<br />

<br />


Dual-stack subnets let your App Engine resources send IPv4
and IPv6 traffic to a VPC network with Direct VPC egress.
You can change an existing IPv4 only (single-stack) subnet to a dual-stack
subnet.

## Subnet types

VPC networks support the following
[Compute Engine subnet types](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#subnet-types):

- IPv4 only (single-stack) subnets, with only [IPv4 subnet ranges](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#ipv4-ranges)

- IPv4 and IPv6 (dual-stack) subnets, with both IPv4 and [IPv6 subnet ranges](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#ipv6-ranges)

## Dual-stack limitations

Before you change the stack type on an existing App Engine
resource, consider the following limitations:

- Dual-stack support is only available with subnets in a custom-mode
  VPC network. To have the internal access type
  available for dual-stack subnets, the VPC network internal IPv6
  range must be enabled. Set up or [convert](https://docs.cloud.google.com/vpc/docs/create-modify-vpc-networks.md.txt#switch-network-mode)
  the VPC network to custom mode.

- Compared to IPv4-only subnets, dual-stack subnets might experience elevated
  cold-start latencies, limiting how quickly your application can scale up.

- [NAT64](https://tools.ietf.org/html/rfc6146) isn't supported.

## Before you begin

Be sure that the App Engine service agent has the [Compute Public IP Admin role (`roles/compute.publicIpAdmin`)](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.publicIpAdmin) to use the subnet with external IPv6.

## Set up a dual-stack subnet

Dual-stack subnets have both IPv4 and IPv6 address ranges.

To set up a dual-stack subnet, you can either use the Google Cloud console or the
Google Cloud CLI:

### Console

1. Go to the Google Cloud console and enable the Compute Engine API:

   [Enable the Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com)
2. Navigate to the **VPC networks** page:

   [Go to VPC networks](https://console.cloud.google.com/networking/networks/list)
3. Click **Create VPC network** if you are creating a new custom-mode network.
   If you are using an existing VPC network, click the name of the
   VPC network to show its *VPC network details* page.

4. If you are creating a new network or converting an existing one, enter the
   name and be sure that the **Subnet creation mode** is set to **Custom** , then select
   **Configure a ULA internal IPv6 range for this VPC Network**.

5. From the **Subnets** tab, click **Add subnet**. In the panel that appears:

   1. Provide a **Name**.
   2. Select a **Region**.
   3. For **IP stack type** , select **IPv4 and IPv6 (dual-stack)**.
   4. Enter an **IPv4 range** . This is the [primary IPv4 range](https://docs.cloud.google.com/vpc/docs/vpc.md.txt#vpc_networks_and_subnets) for the subnet.
   5. Select the **IPv6 access type**.

      If the **Internal** option is not available and you need it, check that
      an internal IPv6 range is assigned on the network.
   6. Click **Add**.

### gcloud

1. To create a custom-mode network that supports dual-stack subnets, run the
   `gcloud compute networks create` command.

   To configure *internal* IPv6 ranges on any subnets in this network, use the
   `--enable-ula-internal-ipv6` flag. This option assigns a `/48` ULA prefix
   from within the `fd20::/20` range used by Google Cloud for
   internal IPv6 subnet ranges.

   ```bash
   gcloud compute networks create NETWORK \
     --subnet-mode=custom \
     --enable-ula-internal-ipv6
   ```

   Replace <var translate="no">NETWORK</var> with the name of the VPC
   network that will contain the new subnet.
2. To convert an auto-mode network or update a custom-mode network so that it
   supports dual-stack subnets, run the following steps:

   1. If you're converting an auto-mode network, switch the
      network to custom subnet mode:

      ```bash
      gcloud compute networks update NETWORK \
        --switch-to-custom-subnet-mode
      ```
   2. Enable an internal IPv6 range on the network:

      ```bash
      gcloud compute networks update NETWORK \
        --enable-ula-internal-ipv6
      ```

      Replace <var translate="no">NETWORK</var> with the VPC
      network name that contains the new subnet.
3. To create a dual-stack subnet with an IPv6 range, run the
   [`subnets create` command](https://docs.cloud.google.com/sdk/gcloud/reference/compute/networks/subnets/create)
   using the dual-stack settings:

   ```bash
   gcloud compute networks subnets create SUBNET \
     --network=NETWORK \
     --range=PRIMARY_IPv4_RANGE \
     --stack-type=IPV4_IPV6 \
     --ipv6-access-type=IPV6_ACCESS_TYPE \
     --region=REGION
   ```

   Replace the following:
   - <var translate="no">SUBNET</var>: a name for the new subnet.
   - <var translate="no">NETWORK</var>: the name of the VPC network that will contain the new subnet.
   - <var translate="no">PRIMARY_IPv4_RANGE</var>: the primary IPv4 range for the new subnet, in CIDR notation. For more information, see [IPv4 subnet
     ranges](https://docs.cloud.google.com/vpc/docs/subnets#manually_created_subnet_ip_ranges).
   - <var translate="no">IPV6_ACCESS_TYPE</var>: the IPv6 access type for the new subnet, either `internal` or `external`.
   - <var translate="no">REGION</var>: the Google Cloud region that the new subnet will be created in.

