The following features are available in Connectivity Tests:

• Google Kubernetes Engine (GKE) Pod as an endpoint: you can specify a GKE Pod as the source or destination endpoint for a connectivity test.
• IP masquerading evaluation: Connectivity Tests evaluates whether IP masquerading is applied to traffic sent from a GKE Pod endpoint. If IP masquerading is applied, the translated address is used for the test.
• Network policy evaluation: for GKE clusters where FQDN network policies aren't enabled, Connectivity Tests evaluates GKE network policies that apply to a GKE Pod endpoint.

For more information, see Considerations for Google Kubernetes Engine.

Connectivity Tests evaluates hybrid subnet routing, including routing for unmatched resources in hybrid subnets.

The following features are available in Connectivity Tests:

• Source IP type selection: you can select a specific source IP address type when creating a connectivity test in the Google Cloud console.

  Options include: an internal IP address in a VPC network; an internal IP address outside of Google Cloud; an external IP address; or automatic source detection that evaluates all possible paths.

• New network type: the Network Management API includes the INTERNET network type, which maps to the External IP address source IP type in the Google Cloud console.

• Your own IP address as the source: you can select your user IP address as the source IP address for a connectivity test in the Google Cloud console.

• Automatic VPC network detection: for destination IP addresses within Google Cloud, Connectivity Tests automatically detects the destination VPC network. You no longer need to select it manually.

Connectivity Tests identifies the following routes as invalid: peering dynamic routes and Network Connectivity Center dynamic routes that are dropped due to network- or hub-level quotas.

Cloud Network Insights is available in Preview.

Cloud Network Insights monitors your network and web application performance across multicloud and hybrid networks and provides visualization tools to help identify and diagnose network issues.

Contact your Technical Account Manager to request access.

Flow Analyzer supports latency mode, allowing you to analyze round-trip time in your traffic flows. For more information, see Display flows in latency mode.

Connectivity Tests analyzes firewall policies that apply to managed Envoy proxies.

Connectivity Tests analyzes configurations that use geolocation objects in firewall policy rules.

The following insight types and subtypes are available in Network Analyzer:

• Recommender insight subtypes:
  • ROUTE_NEXT_HOP_FORWARDING_RULE_IP_MISMATCH
  • ROUTE_NEXT_HOP_FORWARDING_RULE_TYPE_INVALID
  • ROUTE_NEXT_HOP_ILB_VIP_NOT_ASSIGNED
  • ROUTE_NEXT_HOP_IP_NOT_ASSIGNED
  • ROUTE_NEXT_HOP_VM_NON_PRIMARY_IP
  • ROUTE_NEXT_HOP_VM_WRONG_NETWORK
  • ROUTE_NEXT_HOP_VPN_TUNNEL_NOT_ESTABLISHED
  • NCC_DYNAMIC_ROUTE_FULLY_SHADOWED
• Cloud Logging insight types:
  • ROUTE_INVALID_NEXT_HOP_FORWARDING_RULE_IP_MISMATCH
  • ROUTE_INVALID_NEXT_HOP_FORWARDING_RULE_TYPE_INVALID
  • ROUTE_INVALID_NEXT_HOP_ILB_VIP_NOT_ASSIGNED
  • ROUTE_INVALID_NEXT_HOP_IP_NOT_ASSIGNED
  • ROUTE_INVALID_NEXT_HOP_VM_NON_PRIMARY_IP
  • ROUTE_INVALID_NEXT_HOP_VM_WRONG_NETWORK
  • ROUTE_INVALID_NEXT_HOP_VPN_TUNNEL_NOT_ESTABLISHED
  • DYNAMIC_ROUTE_SHADOWED_FULLY_SHADOWED_BY_NCC_SUBNET_ROUTE
  • NCC_DYNAMIC_ROUTE_SHADOWED_FULLY_SHADOWED_BY_PEERING_SUBNET_ROUTE
  • NCC_DYNAMIC_ROUTE_SHADOWED_FULLY_SHADOWED_BY_STATIC_ROUTE
  • NCC_DYNAMIC_ROUTE_SHADOWED_FULLY_SHADOWED_BY_SUBNET_ROUTE

For more information, see Routes with an invalid next hop and Shadowed dynamic routes.

