Hybrid Connectivity Part 1: Cloud Interconnect

There comes a point in every enterprise cloud journey where the VPN tunnel stops being enough. Maybe you are migrating petabytes of genomic data, or your trading platform demands sub-millisecond jitter between your on-premises data center and Google Cloud. The public internet, no matter how fast, is unpredictable. It is a shared resource—your packets ride alongside Netflix streams and video game traffic. When your business demands a private, dedicated highway, you turn to Cloud Interconnect.

Cloud Interconnect is not a software feature you enable with a checkbox. It is a physical, fiber optic connection between your data center and Google’s network. Think of it as running a private cable from your building directly into Google’s infrastructure. The packets never touch the public internet. The result is predictable latency, higher bandwidth, and a level of reliability that VPN simply cannot match.

Dedicated vs. Partner: Choosing Your On-Ramp

Google offers two flavors of Interconnect, and the choice between them is one of the most frequently tested topics on the PCNE exam.

Dedicated Interconnect

This is the “I own the cable” option. You physically provision a cross-connect between your router and Google’s router inside a colocation facility (like Equinix or CoreSite).

  1. Capacity: 10 Gbps or 100 Gbps per link.
  2. Requirement: Your equipment must be in the same colocation facility as a Google PoP (Point of Presence).
  3. LOA-CFA: Google provides a Letter of Authorization / Connecting Facility Assignment. You hand this to the colo provider, and they run the cable.
  4. Use Case: You are a large enterprise that moves massive data volumes and needs full control over the physical link.
Partner Interconnect

This is the “I rent bandwidth from someone who already has a cable to Google” option.

  1. Capacity: Starts at 50 Mbps, scales to 50 Gbps.
  2. Requirement: You work with a supported Service Provider (like AT&T, Equinix Fabric, or Megaport).
  3. Use Case: Your office is not in a Google colocation facility, or you don’t need 10 Gbps of dedicated fiber.

The key exam distinction: Dedicated Interconnect gives you the 99.99% SLA with proper topology. Partner Interconnect can also achieve 99.99%, but only if the partner supports it and you deploy redundantly.

The SLA Mathematics

Google’s Interconnect SLA is not automatic. You must architect it.

99.9% SLA (Production)
  1. Deploy two VLAN attachments in a single metropolitan area.
  2. Each attachment connects to a different edge availability domain.
99.99% SLA (Critical)
  1. Deploy four VLAN attachments across two different metropolitan areas.
  2. Each metro has two attachments on separate edge availability domains.
  3. This ensures that even if an entire city loses power, your connectivity survives through the other metro.
VLAN Attachments: The Logical Layer

A physical Interconnect connection is just a pipe. To actually route traffic, you create VLAN Attachments (also called InterconnectAttachments). Each VLAN attachment:

  1. Is associated with a specific Cloud Router.
  2. Establishes a BGP session between your on-premises router and Google’s Cloud Router.
  3. Carries traffic for a specific VPC.

You can create multiple VLAN attachments on the same physical link, each serving a different VPC or project. This is how large organizations share a single expensive Interconnect across teams.

MACsec: Encryption at Layer 2

By default, Interconnect traffic is private but not encrypted. The packets travel over dedicated fiber, so a man-in-the-middle attack is extremely difficult—but not impossible for nation-state actors. For compliance-heavy industries (healthcare, finance), this matters.

MACsec (Media Access Control Security) encrypts traffic at Layer 2, directly on the Interconnect link. It is line-rate encryption—meaning it adds zero latency overhead. You enable it on the Interconnect resource and manage the cryptographic keys through a rotation schedule.

Putting it Together: A Pro-Engineer View

Imagine you are the network architect for a hospital chain that is migrating its medical imaging system to Google Cloud. Compliance mandates encrypted transit. Latency must not exceed 5ms. You provision a Dedicated Interconnect with two links in Chicago and two in Dallas (99.99% SLA). You enable MACsec on all four links. You create VLAN attachments that peer BGP with your on-premises Cisco router. The radiologists in the hospital see zero difference—except the images load faster because Google’s backbone is better than the WAN link they were using before. That is Cloud Interconnect in production.

Related Posts