1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

                     [Shared Services VPC]
                    shared-vpc (10.0.0.0/16)
                   ├─ AD: 10.0.1.0/24
                   ├─ DNS: 10.0.2.0/24  
                   └─ Monitoring: 10.0.3.0/24
                          ↓ VPC Peering
        ┌─────────────────┼─────────────────┐
        ↓                 ↓                 ↓
   [Sales VPC]         [Dev VPC]        [Finance VPC]
sales-vpc           dev-vpc           finance-vpc
(10.1.0.0/16)      (10.2.0.0/16)     (10.3.0.0/16)
     ↓                  ↓                  ↓
VPC Peering        VPC Peering        VPC Peering
     ↓                  ↓                  ↓
[Sales PROD]         [Dev PROD]         [Finance PROD]  
(10.1.0.0/24)      (10.2.0.0/24)      (10.3.0.0/24)
     ↓                  ↓                  ↓
[Sales STAGING]      [Dev STAGING]      [Finance STAGING]
(10.1.1.0/24)      (10.2.1.0/24)      (10.3.1.0/24)
     ↓                  ↓                  ↓
[Sales DEV]          [Dev DEV]          [Finance DEV]
(10.1.2.0/24)      (10.2.2.0/24)      (10.3.2.0/24)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# Shared services VPC
gcloud compute networks create shared-vpc \
    --subnet-mode=custom \
    --project=shared-services

# Create each department VPC
for dept in sales dev finance; do
    gcloud compute networks create ${dept}-vpc \
        --subnet-mode=custom \
        --project=${dept}-project
done

# Create each environment VPC
for dept in sales dev finance; do
    for env in prod staging dev; do
        gcloud compute networks create ${dept}-${env}-vpc \
            --subnet-mode=custom \
            --project=${dept}-${env}-project
    done
done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Shared services → Each department connection
gcloud compute networks peerings create shared-to-sales \
    --network=shared-vpc \
    --peer-project=sales-project \
    --peer-network=sales-vpc

gcloud compute networks peerings create shared-to-dev \
    --network=shared-vpc \
    --peer-project=dev-project \
    --peer-network=dev-vpc

# ... Similarly create 12 more Peerings

1
2
3

WARNING: Peering 'shared-to-sales' created, but route may conflict
WARNING: Multiple routes to 10.0.0.0/16 detected
WARNING: Possible routing loop detected

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# From Sales PROD environment
ping 10.0.1.10
# PING 10.0.1.10: 56 data bytes
# ping: cannot resolve 10.0.1.10: Unknown host

# From Dev PROD environment  
ping 10.0.1.10
# PING 10.0.1.10: 56 data bytes
# ping: sendto: No route to host

# From Finance PROD environment
ping 10.0.1.10
# PING 10.0.1.10: 56 data bytes
# Request timeout for icmp_seq 0

1
2
3
4
5
6
7
8

# Shared services VPC routing table
gcloud compute routes list --project=shared-services

NAME                NETWORK      DEST_RANGE    NEXT_HOP
shared-vpc-route    shared-vpc   10.0.0.0/16   shared-vpc
sales-peer-route    shared-vpc   10.1.0.0/16   peering-sales
dev-peer-route      shared-vpc   10.2.0.0/16   peering-dev  
finance-peer-route  shared-vpc   10.3.0.0/16   peering-finance

1
2
3
4
5
6
7
8

gcloud compute routes list --project=sales-project

NAME                NETWORK      DEST_RANGE    NEXT_HOP
sales-vpc-route     sales-vpc    10.1.0.0/16   sales-vpc
shared-peer-route   sales-vpc    10.0.0.0/16   peering-shared
sales-prod-route    sales-vpc    10.1.0.0/24   peering-prod
sales-stg-route     sales-vpc    10.1.1.0/24   peering-staging  
sales-dev-route     sales-vpc    10.1.2.0/24   peering-dev