Change

Network Analyzer no longer generates the following insight types and subtypes:

• Recommender insight subtypes:
  • ROUTE_NEXT_HOP_ILB_BACKEND_IP_FORWARDING_DISABLED
  • DYNAMIC_ROUTE_PARTIALLY_SHADOWED
  • PEERING_DYNAMIC_ROUTE_PARTIALLY_SHADOWED
• Cloud Logging insight types:
  • ROUTE_INVALID_NEXT_HOP_ILB_BACKEND_IP_FORWARDING_DISABLED
  • DYNAMIC_ROUTE_SHADOWED_PARTIALLY_SHADOWED_BY_SUBNET_ROUTE
  • DYNAMIC_ROUTE_SHADOWED_PARTIALLY_SHADOWED_BY_PEERING_SUBNET_ROUTE
  • DYNAMIC_ROUTE_SHADOWED_PARTIALLY_SHADOWED_BY_STATIC_ROUTE
  • DYNAMIC_ROUTE_SHADOWED_PARTIALLY_SHADOWED_BY_PEERING_STATIC_ROUTE

Network Analyzer no longer generates the following insight types and subtypes:

• Recommender insight type and subtypes:
  • google.networkanalyzer.managedservices.cloudSqlInsight, including BLOCKED_BY_EGRESS_FIREWALL, BLOCKED_BY_ROUTING_ISSUE, and INSTANCE_NOT_RUNNING
  • CONTROL_PLANE_TO_NODE_BLOCKED_BY_INGRESS_FIREWALL
  • CONTROL_PLANE_TO_NODE_BLOCKED_BY_ROUTING_ISSUE
  • EXTERNAL_IP_UNASSIGNED
  • MISSING_ROUTES_TO_GOOGLE_APIS_AND_SERVICES
  • PRIVATE_GOOGLE_ACCESS_DISABLED
• Cloud Logging insight types:
  • CLOUD_SQL_PRIVATE_IP_BLOCKED_BY_EGRESS_FIREWALL
  • CLOUD_SQL_PRIVATE_IP_BLOCKED_BY_ROUTING_ISSUE
  • CLOUD_SQL_PRIVATE_IP_INSTANCE_NOT_RUNNING
  • GKE_CONTROL_PLANE_TO_NODE_BLOCKED_BY_INGRESS_FIREWALL_ON_NODE
  • GKE_CONTROL_PLANE_TO_NODE_BLOCKED_BY_ROUTING_ISSUE

Connectivity Tests analyzes configurations with secure tags for firewalls that are applied to VM instances with multiple network interfaces.

Connectivity Tests analyzes configurations with organization-level secure tags for firewalls.

Connectivity Tests analyzes the following features for serverless endpoints:

• Cloud Run configured with Direct VPC egress
• Full resolution of public destinations within Google Cloud for tests from Cloud Run, Cloud Run functions, and App Engine
• IPv6 and Private NAT in serverless configurations

Connectivity Tests analyzes configurations with custom producer ports in Private Service Connect backends.

Connectivity Tests analyzes configurations with NAT64 in Public NAT.

Feature

Network Analyzer includes an insight that indicates if a GKE cluster's pod CIDR range isn't included in the ip-masq-agent ConfigMap. For more information, see GKE IP masquerade configuration insights.

Connectivity Tests analyzes configurations that include Application and proxy Network Load Balancers with IPv6 backends.

Gemini Cloud Assist for Flow Analyzer is in Preview. You can generate SQL queries for VPC Flow Logs with Gemini assistance.

Connectivity Tests analyzes configurations with Private Service Connect port mapping.

Flow Analyzer is available in General availability.

Connectivity Tests analyzes configurations that include firewall policy rules with network types.

Connectivity Tests supports round-trip connectivity tests. Test results include return traces with connection tracking.

Connectivity Tests analyzes configurations that include dynamic routes in VPC networks with the standard best path selection mode.

Connectivity Tests analyzes configurations that include IPv6 policy-based routes and policy-based routes with a next hop internal passthrough Network Load Balancer in a peered VPC network. For more information, see Policy-based routes.

Connectivity Tests supports Redis instances and Redis Cluster instances as destination endpoints.

Network Analyzer now includes additional information in the IP address utilization summary insights. In the case of Shared VPC, Network Analyzer gives a summary of the IP address utilization of all relevant subnet ranges of the host project, and also provides the insights of the service projects. For more information, see IP address utilization summary insights.

Connectivity Tests analyzes configurations with Network Connectivity Center producer VPC spokes.

Connectivity Tests analyzes configurations with Network Connectivity Center hybrid spokes.

Network Analyzer now includes an insight indicating that the next hop IP address is not assigned to any forwarding rule in the relevant networks. This insight is already available in the Recommender API. For more information, see routes with an invalid next hop insight.

Connectivity Tests analyzes configurations with Hybrid NAT.

Connectivity Tests analyzes configurations with Private Service Connect interfaces.