PBR, BFD & Direct VPC Egress

There is a level of Google Cloud networking that most documentation glosses over. These are the features that only matter when your architecture is complex enough to need them—when standard routing is not flexible enough, when BGP convergence is too slow, and when your serverless workloads need to break out of their sandboxed environment. Policy-Based Routing, Bidirectional Forwarding Detection, and Direct VPC Egress are the tools that solve these edge cases.

Policy-Based Routing (PBR)

Standard routing in Google Cloud is destination-based: a packet’s next hop is determined entirely by its destination IP. But sometimes you need to route based on something other than the destination. Maybe you want to send all traffic from a specific source subnet through an inspection appliance, or route traffic to a different next hop based on the protocol.

Policy-Based Routing allows you to create rules that match traffic based on:

  1. Source IP range.
  2. Destination IP range.
  3. IP protocol (TCP, UDP, ICMP).
  4. The route then sends matching traffic to a specific next hop Internal Load Balancer or drops it entirely.
Use Case: Traffic Inspection

You have a compliance requirement that all traffic from the “Finance” subnet must pass through a Palo Alto firewall VM before reaching any destination. Standard routes cannot distinguish traffic by source. PBR can:

  • Match: Source 10.1.0.0/24 (Finance subnet), Destination 0.0.0.0/0 (any).
  • Action: Next hop = Internal Load Balancer fronting the firewall VMs.

PBR acts on traffic before standard routing. If a PBR rule matches, the standard route table is bypassed for that packet.

Bidirectional Forwarding Detection (BFD)

BGP is reliable but slow to detect failures. By default, if a BGP peer goes down, it can take up to 90 seconds (three missed keepalives at 30-second intervals) for the session to be declared dead. In production, 90 seconds of packet loss is unacceptable.

BFD is a lightweight protocol that runs alongside BGP and detects link failures in milliseconds, not minutes.

  1. BFD sends tiny probe packets at high frequency (e.g., every 300ms).
  2. If three consecutive probes are missed, BFD declares the link dead.
  3. BFD immediately notifies BGP to tear down the session and reroute traffic.
Configuration in Cloud Router

You enable BFD on a BGP peer within your Cloud Router configuration:

  1. Set the minimum transmit interval (e.g., 1000ms).
  2. Set the minimum receive interval (e.g., 1000ms).
  3. Set the multiplier (e.g., 3). If 3 consecutive intervals pass without a probe, the session is torn down.
When to Use
  1. HA VPN with aggressive SLAs: You need sub-second failover between tunnels.
  2. Interconnect: Detect physical link failures faster than BGP alone.
  3. NCC with Router Appliances: Ensure third-party NVAs are detected as down immediately.
Direct VPC Egress for Cloud Run

By default, Cloud Run services run in a Google-managed environment that is isolated from your VPC. If a Cloud Run service needs to connect to resources inside your VPC (like a Cloud SQL instance on a private IP), you traditionally used a Serverless VPC Access Connector—a managed group of small VMs that bridge the gap.

Direct VPC Egress eliminates that connector. Cloud Run instances are placed directly into your VPC subnet, with their own IP addresses from your subnet’s range.

  1. No connector VMs: Fewer resources to manage, no connector scaling limits.
  2. VPC-native addressing: The Cloud Run instance gets an IP from your subnet—it appears as a native VPC citizen.
  3. Firewall integration: Because the instance has a real VPC IP, your existing firewall rules apply to it directly.
Putting it Together: A Pro-Engineer View

Imagine you are running a financial trading platform on Google Cloud. Compliance requires that all traffic from your trading engine subnet passes through an inline firewall. You deploy PBR to route that traffic through an Internal LB fronting a pair of Palo Alto VMs. Your HA VPN to the exchange’s colocation facility uses BFD with a 300ms interval—ensuring sub-second failover if a tunnel drops. And your real-time pricing API runs on Cloud Run with Direct VPC Egress, connecting to your Market Data database on a private IP without any Serverless VPC Access Connector bottleneck. Three expert-level features. Three specific problems. Zero compromise.

Related Posts