Routes - Virtual Networks Module 1.2.3

Question 1

What is a network route

Answer 1

Route is a mapping of an IP range to a destination.

Question 2

Which routes every GSP network has?

Answer 2

By default, every network has routes that let instances in a network send traffic directly to each other, even across subnets.

In addition, every network has a default route that directs packets to destinations that are outside the network.
you can also create special routes that overwrite these routes.

Question 3

What is also needed besides routes to enable traffic to arrive to a destination

Answer 3

Firewall rules must also allow the packet.
Routes match packets by destination IP addresses.
However, no traffic will flow without also matching a firewall rule.

Question 4

What are default network pre-configured firewall rules (except custom networks that don’t have tham)

Answer 4

default-allow-internal - Permits incoming connections to VM instances from other instances within the same VPC network.
default-allow-ssh - Lets you connect to instances with tools such as ssh, scp, or sftp.
default-allow-rdp - Lets you connect to instances using the Microsoft Remote Desktop Protocol (RDP).
default-allow-icmp - Lets you use tools such as ping.

Question 5

When are routes created by default

Answer 5

A route is created when a network is created, enabling traffic delivery from “anywhere”.
Also, a route is created when a subnet is created.
This is what enables VMs on the same network to communicate.

Question 6

How the routes apply to an instance

Answer 6

A route applies to an instance if the network and instance tags match

If the network matches and there are no instance tags specified, the route applies to all instances in that network.

Question 7

How the traffic flow goes

Answer 7

Compute Engine then uses the Routes collection to create individual read-only routing tables for each instance.
There is massively scalable virtual router at the core of each network.
Every virtual machine instance in the network is directly connected to this router, and all packets leaving a virtual machine instance are first handled at this layer before they are forwarded to their next hop.
The virtual network router selects the next hop for a packet by consulting the routing table for that instance.

Question 8

what is ingress/ egress

Answer 8

inbound and outbound, known as ingress and egress, respectively.
Inbound connections are matched against ingress rules only, and outbound connections are matched against egress rules only.
Ingress incoming traffic (entering) Egress refers exiting traffic.

Question 9

What means that GCP firewall rules are stateful.

Answer 9

This means that if a connection is allowed between a source and a target or a target at a destination, all subsequent traffic in either direction will be allowed.
In other words, firewall rules allow bidirectional communication once a session is established.

Question 10

which are implied firewall rules on network

Answer 10

Also, if for some reason, all firewall rules in a network are deleted, there is still
an implied “Deny all” ingress rule and an implied “Allow all” egress rule for the network.

Question 11

What is firewall rule composed of?

Answer 11

• direction (ingress/egress)
• source (for ingress : IP addresses, tags, source service account)
  or
  destination (for egress IP address ranges)
• protocol & port
• action (allow, deny)
• priority
• rule assignment (rules are assigned to all instances, but you can assign certan rules to certan instances ????