You want to implement an IPSec tunnel between your on-premises network and a VPC via Cloud VPN.
You need to restrict reachability over the tunnel to specific local subnets, and you do not have a device capable of speaking Border Gateway Protocol (BGP)
Which routing option should you choose?
Click on the arrows to vote for the correct answer
A. B. C. D.A.
https://cloud.google.com/vpn/docs/concepts/overviewIf you want to implement an IPSec tunnel between your on-premises network and a VPC via Cloud VPN and need to restrict reachability over the tunnel to specific local subnets, and you do not have a device capable of speaking Border Gateway Protocol (BGP), you should choose option C, which is policy-based routing using a custom local traffic selector.
Policy-based routing (PBR) is a method of selectively applying routing policies based on a defined policy. In this case, it allows you to control the path of the traffic based on a specific policy, such as the source or destination address, the protocol, or the port number.
Using PBR, you can create a custom local traffic selector that specifies the local subnets that you want to allow to communicate over the tunnel. This approach is useful when you have a limited number of subnets that you want to allow to communicate over the tunnel and do not want to use BGP.
On the other hand, dynamic routing using Cloud Router (option A) requires a device capable of speaking BGP, and it is more appropriate when you have a large number of subnets to route between on-premises and cloud networks.
Route-based routing using default traffic selectors (option B) is a method where you route traffic based on the destination network address of the traffic. This method is not suitable for restricting reachability to specific local subnets.
Policy-based routing using the default local traffic selector (option D) is not recommended as it will route all traffic over the tunnel, including traffic that is not intended to be routed over the tunnel. This approach can cause traffic loops and performance issues.
In summary, when you want to restrict reachability over an IPSec tunnel to specific local subnets and do not have a device capable of speaking BGP, you should choose policy-based routing using a custom local traffic selector (option C).