Set up NCC and create a hub

Console

To enable the Network Connectivity API, do the following:

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. Click Enable.

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project.

3. Click Create hub.

4. Optional: choose the Hub policy mode.

5. Complete the Basic configuration section of the form:

   1. Enter a Hub name.
   2. Optional: Enter a Description.
   3. Optional: To add a label, click Add Item, and then enter a Key and Value.
   4. Verify that the form displays the correct Project ID. If the project ID is incorrect, select a different project by using the menu at the top of the page.

6. Optional: To enable Private Service Connect connection propagation, in the Private Service Connect connection propagation field, click On.

7. Do one of the following:

   • If you want to create a spoke, click Next step and complete the spoke-creation section of the form. For instructions, see, Create an NCC Gateway spoke.
   • If you don't want to create a spoke right now, click Create to finish creating your new hub.

gcloud

Use the gcloud network-connectivity hubs create command and specify the hybrid inspection preset topology.

gcloud beta network-connectivity hubs create HUB_NAME \
    --preset-topology=hybrid-inspection

Replace HUB_NAME with a name for the new hub.

API

Use the projects.locations.global.hubs.create method.

POST https://networkconnectivity.googleapis.com/v1beta/projects/PROJECT_ID/locations/global/hubs
{
  "name":"HUB_NAME",
  "description":"DESCRIPTION",
  "labels": {
    "KEY": "VALUE"
  },
  "presetTopology": "HYBRID_INSPECTION"
}

Replace the following:

• PROJECT_ID: the project ID of the project that contains the new hub
• HUB_NAME: the name of the new hub
• DESCRIPTION: optional text that describes the hub
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project in which you want to create the spoke.

3. Click the Spokes tab.

4. Click Add spokes.

5. In the Select hub section, select the hub location as follows:

   • To attach the new spoke to a hub in the same project, select In project PROJECT_NAME and select the hub name from the list.
   • If you want to attach the new spoke to a hub in another project, select In another project. Enter the Project ID and the Hub name to which you want to attach your new spoke.

   When you choose a hub in a different project, your spoke becomes active only when the hub administrator reviews and accepts your proposed spoke. For more details about creating spokes attached to a hub in a different project, see VPC spokes overview. If you are creating a VPC spoke in the same project as the hub, it is automatically accepted and activated.

6. Enter a Spoke name and optionally, a Description.

7. Based on the topology of the hub that you are connecting to, choose the Spoke group for your spoke. You can choose from the following values:

   • Default for a mesh topology hub
   • Center or Edge for a star topology hub. This field is required for spoke groups that use star topology
   • Prod, Non-prod, or Services for a hub that uses the hybrid inspection topology (only for NCC Gateway spokes)

   For detailed information about spoke groups, see Spoke groups.

8. Select VPC network as the Spoke type.

9. To add a VPC network to the spoke, select one from the Associated VPC network list.

10. Optional: add a VPC spoke filter to customize how routes are advertised by specifying IP address ranges to exclude or include export from the spoke to the hub. You can configure the spoke to export only subnet ranges that use private IPv4 addresses, only IPv6 subnet ranges (internal and external), or both subnet ranges that use private IPv4 addresses and internal and external IPv6 subnet ranges.

    1. IPv4 ranges: configure the export of IPv4 subnet ranges.

       • Include export IPv4 subnet ranges from spoke to hub: by default, this checkbox is selected and all subnet ranges that use private IPv4 addresses are exported.

         If you don't want to export IPv4 subnet ranges, clear this checkbox.

         If you only want to export specific IPv4 subnet ranges, select Specify IPv4 ranges and enter the address ranges that you want to export. The IPv4 subnet ranges that you specify must be private IPv4 address ranges, excluding privately used public IPv4 addresses. For more information, see Valid IPv4 ranges.

       • Exclude export IPv4 subnet ranges from spoke to hub: if the spoke exports subnet ranges and you want to exclude specific ranges from export, enter those ranges in this field.

    2. IPv6 ranges: configure the export of IPv6 subnet ranges (internal and external).

       • Include export all IPv6 subnet ranges from spoke to hub: to export all IPv6 subnet ranges to the hub, select the checkbox.

         If you only want to export specific IPv6 subnet ranges, select Specify IPv6 ranges and enter the address ranges that you want to export.

       • Exclude export IPv6 subnet ranges from spoke to hub: if the spoke exports subnet ranges and you want to exclude specific ranges from export, enter those ranges in this field.

11. Click Done.

12. If you want to add more spokes, click Add spoke and begin the process again, starting with entering a Spoke name.

13. When you have finished adding spokes, click Create. The NCC page updates to show details about the spokes that you created.

gcloud

To create a VPC spoke, use the gcloud network-connectivity spokes linked-vpc-network create command.

gcloud network-connectivity spokes linked-vpc-network create SPOKE_NAME \
    --hub=HUB \
    --description=DESCRIPTION \
    --vpc-network=VPC_URI \
    --include-export-ranges=[INCLUDE_EXPORT_RANGES] \
    --exclude-export-ranges=[EXCLUDE_EXPORT_RANGES] \
    --global \
    --group=GROUP_NAME

Replace the following:

• SPOKE_NAME: the name of the spoke that you are creating, such as vpc-spoke1
• HUB: the hub for the spoke
• DESCRIPTION: an optional description of the spoke
• VPC_URI: the VPC network that this spoke points to

• INCLUDE_EXPORT_RANGES: a comma-delimited list of keywords, IP address ranges, or a combination of keywords and IP address ranges that define which subnet IP address ranges can be exported to the hub.

