Networking Operations & DNS

Introduction to Networking Operations and DNS

In the day-to-day life of an Associate Cloud Engineer, ensuring that your network is reachable, reliable, and secure is a primary responsibility. Networking Operations & DNS cover the essential tasks that go beyond setting up a VPC. This includes managing how your services are found by name (Cloud DNS), how private resources reach the internet safely (Cloud NAT), and how your load balancers know which servers are healthy and ready to receive traffic.

Networking Operations & DNS focus on the "plumbing" of the cloud. Just as a city needs functioning water lines and clear street signs to operate, your cloud environment needs robust DNS resolution and network address translation to support your applications. Mastering these operational aspects is critical for maintaining high availability and low latency for your users, and it is a major component of the ACE certification exam.

白話文解釋（Plain English Explanation）

To help you internalize the concepts of Networking Operations & DNS, let's look at three analogies that describe how these services interact.

1. The City Street Signs and GPS (Cloud DNS)

Imagine driving through a large city:

• IP Addresses are the GPS coordinates of a building. They are precise but very hard for humans to remember.
• Cloud DNS is the Street Signs and the Digital Map. Instead of memorizing "34.123.45.67," you just look for "MainStreet.com."
• Public Zones are the signs everyone can see.
• Private Zones are the signs inside a private office park that only employees (internal VMs) can read.

In Networking Operations & DNS, DNS is the service that translates human-friendly names into machine-readable addresses, ensuring everyone finds their way.

2. The One-Way Security Gate (Cloud NAT)

Think about a gated community with high security:

• Private VMs are the residents of the community. They don't have public house numbers (External IPs).
• Cloud NAT is the Exit-Only Security Gate. Residents can drive out to go to the grocery store (the internet) to get supplies (software updates), but strangers from the outside cannot drive through that gate to enter the community.

Networking Operations & DNS use NAT to allow private resources to reach the world without making them vulnerable to incoming attacks from the public internet.

3. The Restaurant Health Inspector (Health Checks)

Consider a busy food court:

• The Backend Servers are the individual food stalls.
• The Load Balancer is the Hostess at the entrance.
• Health Checks are the Health Inspector who checks each stall every 5 minutes.

If the Inspector finds that a stall's refrigerator is broken (the server is down), they put a "Closed" sign on it. The Hostess (Load Balancer) then stops sending hungry customers (traffic) to that stall until it's fixed. This is a core part of Networking Operations & DNS to ensure a smooth user experience.

Mastering Cloud DNS for Service Discovery

Cloud DNS is a scalable, reliable, and managed authoritative Domain Name System (DNS) service.

Public vs. Private DNS Zones

• Public Zones: These are reachable from the public internet. You use them to host your website's domain (e.g., example.com).
• Private Zones: These are only visible within your specified VPC networks. They are perfect for internal service discovery (e.g., db.internal).

Managing DNS Record Sets

The most common records you will manage in Networking Operations & DNS include:

• A Record: Maps a name to an IPv4 address.
• CNAME Record: Maps one name to another (an alias).
• TXT Record: Used for domain verification and security policies.

DNS Peering and Forwarding Zones

You can "peer" DNS zones between different VPCs so that they can resolve each other's internal names, which is a common requirement in complex Networking Operations & DNS architectures.

Providing Internet Access with Cloud NAT

How Cloud NAT Works without External IPs

In Networking Operations & DNS, Cloud NAT allows Compute Engine instances and GKE nodes without external IP addresses to send traffic to the internet. The internet sees the traffic coming from the NAT IP address, not the internal IP of the VM.

Configuring Cloud Router for NAT

Cloud NAT is not a standalone "appliance." It is a service that is managed by a Cloud Router. You must create a Cloud Router in the same region as your subnets to enable NAT.

Managing Port Reservation and Allocation

Each NAT IP address can handle about 64,000 concurrent connections. Networking Operations & DNS involve monitoring "Port Exhaustion" to ensure your VMs don't lose internet connectivity if they make too many requests.

IP Address Management (IPAM)

Reserving Static External IP Addresses

An "Ephemeral" IP changes when you stop your VM. For production servers, you should "promote" these to "Static" IPs.

Internal vs. External IP Lifecycles

Understand that internal IPs are assigned by the VPC subnet, while external IPs are assigned from Google's global or regional pools.

Load Balancer Health Checks and Reliability

Health checks are the "heartbeat" of your Networking Operations & DNS strategy.

Defining Health Check Probes

You can probe your backends via HTTP, HTTPS, TCP, or SSL. For a web server, an HTTP probe checking for a "200 OK" status on a /healthz path is the standard.

