This page summarizes the Google Cloud networking configurations and features that Connectivity Tests can analyze. Connectivity Tests supports both IPv4 and IPv6 when applicable.
The specific configurations and features that are analyzed in a test depend on your source and destination endpoints. For a list of supported endpoints, see Supported endpoints.
Compute Engine
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| Instances with single and multiple network interfaces | ||
Instances with internal and external IP addresses, including: |
Google Kubernetes Engine
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| IP masquerading | ||
| Non-FQDN network policies |
Serverless endpoints
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| Direct VPC egress for active revisions with allocated addresses1 | ||
| Serverless VPC Access | ||
| External connectivity |
1
Connectivity Tests analyzes Direct VPC egress only for
Cloud Run.
Virtual Private Cloud networking
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| VPC networks, including Shared VPC networks | ||
| Policy-based routes1 | ||
| Subnet routes | ||
| Static routes1 | ||
| Dynamic routes1 | ||
| VPC Network Peering (all types of peering routes) | ||
| Private Google Access |
1
All types of next hops.
Cloud Next Generation Firewall
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
Firewall policies:
|
||
| VPC firewall rules | ||
| Firewall rules for Envoy proxies | ||
| Rule components | ||
| Secure tags, network tags, and service accounts | ||
| Network contexts | ||
| IP address ranges and address groups | ||
| FQDN objects | ||
| Geolocation objects | ||
| Google Threat Intelligence lists | ||
Cloud NAT
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| Public NAT | ||
| NAT44 | ||
| NAT64 | ||
| Private NAT | ||
| NAT44 | ||
| NAT64 | ||
| NAT rules | ||
| NAT rules (Public NAT and Private NAT) | ||
Cloud Load Balancing
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| Application Load Balancer | ||
| Internal (regional and cross-region) | ||
| External (global, classic, and regional) | ||
| Proxy Network Load Balancer | ||
| Internal (regional and cross-region) | ||
| External (global, classic, and regional) | ||
| Passthrough Network Load Balancer | ||
| Internal (regional) | ||
| External (global and regional) | ||
| Backends | ||
| Instance groups, target pools, and target instances | ||
Network endpoint groups (NEGs):
|
(only for zonal and port mapping NEGs) |
|
| Backend buckets | ||
The following additional considerations apply to configuration analysis:
- Connectivity Tests verifies whether firewall rules allow Cloud Load Balancing health check probes to reach backends and Envoy proxies. For information about how Connectivity Tests analyzes backends, see Number of traces in a test to a load balancer.
- Google Cloud Armor policies aren't analyzed when tracing connectivity to load balancers.
Private Service Connect
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| Endpoints for published services | 1 | |
| Endpoints for global and regional Google APIs | ||
| Connection propagation through Network Connectivity Center (NCC) | ||
| Interfaces |
1
Supported only when the target producer is an internal passthrough Network Load Balancer.
Network Connectivity Center
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| VPC spokes (including producer VPC spokes) and NCC subnet routes | ||
| Hybrid spokes and NCC dynamic routes1 | ||
| Gateway spokes2 |
1
All types of next hops.
2
Up to NCC Gateway.
Connectivity Tests doesn't analyze the path through the
spoke.
Hybrid connectivity
| Configuration or feature | Configuration analysis | Live data plane analysis |
|---|---|---|
| Cloud Interconnect1 | ||
| HA VPN and Classic VPN2 | ||
| Router appliance instances |
1
Up to the VLAN attachment for Cloud Interconnect.
2
Up to the VPN gateway, unless the peer VPN gateway is in
Google Cloud.
HA VPN
gateways connected to Compute Engine instances
aren't supported.