Create and manage VPC networks

This document describes how to create, modify, and delete Virtual Private Cloud (VPC) networks and subnetworks. Before reading this document, ensure that you are familiar with the characteristics of VPC networks as described in VPC networks. Networks and subnets are different resources in Google Cloud.

If you plan to enable IPv6 ranges on subnets, see IPv6 subnet ranges.

Try it for yourself

If you're new to Google Cloud, create an account to evaluate how VPC performs in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

Try VPC free

Create networks

You can choose to create an auto mode or custom mode VPC network. Each new network that you create must have a unique name within the same project.

You can optionally create your network using a network profile provided by Google Cloud for a specific use case. You only need to configure a network profile if you want to run AI Hypercomputer workloads that require RDMA NICs. For more information, see RDMA network profiles.

Create an auto mode VPC network

When you create an auto mode VPC network, one subnet is created in each Google Cloud region. As new regions become available, new subnets in those regions are automatically added to the auto mode VPC network. IPv4 ranges for the automatically created subnets come from a predetermined set of ranges. All auto mode VPC networks use the same set of IPv4 ranges.

Subnets with IPv6 address ranges are not supported on auto mode VPC networks. Create a custom mode VPC network if you want to create subnets with IPv6 address ranges.

To create an auto mode VPC network, follow these steps.

Console

  1. In the Google Cloud console, go to the VPC networks page.

    Go to VPC networks

  2. Click Create VPC network.

  3. Enter a Name for the network.

  4. To configure the maximum transmission unit (MTU) of the network, do the following:

    • To use the default value of 1460, keep the Set MTU automatically checkbox selected.
    • To set a custom value, do the following:
      1. Review the information in Maximum transmission unit.
      2. Clear the Set MTU automatically checkbox.
      3. In the Maximum transmission unit (MTU) field, choose an MTU value.

  5. Choose Automatic for the Subnet creation mode.

  6. In the Firewall rules section, select zero or more predefined firewall rules. The rules address common use cases for connectivity to instances.

    Whether or not you select pre-defined rules, you can create your own firewall rules after you create the network.

    Each predefined rule name starts with the name of the VPC network that you are creating, NETWORK. In the IPv4 firewall rules tab, the predefined ingress firewall rule named NETWORK-allow-custom is editable. By default it specifies the source range 10.128.0.0/9, which contains current and future IPv4 ranges for subnets in an auto mode network. The right side of the row that contains the rule, click Edit to select subnets, add additional IPv4 ranges, and specify protocols and ports.

  7. Choose the Dynamic routing mode for the VPC network.

    For more information, see dynamic routing mode. You can change the dynamic routing mode later.

  8. Click Create.

gcloud

Use the networks create command.

gcloud compute networks create NETWORK \
    --subnet-mode=auto \
    --bgp-routing-mode=DYNAMIC_ROUTING_MODE \
    --mtu=MTU

Replace the following:

  • NETWORK: a name for the VPC network.
  • DYNAMIC_ROUTING_MODE: controls the behavior of Cloud Routers in the network. Can be either global or regional. The default is regional. For more information, see dynamic routing mode.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

Terraform

Use the google_compute_network Terraform resource.

MTU is the maximum transmission unit, or largest packet size, of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

resource "google_compute_network" "vpc_network" {
  project                 = var.project_id # Replace this with your project ID in quotes
  name                    = "my-auto-mode-network"
  auto_create_subnetworks = true
  mtu                     = 1460
}

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

API

Make a POST request to the networks.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks
{
  "autoCreateSubnetworks": true,
  "name": "auto-network1",
  "mtu": MTU
}

Replace the following:

  • PROJECT_ID: the ID of the project where the VPC network is created.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

To specify the dynamic routing mode of the VPC network, include the routingConfig field:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks
{
  "routingConfig": {
    "routingMode": "DYNAMIC_ROUTING_MODE"
  },
  "autoCreateSubnetworks": true,
  "name": "NETWORK",
  "mtu": MTU
}

Replace the following:

  • PROJECT_ID: the ID of the project where the VPC network is created.
  • NETWORK: a name for the VPC network.
  • DYNAMIC_ROUTING_MODE: controls the behavior of Cloud Routers in the network. Can be either GLOBAL or REGIONAL. The default is REGIONAL. For more information, see dynamic routing mode.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

Create a custom mode VPC network with IPv4-only subnets

For custom mode VPC networks, create a network, then create the subnets that you want within a region. You do not have to specify subnets for all regions right away, or even at all, but you cannot create instances in a region that has no subnet defined. Finally, define the firewall rules for your network.

Each subnet in a VPC network can have a different configuration; you don't need to configure them all as IPv4-only, for example. You can also change an IPv4-only only subnet to dual-stack later.

To create a custom mode VPC network with IPv4-only subnets, follow these steps.

Console

  1. In the Google Cloud console, go to the VPC networks page.

    Go to VPC networks

  2. Click Create VPC network.

  3. Enter a Name for the network.

  4. To configure the MTU of the network, do the following:

    • To use the default value of 1460, keep the Set MTU automatically checkbox selected.
    • To set a custom value, do the following:
      1. Review the information in Maximum transmission unit.
      2. Clear the Set MTU automatically checkbox.
      3. In the Maximum transmission unit (MTU) field, choose an MTU value.

  5. Choose Custom for the Subnet creation mode.

  6. In the New subnet section, specify the following configuration parameters for a subnet:

    1. Provide a Name for the subnet.
    2. Select a Region.

    3. Enter an IP address range. This is the primary IPv4 range for the subnet.

      If you select a range that is not an RFC 1918 address, confirm that the range doesn't conflict with an existing configuration. For more information, see IPv4 subnet ranges.

    4. To define a secondary range for the subnet, click Create secondary IP range.

      If you select a range that is not an RFC 1918 address, confirm that the range doesn't conflict with an existing configuration. For more information, see IPv4 subnet ranges.

    5. Private Google Access: Choose whether to enable Private Google Access for the subnet when you create it or later by editing it.

    6. Flow logs: Choose whether to enable VPC flow logs for the subnet when you create it or later by editing it.

    7. Click Done.

  7. To add more subnets, click Add subnet and repeat the previous steps. You can also add more subnets to the network after you have created the network.

  8. In the Firewall rules section, select zero or more predefined firewall rules in the IPv4 firewall rules. The rules address common use cases for connectivity to instances.

    If you don't select any predefined rules, you can create your own firewall rules after you create the network.

    Each predefined rule name starts with the name of the VPC network that you are creating, NETWORK. In the IPv4 firewall rules tab, the predefined ingress firewall rule named NETWORK-allow-custom is editable. On the right side of the row that contains the rule, click Edit to select subnets, add additional IPv4 ranges, and specify protocols and ports.

    The NETWORK-allow-custom firewall rule is not automatically updated if you later add additional subnets. If you need firewall rules for the new subnets, you must update the firewall configuration to add the rules.

  9. Choose the Dynamic routing mode for the VPC network.