[MUSIC PLAYING]
SPEAKER: Network Intelligence Center
is Google Cloud's solution for network
monitoring across the cloud and on premise.
It improves user experience, security, and operations
by providing a comprehensive platform for monitoring,
visualizing, and troubleshooting network health across the cloud
and data center.
Connectivity Tests is a module in Network Intelligence Center
that enables you to do network verification, which
is a key part of intent-based networking.
The idea of verification is to ensure
that the intent of the network designer is being met.
It also allows you to move from reactive
to proactive network operations by predicting what could happen
when you make a config change, thus preventing network
outages.
Published sources show that 75% of network outages
and performance issues happen due to misconfiguration.
In a complex Google Cloud environment
with a shared VPC, many firewall rules and routes,
it can be difficult to quickly identify which configuration
caused the connectivity issue.
Connectivity Test enables a user to test connectivity
between a source and destination end point.
It also tells you if the connectivity
is broken and identifies the root cause, such as a firewall
rule or route config.
Connectivity Test performs a static reachability analysis
by building a model of the network
and then doing packet simulation on the network based
on configuration.
Let's see how you can use on-demand connectivity tests
with the help of three different examples.
Say you've run into connectivity issues between two VM instances
in different zones in a project.
You can check the connectivity between source and destination
endpoint by creating a connectivity test.
Click on Create Connectivity Test.
Pick the protocol ICMP.
Select a source VM instance or an IP address, pick VPC1 US VM,
and a destination VM instance slash IP address.
Pick VPC1 EU VM, and click Create.
This saves the test and also runs it.
Once the test is run, it shows Test Result as Unreachable.
Click on View to check the result details.
It shows you a detailed hop-by-hop trace,
showing how the packet would traverse through the network.
From the trace, you can see the packet starts from the source
VM, goes through an egress firewall rule,
and then the packet gets dropped by the ingress firewall
rule at the destination VM.
You can click any of the hops to see more details of the hop.
Here, if you click Ingress Firewall Rule,
you can see that the Deny ICMP Firewall
rule blocked the connectivity.
Right from here, you can go to the firewall rule page,
update or disable the firewall rule.
Let's disable the firewall rule and check
if this fixes the issue.
Select the test, and run the connectivity test again
to verify the impact of your firewall rule change
and make sure connectivity is restored.
After you rerun, the Test Result shows
Reachable, which tells you that the connectivity issue is
fixed.
Notice how easy it was to quickly understand the trace,
find out the root cause, firewall rule,
and update it, and analyze whether it fixes the problem?
Let's look at a more complex scenario
where there are two VPCs connected
via high-availability VPN.
AJ VPN creates two tunnels to provide
four nines of availability.
We'll test connectivity between a VM in VPC1 connected to a VM
in VPC2 via HA VPN.
Click on Create Connectivity Test
and pick the protocol TCP, source and destination VM,
and click Create.
It shows Test Result as Unreachable.
Click on View to see the trace.
In this case, you can see there are
two traces, which is expected, since this path is
through HA VPN.
Connectivity Test will show you multiple traces if they exist.
From this trace, you can see that there is a VPN gateway,
and the traffic is getting dropped at the ingress firewall
rule VPC2, Deny HTTP.
You can go to the Firewall Rules page
and fix or disable the firewall rule.
Let's disable it and rerun the test.
And you can now see that the connectivity is restored.
You can also check the second, trace to analyze the path
and make sure both the tunnels are set up correctly,
You can also verify connectivity between Google Cloud
and on-prem, or on-prem to Google Cloud, which
could be especially useful during application migration.
Here we are checking the connectivity
between the VM instance on GCP and an external on-prem IP
address.
Click on Create Connectivity Test, select Protocol, ICMP,
source VM instance as VPC1 US VM, and destination IP address.
Once the test finishes, you can see
Test Result shows Reachable, which
means the connectivity is OK.
You can click on View and look at the path trace
to better understand your network design.
In this case, you can see the traces
going through a NAT gateway and can reach the external IP
address.
As a user, you can create and save
multiple connectivity tests that reflect your intent,
connectivity that should be allowed,
and those that should be blocked.
Here, you can see we have created and saved
a few different tests.
Anytime you make a configuration change,
you can run these tests to verify the impact
of your configuration changes.
For some tests, the intent might be
to have connectivity between the endpoints,
so you'll see those test results in green.
For other tests, the intent might
be to block connectivity between the endpoints,
so those test results should be in red.
Anytime you make a configuration change,
you can run these tests to make sure your intent stays intact.
Connectivity Test provides you a quick way
to do network verification and ensure
that any configuration change does not violate your intent.
It allows you to treat your configuration as code,
and you can think of these as unit tests
that you can run to prevent network outages
and also verify your security slash compliance posture.
Congratulations.
You're all set up to start using the Connectivity Test
module in network Intelligence Center
to do network verification, quickly diagnose
connectivity issues due to misconfiguration,
and predict the impact of configuration changes.
[MUSIC PLAYING]