egress, which needs no connector.
3. Global external passthrough Network Load Balancer: listed as Preview in the docs, so it isn't yet covered by GA terms.

Walkthrough: audit a project against the map

Here is how to spot lifecycle risks in an inherited project with gcloud:

# 1. Which networking APIs are switched on? Each one is a service from the map.
gcloud services list --enabled \
  --filter="config.name~(compute|dns|networkconnectivity|networksecurity|networkmanagement|servicenetworking)"

# 2. Find Classic VPN tunnels. Classic tunnels point at a targetVpnGateway;
#    HA VPN tunnels point at a vpnGateway. A router value means BGP.
gcloud compute vpn-tunnels list \
  --format="table(name,region.basename(),targetVpnGateway.basename(),vpnGateway.basename(),router.basename())"

Example output:

NAME          REGION        TARGET_VPN_GATEWAY  VPN_GATEWAY  ROUTER
legacy-dc1    europe-west2  classic-gw          -            dc1-router   # Classic + BGP: no SLA, plan an HA VPN move
ha-dc2-if0    europe-west2  -                   ha-gw        dc2-router   # HA VPN + BGP: fine

# 3. Find classic-mode load balancers (older scheme)
gcloud compute backend-services list \
  --filter="loadBalancingScheme=EXTERNAL" --format="table(name,loadBalancingScheme)"

Best practice: record what you find in a short register with four columns: service, map group, current name and lifecycle status. Later levels build on this register.

The monitoring group, unpacked

Network Intelligence Center is a single console made up of modules:

• Network Topology: a visual map of your VPCs.
• Connectivity Tests: checks whether A can reach B.
• Performance Dashboard: latency and packet loss.
• Firewall Insights: spots unused or shadowed rules.
• Network Analyzer: detects misconfigurations automatically.
• Flow Analyzer: analyses VPC Flow Logs without hand-written SQL.
• Cloud Network Insights: monitors hybrid and multicloud network health.

Key takeaways

• Sort every service by its main job into one of eight groups: virtual networks, links between networks, hybrid links, load balancing and delivery, DNS, private access, network security and monitoring.
• Translate old names as you read: HTTP(S) LB is now Application Load Balancer, Cloud Firewall is now Cloud NGFW, Firewall Plus is now NGFW Enterprise, and Traffic Director is now Cloud Service Mesh.
• Classic VPN with BGP was deprecated on 1 August 2025. Use HA VPN for dynamic routing.
• EXTERNAL load-balancing schemes mean classic mode. Prefer EXTERNAL_MANAGED.
• Check lifecycle status (GA, Preview or deprecated) before building on a service.