## Add the dual-stack subnet to an App Engine resource

After you create a dual-stack subnet, add the subnet to your App Engine
service by using YAML or Terraform. To enable Direct VPC egress for a service
that doesn't already use it, deploy a new version and
[migrate traffic](https://docs.cloud.google.com/appengine/docs/standard/migrating-traffic.md.txt) to it. You can
also delete the deployed version first, instead of overwriting an existing
version ID.

### YAML

1. In your `app.yaml` file, specify the network and subnet in the `vpc_access`
   field:

   ```yaml
   vpc_access:
   network_interface:
    network: NETWORK
    subnet: SUBNET
   vpc_egress: EGRESS_SETTING
   ```

   Replace the following:
   - <var translate="no">NETWORK</var>: the name of the network you created in the previous
     step.

   - <var translate="no">SUBNET</var>: the name of the subnet you created in the previous
     step.

   - Optional: <var translate="no">EGRESS_SETTING</var> controls how outbound traffic is
     routed. This field supports the following configuration settings:

     - `all-traffic`: All outbound requests are routed through the VPC network.
     - `private-ranges-only` (default): Only traffic to internal IP addresses is routed through the VPC network. Internet traffic uses the default App Engine path.
2. Deploy to App Engine by running the following command:

   ```bash
   gcloud app deploy
   ```

### Terraform

To learn how to apply or remove a Terraform configuration, see
[Basic Terraform commands](https://docs.cloud.google.com/docs/terraform/basic-commands.md.txt).

1. Add the following `vpc_access` block to a
   [`google_app_engine_standard_app_version`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/app_engine_standard_app_version)
   resource in your Terraform configuration:

   ```terraform
   vpc_access {
   vpc_egress = "EGRESS_SETTING"
   network_interfaces {
    network    = "NETWORK"
    subnetwork = "SUBNET"
   }
   }
   ```

   Replace the following:
   - <var translate="no">NETWORK</var>: the name of the VPC network you created in the previous step.
   - <var translate="no">SUBNET</var>: the name of the subnet you created in the previous step.
   - Optional: <var translate="no">EGRESS_SETTING</var> controls how outbound traffic is routed. This field supports the following configuration settings:
   - `ALL_TRAFFIC`: All outbound requests are routed through the VPC network.
   - `PRIVATE_IP_RANGES` (default): Only traffic to internal IP addresses is routed through the VPC network. Internet traffic uses the default App Engine path.
2. If the version is already deployed without Direct VPC egress, update the
   `version_id` field to a new value. You can't enable Direct VPC egress
   on an existing version.

3. Apply the configuration:

   ```bash
   terraform apply
   ```

## Change a subnet from single-stack to dual-stack

To add an IPv6 subnet range to an existing IPv4-only subnet in a custom-mode
VPC network, see [Change a subnet's stack type to dual-stack](https://docs.cloud.google.com/vpc/docs/create-modify-vpc-networks.md.txt#subnet-enable-ipv6).
Then, deploy the App Engine service on the dual-stack subnet.

## Change a subnet from dual-stack to single-stack

To change a resource's dual-stack subnet to a single-stack subnet, see
[Change a dual-stack subnet to IPv4 only](https://docs.cloud.google.com/vpc/docs/create-modify-vpc-networks.md.txt#subnet-change-stacktype).
Then, deploy the App Engine service on the single-stack subnet.

## Verify the network and subnet

To check that your resource is on the VPC network, run the
following command:

<br />

```bash
gcloud app versions describe VERSION --service=SERVICE
```

<br />

Replace the following:

- <var translate="no">VERSION</var>: the deployed version of your service
- <var translate="no">SERVICE</var>: the deployed service

The following example output shows your network and subnet:

      vpcAccess:
        networkInterfaces:
        - network: projects/YOUR_PROJECT/global/networks/YOUR_NETWORK
          subnet: projects/YOUR_PROJECT/regions/YOUR_REGION/subnetworks/YOUR_SUBNET
        vpcEgress: ALL_TRAFFIC/PRIVATE_IP_RANGES