Configuring Thresholds and Intervals

• Check Interval: How often to probe (e.g., every 5 seconds).
• Unhealthy Threshold: How many failures in a row before stopping traffic (e.g., 3 failures).

Troubleshooting Unhealthy Backends

If your load balancer says a backend is unhealthy, but you can SSH into the VM, check your firewall rules! You must allow the Google Health Check IP ranges (130.211.0.0/22 and 35.191.0.0/16) to reach your VM.

Secure Connectivity with Cloud VPN

HA VPN: Setting up Redundant Tunnels

High Availability (HA) VPN is the standard for Networking Operations & DNS. It requires two tunnels and two public IPs on the Google side, providing a 99.99% availability SLA.

Classic VPN vs. HA VPN

Classic VPN is being phased out. Always choose HA VPN for production workloads to ensure redundant connectivity to your on-premises data centers.

Global Network Reach with Anycast IP

How Anycast Routes Users to the Nearest Edge

Google uses "Anycast" IP addresses for its global load balancers. This means the same IP address is advertised from all Google edge locations worldwide. A user in Tokyo and a user in New York will both hit the "same" IP but be routed to the Google edge closest to them.

Advanced DNS Operations: Policies and Steering

Geolocation-based DNS Routing

You can configure Networking Operations & DNS so that users in Europe are directed to your europe-west1 resources, while users in the US go to us-central1.

Enabling DNSSEC for Security

DNS Security Extensions (DNSSEC) add a layer of cryptographic signatures to your DNS records, preventing "DNS spoofing" or "man-in-the-middle" attacks.

Monitoring Network Performance

Network Topology Visualization

Use the Network Intelligence Center to see a graphical map of how your VPCs, subnets, and hybrid connections are linked in your Networking Operations & DNS environment.

Diagnosing Connectivity with Performance Dashboards

View real-time and historical latency between all Google Cloud regions to help plan your multi-region deployment strategy.

Managing Network Ops via gcloud CLI

• gcloud dns managed-zones create my-zone --dns-name="example.com." --description="My public zone": Creates a DNS zone.
• gcloud compute addresses create my-ip --region=us-central1: Reserves a static IP.
• gcloud compute routers nats create my-nat --router=my-router --region=us-central1 --auto-allocate-nat-external-ips: Enables NAT.

Troubleshooting Common Networking Failures

DNS Resolution Timeouts

Usually caused by a misconfigured Private DNS zone or a missing DNS forwarding rule between peered VPCs.

NAT Gateway Port Exhaustion

If your logs show OUT_OF_RESOURCES for your NAT gateway, you need to add more IP addresses to the gateway to provide more ports for your VMs.

Health Check Probe Blocking by Firewall

This is the #1 cause of "Unhealthy" backends on the ACE exam. Always verify that your firewall allows traffic from the specific Google Health Check IP ranges.

Common Exam Scenarios for ACE

Allowing Private VMs to Update Software

"You have a subnet with no external IPs. The VMs need to download security patches. What is the best solution?" (Answer: Configure a Cloud NAT gateway via a Cloud Router).

Migrating a Domain to Cloud DNS

"You want to move your domain from a legacy provider to GCP for 100% availability. What are the steps?" (Answer: Create a Public Managed Zone in Cloud DNS, add your records, and update your domain registrar's Name Servers to point to Google).

Fixing a "Broken" Load Balancer

"Your Load Balancer is showing 502 errors, but your VMs are running. What do you check?" (Answer: Verify the Health Check status and ensure firewall rules allow the Google Health Check probes).

FAQ

Q1: Can I use Cloud NAT for incoming connections? A1: No. Cloud NAT is for outbound traffic only. For inbound traffic to private VMs, use an Internal Load Balancer or IAP.

Q2: Is Cloud DNS a regional or global service? A2: Cloud DNS is a global service. Your zones and records are available worldwide with the same latency.

Q3: What happens if a Health Check fails? A3: The load balancer stops sending new connections to that instance. Existing connections may be allowed to drain depending on your configuration.

Q4: Can I have multiple NAT gateways in one region? A4: You can have multiple gateways per region, but each must be associated with a different Cloud Router or different subnets.

Q5: What is a CNAME record used for? A5: It's an "Alias." For example, you can point blog.example.com to ghs.googlehosted.com to use a Google-hosted service.

Summary Checklist for ACE

• Understand the difference between Public and Private DNS zones.
• Know that Cloud NAT requires a Cloud Router.
• Understand the pricing logic for static IP addresses.
• Be able to troubleshoot Load Balancer health checks (check firewalls!).
• Know how to use 'Anycast' IPs for global load balancing.
• Recognize the role of DNSSEC in preventing DNS attacks.