  • The ALL_PRIVATE_IPV4_RANGES keyword adds all subnet ranges that use private IPv4 addresses to the include export range list.

  • The ALL_IPV4_RANGES keyword includes all IPv4 addresses, equivalent to the 0.0.0.0/0 CIDR. All valid IPv4 ranges for subnet ranges, including privately used public IPv4 address ranges, are included. You can refine the list by using the --exclude-export-ranges flag.

  • The ALL_IPV6_RANGES keyword includes all IPv6 addresses, equivalent to the ::/0 CIDR.

  • The include export ranges support up to 16 unique, nonoverlapping CIDRs. No CIDR in the include export ranges can match or contain another CIDR.

  • If you omit --include-export-ranges for a VPC spoke, the default include export ranges is the same as if you had specified ALL_PRIVATE_IPV4_RANGES.

  • Subnet ranges in the VPC spoke, its include export ranges, and its exclude export ranges must follow the Export filter rules for VPC spokes.

• EXCLUDE_EXPORT_RANGES: a comma-delimited list of IP address ranges that define which subnet IP address ranges are never exported to the hub.

  • The exclude export ranges support up to 16 unique, nonoverlapping CIDRs. No CIDR in the exclude export ranges can match or contain another CIDR.

  • Every CIDR specified in the exclude export ranges must expand to IP addresses that are fully contained by CIDRs or keywords in the include export ranges (or the default include export ranges, if you don't specify any include export ranges explicitly).

  • Exclude export ranges don't support keywords.

  • If you omit --exclude-export-ranges, NCC uses an empty list as the default exclude export ranges.

  • Subnet ranges in the VPC spoke, its include export ranges, and its exclude export ranges must follow the Export filter rules for VPC spokes.

• GROUP_NAME: the group that this spoke belongs to. Supported values are:

  • Default for a mesh topology hub
  • Center or edge for a star topology hub. This field is required for spoke groups that use star topology
  • Prod, non-prod, or services for a hub that uses the hybrid inspection topology (only for NCC Gateway spokes)

  For detailed information about spoke groups, see Spoke groups.

API

To create a VPC spoke, use the projects.locations.spokes.create method.

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/spokes/SPOKE_NAME
  {
    "hub":"HUB_NAME",
    "linkedVpcNetwork": {
       "uri": VPC_URI,
       "include_export_ranges": "[INCLUDE_EXPORT_RANGES]",
       "exclude_export_ranges": "[EXCLUDE_EXPORT_RANGES]",
       "group": "GROUP_NAME"
    },
  }

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the new spoke.
• SPOKE_NAME: the name of the new spoke.
• HUB_NAME: the name of the hub that you are attaching the spoke to.
• VPC_URI: The VPC network that this spoke points to, such as vpc_uri.

• INCLUDE_EXPORT_RANGES: a comma-delimited list of keywords, IP address ranges, or a combination of keywords and IP address ranges that define which subnet IP address ranges can be exported to the hub.

  • The ALL_PRIVATE_IPV4_RANGES keyword adds all subnet ranges that use private IPv4 addresses to the include export range list.

  • The ALL_IPV4_RANGES keyword includes all IPv4 addresses, equivalent to the 0.0.0.0/0 CIDR. All valid IPv4 ranges for subnet ranges, including privately used public IPv4 address ranges, are included. You can refine the list by using the --exclude-export-ranges flag.

  • The ALL_IPV6_RANGES keyword includes all IPv6 addresses, equivalent to the ::/0 CIDR.

  • The include export ranges support up to 16 unique, nonoverlapping CIDRs. No CIDR in the include export ranges can match or contain another CIDR.

  • If you omit include_export_ranges for a VPC spoke, the default include export ranges is the same as if you had specified ALL_PRIVATE_IPV4_RANGES.

  • Subnet ranges in the VPC spoke, its include export ranges, and its exclude export ranges must follow the Export filter rules for VPC spokes.

• EXCLUDE_EXPORT_RANGES: a comma-delimited list of IP address ranges that define which subnet IP address ranges are never exported to the hub.

  • The exclude export ranges support up to 16 unique, nonoverlapping CIDRs. No CIDR in the exclude export ranges can match or contain another CIDR.

  • Every CIDR specified in the exclude export ranges must expand to IP addresses that are fully contained by CIDRs or keywords in the include export ranges (or the default include export ranges, if you don't specify any include export ranges explicitly).

  • Exclude export ranges don't support keywords.

  • If you omit exclude_export_ranges, NCC uses an empty list as the default exclude export ranges.

  • Subnet ranges in the VPC spoke, its include export ranges, and its exclude export ranges must follow the Export filter rules for VPC spokes.

• GROUP_NAME: the group that this spoke belongs to. Supported values are:

  • Default for a mesh topology hub
  • Center or edge for a star topology hub. This field is required for spoke groups that use star topology
  • Prod, non-prod, or services for a hub that uses the hybrid inspection topology (only for NCC Gateway spokes)

  For detailed information about spoke groups, see Spoke groups.