NIKHIL KELSHIKAR: Hello, everyone.
Thank you for joining us today and spending the next 20
minutes with us to learn about how we are simplifying
hybrid networking and services for our customers
in Google Cloud.
The goal of this session is to walk you
through some key fundamentals of how we are enhancing network
to make it easy for you to build hybrid networks,
while connecting GCP to on prem and other clouds.
We will talk about how we're enabling our customers
to build, consume, and deliver services
to their customers with new networking innovations,
and how this model enables the zero trust security paradigm.
I am Nikhil Kelshikar, director of product management
in Cloud networking, responsible for enterprise
networking and Kubernetes networking.
And joining us as well today is Brian Rogan.
Brian?
BRIAN ROGAN: Hi.
I'm Brian Rogan.
I'm an engineering director at Google Cloud
and a longtime Googler.
I've worked on building the Google
backbone and the services that allow people to access Google
from all over the world.
Over the last few years, I've been
really excited to take those services and infrastructure
and expose them to our Cloud customers.
NIKHIL KELSHIKAR: Thank you, Brian.
And with that, let's get right into it.
As our customers move to the Cloud
and build new Cloud native applications,
customers have to build Cloud networks to meet application
scale, security, and reach.
This requires a new type of networking engineer, someone
who is able to understand the Cloud networking
paradigm and design networks which are fundamentally
software defined.
Additionally, these networks also
need to interoperate with the networks
as they are built today.
This design shift creates a new challenge for customers.
There are two clear patterns based
on the goals of the business.
First, traditional enterprises.
Traditional enterprises have well-established network design
patterns, and are often moving applications to the Cloud.
This requires mapping the Cloud network
through a complex existing network
to provide an on ramp to the Cloud
from branches, data centers, and perhaps even connecting
across multiple clouds as well.
Often what this results in is a parallel network
core for Cloud connectivity.
Security is complicated, as there
are different internal policies governing Cloud,
on prem, and user workloads.
And there is a lack of consistency in these policies.
This is often a hurdle for moving applications
to the Cloud and getting the right business results.
Secondly are the digital natives.
Digital natives are organizations
which have started their journey in the Cloud,
and are building new applications based
on native Cloud primitives.
Here, they are looking to enable a multi-cloud framework,
adopting service meshes in Kubernetes.
They're delivering applications from the Cloud globally.
Critical challenges here are to enable scale, security,
and consistency.
Our goal is to remove any hurdles in this Cloud journey,
by enabling a simple, secure, and scalable Cloud network.
To enable this, our main goal and vision
for hybrid networking and security
is to connect our customers and your users
to workloads in any Cloud or on prem location,
with a consistent experience that
is easy to secure and manage.
Let's dive deeper into this.
Connect refers to our investments
in making connectivity simple and pervasive.
Build capacity, scale, and performance where you need it.
You want to enable reachability and security
for all workloads and all services,
your business needs, irrespective of where they are,
where they reside, on prem, Google Cloud
or any other Cloud.
A consistent management and operations experience
is needed if we are to simplify and help
customers adopt multi-cloud.
Last but not least, security is paramount.
We want to enable our customers to adopt a zero trust model.
To do this, let's start with the network itself.
The Google network is the Cloud network.
This is the backbone which supports global traffic
for Google Search, Maps, and YouTube,
and all of the other Google services we use.
And this has been growing phenomenally
to meet the needs of the entire world,
as well as the need of our Cloud customers.
We are heavily invested in this network,
and continue to invest to build the lowest
latency, highest performance, reliable global network.
This has now expanded to over 27 regions worldwide
with 146 Edge PoPs, and continues to grow.
Additionally, we also continue to invest
in our undersea, subsea cables, to grow capacity
and the reach of the network.
Coupled with our edge nodes for media delivery
and distribution, this helps expand our customers' reach
to be able to reach their own customers.
Google's global network is your network,
and is a key differentiator of the GCP service.
