Hybrid Connectivity Security

Introduction to Hybrid Connectivity Security

Connecting an on-premises data center to Google Cloud is a critical path for data. If this connection is compromised, the entire hybrid infrastructure is at risk. A Professional Cloud Security Engineer (PSE) must ensure that hybrid links are encrypted, authenticated, and resilient against both eavesdropping and routing attacks.

The two primary methods for hybrid connectivity are Cloud VPN and Cloud Interconnect.

白話文解釋（Plain English Explanation）

Analogy 1: Cloud Interconnect vs HA VPN as a Bank Vault Tunnel vs Armored Car

Think of Dedicated Interconnect as a private underground tunnel built directly from your bank vault (on-prem data center) to the Federal Reserve (Google Cloud). No one else uses the tunnel — but it is still just a tunnel, and a corrupt construction worker could theoretically tap into the wall. That is why high-compliance customers add MACsec on top, which is like coating the inside of the tunnel with tamper-evident foil at the Ethernet (Layer 2) level. HA VPN, by contrast, is an armored car driving on the public highway: anyone can see the truck, but the contents are sealed by IPsec encryption with IKEv2 key exchange, and you always send two trucks (two tunnels) for the 99.99% SLA.

Analogy 2: BGP MD5 as a Secret Handshake at the Border

Cloud Router speaks BGP with your on-prem router to swap routing tables — basically saying "I own these subnets, send traffic for them to me." Without authentication, any router that yells loud enough can claim "actually, send all of 10.0.0.0/8 to me" and hijack your traffic. BGP MD5 authentication is a secret handshake: every BGP message is signed with a shared password hash. If the handshake doesn't match, the Cloud Router slams the door. It does not encrypt the data, only the control plane (the routing announcements themselves).

Analogy 3: Partner Interconnect as Renting a Truck from a Moving Company

With Dedicated Interconnect, you own the truck. With Partner Interconnect (Equinix, Megaport, AT&T, etc.), you rent the truck and the driver from a third party. The provider can technically see your Layer 2 frames as they hand them off to Google's edge. The mitigation is to never trust the truck — pack your cargo inside a locked container, which means layering HA VPN (IPsec) on top of Partner Interconnect. Private Google Access then ensures that even when you reach Google APIs over this hybrid link, you stay on private IPs (199.36.153.8/30) instead of leaking out to the public internet.

Securing HA VPN with IPsec and IKEv2

High Availability (HA) VPN is the standard for secure, encrypted tunnels over the public internet.

Security Features:

• IPsec (Internet Protocol Security): Provides encryption, data integrity, and authentication.
• IKEv2 (Internet Key Exchange v2): The preferred protocol for key exchange. It is more secure and efficient than IKEv1.
• Pre-Shared Keys (PSK): Used for mutual authentication between the peer gateway and the Cloud VPN gateway.
• Traffic Selectors: Define which CIDR ranges are allowed to pass through the tunnel. In HA VPN, these are usually set to 0.0.0.0/0 (any-to-any), with routing handled by BGP.

Cloud Interconnect Security: MACsec (Layer 2)

Dedicated Interconnect provides a direct physical link to Google's network. By default, this traffic is not encrypted because it is on a private circuit. However, for high-compliance industries, MACsec provides Layer 2 encryption.

What is MACsec?

• Link-Level Encryption: Encrypts all traffic between the on-premises router and the Google Edge router at the Ethernet layer.
• Integrity: Prevents man-in-the-middle attacks and packet tampering at the physical layer.
• Pre-shared Keys (CAK): MACsec uses Connectivity Association Keys (CAK) managed via Cloud KMS or stored as Secret Manager secrets.

BGP MD5 Authentication for Route Security

Hybrid connectivity relies on Border Gateway Protocol (BGP) to exchange routes. If an attacker can inject fake routes (BGP hijacking), they can redirect traffic.

• MD5 Authentication: You configure a shared secret (password) on both the Cloud Router and the on-premises router. Every BGP message is signed with a hash of this secret.
• If the hashes don't match, the BGP session is rejected.

Site-to-Site VPN Architectures

For companies with multiple branch offices, Site-to-Site VPN allows secure communication between sites through Google Cloud.

• Hub-and-Spoke: Use a VPC as a "Hub." Branch offices (Spokes) connect to the Hub via VPN.
• Network Connectivity Center (NCC): A Google service that simplifies managing these complex site-to-site topologies.

Encrypting Interconnect Traffic with IPsec

If you need Layer 3 encryption over a Dedicated Interconnect (perhaps because your routers don't support MACsec), you can run HA VPN over Interconnect.

• This provides the speed of Interconnect with the end-to-end encryption of IPsec.
• Architecture: The Interconnect acts as the transport layer for the HA VPN tunnels.

Monitoring Connectivity Health and Latency

Security includes availability. A link that is "down" is a security failure for a mission-critical system.

• Cloud Monitoring: Monitor vpn_gateway/sent_bytes_count and interconnect/dropped_packets.
• BGP Session Status: Alert if the BGP session moves from ESTABLISHED to any other state.
• Network Intelligence Center: Use the Connectivity Test tool to verify that firewall rules aren't blocking hybrid traffic.

Managing Keys and Certificates for VPN

• PSK Rotation: Change pre-shared keys periodically. This can cause brief downtime unless coordinated.
• Certificate-Based Authentication: While Cloud VPN primarily uses PSKs, some specialized architectures (using third-party NVAs) might use certificates managed via Certificate Authority Service (CAS).

Security Considerations for Partner Interconnect

In Partner Interconnect, a third-party provider (like Equinix or AT&T) manages the physical link.

• Risk: The partner technically has access to your Layer 2 frames.
• Mitigation: Always use IPsec (VPN) on top of Partner Interconnect if you do not trust the provider's physical security.

Designing for Redundancy and Failover Security

Failover should be automatic but secure.

• Active-Active: Both tunnels are used. If one fails, traffic shifts to the other.
• Active-Passive: One tunnel is a backup (using BGP MED or AS-PATH prepending to make it less preferred).
• Security Trap: Ensure that both the primary and backup links have identical firewall rules. You don't want a failover to a link that has "wide open" security.

PSE Exam Scenarios

Scenario 1: MACsec Requirement

"A bank requires that all data moving over their 10Gbps Dedicated Interconnect be encrypted at the physical layer to prevent tapping. What should the engineer configure?" Answer: Configure MACsec on the Dedicated Interconnect. Store the MACsec keys in Cloud KMS and ensure the on-premises router supports 802.1AE.

Scenario 2: BGP Hijacking Prevention

"A security audit found that the hybrid BGP sessions are vulnerable to spoofing. How can this be mitigated without adding encryption overhead?" Answer: Enable BGP MD5 Authentication on the Cloud Router and the on-premises peer. This authenticates the BGP control plane without encrypting the data plane.

Summary Checklist

• Differentiate between IPsec (Layer 3) and MACsec (Layer 2).
• List the requirements for a 99.99% HA VPN SLA.
• Explain how BGP MD5 protects routing.
• Describe the benefit of HA VPN over Interconnect.
• Identify the risks associated with Partner Interconnect.