In the Cloud, however, the complexity
of the transport network is completely abstracted away
from our customers.
We want our networking to enable our customers' business,
and grow at the need of the business.
This begins with meeting our customers where they are today
by providing a complete network connectivity solution.
Network connectivity center, or NCC from GCP,
enables such a global connectivity model
for all of hybrid networks.
We're working with you to enable migrating from IPs and Pods
to a service networking paradigm.
Applications are built from services,
and these services communicate with each other.
This is the level of abstraction we
want to provide to enable everything to run as a service.
This implies providing you with a unified way
to expose services across your hybrid environment,
providing the right high level policy controls
and a complete end to end visibility.
Once we have the network connectivity
model and the consistent service networking framework,
the path to zero trust is easier.
One can build a secure perimeter within the Cloud network
and lock access to it at the edge.
Services can be locked down with controls
based on identity and tags to enable micro segmentation.
This is truly the essence of the model we are building towards.
And now, I would like to pass it to Brian
to walk us through the technical building blocks of how
we can enable this journey.
Brian?
BRIAN ROGAN: Thanks, Nikhil.
I'm really excited to talk a little bit more
about what we're building, and how the pieces come together
into a unified architecture for hybrid applications
and services.
As Nikhil mentioned, it all starts with the network, which
we build from the ground up.
Once we come into the world of our Cloud abstractions,
the central virtual abstraction is NCC, or the network
connectivity center.
NCC is like a Swiss army knife for connectivity.
It allows you to bring together physical interconnects, SD WANs
and VPNs into a single coherent model.
Once you have connectivity through GCP,
our focus is on providing you the tools that you
need to secure the perimeter of that connectivity,
and make sure that you can make strong, enterprise wide
guarantees about what can get in and out of your network.
Things like VPC Service Controls let
you control who can access your first party Google services,
like Cloud Storage or Bigtable.
While IAP, firewall, and IDS allow you to determine who
can get into your networks from outside.
Layered on top of that, we're building a strong set
of service networking products.
These let your developers think and services.
Instead of worrying about IP addresses and ports,
they think about services in our service directory.
Service mesh can be configured with Traffic Director or info
service mesh, providing you end to end authorization
and identity.
Finally, you can expose your services
to the outside world easily and securely
with planet scale via our global load balancer, CDN,
and Cloud Armor products, all of which work seamlessly together
to give your users the best experience consuming
your applications, wherever they are in the world.
Wrapped around it all is a consistent view
of what's happening with our network and with these services
through our Network Intelligence in our product.
Let's dive a little bit deeper on the base.
We're happy to announce the GF network connectivity
center, which allows you a simple and consistent way
to connect together the different modes of connectivity
that you have in your hybrid environment
and bridge them onto your VPCs.
It allows you to connect our physical interconnect products,
which offer best in class reliability.
We've been investing significantly
over the last year to grow our reach and capacity.
Today, we have customers scaling up to tens
of terabits of interconnected GCP,
and we've launched 26 new locations in 2021.
Our HAVPN also offers best in class reliability,
and is a key part of many of our customers' architectures.
You can now use it standalone or on top
of our interconnect product for additional security.
We're adding integrations with your SD WAN provider of choice.
We've announced our partnership with Cisco, VMware, Versa,
Fortinet, and Palo Alto, and we intend
to continue growing the set of options
available to our customers.
Moving up our stack, we're working hard
to realize the vision of everything as a service.
Our goal is to fundamentally up level the networking
experience, away from IP addresses, ports, and routing,
and towards named services that your developers can easily
connect to and authenticate against without having
to understand all of that underlying infrastructure.
At the core of this is Private Service Connect,
which allows you to consume services
that are managed by one VPC from another VPC
with a simple producer consumer model.
You can register these services in our service directory
to get an easy way to refer to them,
and we'll soon do this for you automatically.
Over the coming quarters, we'll be introducing new controls
on services that are exposed with Private Service
Connect, that make it easy to determine
which service accounts, VPCs, or identities can access them.
Diving one level deeper on Private Service Connect,
PSC allows you to consume services faster
by letting consumer and producer VPCs be independent from one
another, either across VPC boundaries
or even across organizational boundaries.
A service producer in one VPC can allow service attachments
in another VPC to access that service as if it were published
from within the original VPC, without having
to think at all about the underlying network
configuration.
PSC at layer 4 provides a local IP address, and PSC at layer 7
provides a load balancer backend within the consumer VPC.
You don't need to worry about cross VPC connectivity,
peering, IP address overlaps, or securing the perimeter.
PSC handles all of this for you.
For third party services, we have
a set of partner integrations launching soon, including
MongoDB and Snowflake.
This allows you to privately consume these services
without traffic ever leaving a secure perimeter.
For services you develop, PSC helps you decouple
building a service from consuming that service,
and allows your development teams
to iterate independently across a clean boundary,
increasing their velocity.
PSC today represents a meaningful security perimeter
around the producer.
And going forward, our intent is to produce
an even richer set of controls.
Finally, our load balancing and Edge portfolio
allows you to securely offer your applications to the world,
regardless of where they originate--
in Compute Engine, Kubernetes, Anthos, our first party managed
services, or your hybrid or multi-cloud environment.
Under a single URL space, you can build applications
where the backends reside in any of these systems.
This gives your customers a seamless experience,
even when you're serving from a heterogeneous environment.
These products all offer planet scale delivery,
along with the reach and performance
that you've come to expect from the Google network.
They allow you to attach security policies,
authentication, or caching to your services
to build rich and distributed applications that reach
every corner of the Earth.
Finally, our goal over the coming quarters
is to help our customers move across the zero trust spectrum.
Today, many people that we work with are on the left.
They run network based perimeter controls
to control what traffic can come into their network.
But they have a relatively open posture inside the network.
We view the gold standard to be the right:
end to end authentication at layer 7,
with a strong notion of identity,
orchestrated by Anthos service metro Traffic Director.
This forms the core of the Google beyond prod vision.
The key question that we are working through
with our customers is how do we help get them there?
What are the tools that they need
to tighten their perimeters, move to much more
service-centric connectivity and security models,
and to lock down their services as much
as is practicable for their environment?
We're very excited to go on this journey with you together.
NIKHIL KELSHIKAR: Thank you, Brian.
So the technology building blocks and the network
are the tools.
We are working to bring together all these technologies
to solve three key problems we continually
hear from our customers.
First up, we enable a private enterprise service bus,
which gives you simple and consistent network connectivity
to connect together the services your organization uses
and produces.
We are enabling our customers to deliver
applications via our global network with planet scale
secure perimeter controls.
And thirdly, we enable our customers
to build a security architecture for Cloud workloads, which
provides a zero trust model for workloads and services,
while providing the choice of using native GCP first party
services, as well as best in class security products
from our third party partners itself.
Bringing this all together, we want
to highlight some key new launches and announcements
which have happened in the next or in the past few months.
First up, network connectivity center, NCC,
is now generally available.
Private Service Connect at L4 is generally available,
and we also have a preview for Private Service Connect
at Layer 7, as Brian mentioned.
Encryption is key to our customers.
Now we are glad to announce that IPsec [? all ?] interconnect
is now available as GA in many regions.
Hybrid load balancing, which offers endpoints in GCP,
as well as endpoints in on prem and in other clouds,
is also available now.
We have been investing phenomenally
on the security front.
One key new innovation is about Cloud intrusion detection
system, IDS.
We are delivering Cloud IDS with our partnership with Palo Alto,
and this is now available in preview.
We thank you very much for your time,
and hope that you can try some of these new innovations
in GCP networking, as we help you along
on your Cloud journey.
Thank you.