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Sales Department:
├─ sales-vpc: 10.1.0.0/16 (Department main)
├─ sales-prod: 10.1.0.0/24 (Production environment)    ← Overlap!
├─ sales-staging: 10.1.1.0/24 (Staging)
└─ sales-dev: 10.1.2.0/24 (Development environment)

Development Department:  
├─ dev-vpc: 10.2.0.0/16 (Department main)
├─ dev-prod: 10.2.0.0/24 (Production environment)      ← Overlap!
├─ dev-staging: 10.2.1.0/24 (Staging)
└─ dev-dev: 10.2.2.0/24 (Development environment)

1
2
3

Sales PROD → Sales VPC → Shared VPC → Dev VPC → Dev PROD
   ↑_________________________↑
   Communication via this route impossible

1
2
3
4

Lost packet route:
10.1.0.10 → sales-vpc → shared-vpc → sales-prod → sales-vpc → ...
                                        ↑__________________|
                                        Endless loop

1
2
3
4
5
6

🚨 Monitoring Alert
Subject: [CRITICAL] Active Directory Authentication Failed
Body: Multiple authentication failures detected
- sales-prod: Cannot reach domain controller
- dev-prod: Authentication timeout  
- finance-prod: LDAP connection failed

1
2
3

Dev Manager: Can't deploy to production system
Dev Manager: Monitoring system also invisible
Dev Manager: What's happening?

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Emergency fix of overlapping IP addresses
# sales-prod: 10.1.0.0/24 → 10.1.10.0/24
gcloud compute networks subnets create sales-prod-new \
    --network=sales-prod-vpc \
    --range=10.1.10.0/24

# dev-prod: 10.2.0.0/24 → 10.2.10.0/24  
gcloud compute networks subnets create dev-prod-new \
    --network=dev-prod-vpc \
    --range=10.2.10.0/24

1
2
3
4

ERROR: Cannot delete subnet 'sales-prod-subnet' 
ERROR: 15 instances still attached to subnet
ERROR: Database instances cannot be moved to different subnet
ERROR: Load balancer configuration requires subnet recreation

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# PSC setup for Active Directory service
gcloud compute service-attachments create ad-service \
    --region=asia-northeast1 \
    --producer-forwarding-rule=ad-forwarding-rule \
    --connection-preference=ACCEPT_AUTOMATIC \
    --nat-subnets=ad-psc-subnet

# PSC setup for DNS service  
gcloud compute service-attachments create dns-service \
    --region=asia-northeast1 \
    --producer-forwarding-rule=dns-forwarding-rule \
    --connection-preference=ACCEPT_AUTOMATIC \
    --nat-subnets=dns-psc-subnet

# PSC setup for monitoring service
gcloud compute service-attachments create monitoring-service \
    --region=asia-northeast1 \
    --producer-forwarding-rule=monitoring-forwarding-rule \
    --connection-preference=ACCEPT_AUTOMATIC \
    --nat-subnets=monitoring-psc-subnet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Sales department connection to AD service
gcloud compute addresses create sales-ad-psc-ip \
    --region=asia-northeast1 \
    --subnet=sales-psc-subnet \
    --project=sales-project

gcloud compute forwarding-rules create sales-ad-endpoint \
    --region=asia-northeast1 \
    --network=sales-vpc \
    --address=sales-ad-psc-ip \
    --target-service-attachment=projects/shared-services/regions/asia-northeast1/serviceAttachments/ad-service \
    --project=sales-project

1
2
3
4
5

# Sales environment to AD connection test
ping 10.1.100.10  # PSC endpoint IP
# PING 10.1.100.10: 56 data bytes  
# 64 bytes from 10.1.100.10: icmp_seq=0 ttl=64 time=2.3 ms
# 64 bytes from 10.1.100.10: icmp_seq=1 ttl=64 time=1.8 ms

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Sales system configuration change
# /etc/ldap/ldap.conf
URI ldap://10.1.100.10/  # Via PSC endpoint
BASE dc=company,dc=local

# Development system configuration change  
# /etc/sssd/sssd.conf
ldap_uri = ldap://10.2.100.10/  # Dev department PSC endpoint

# Finance system configuration change
# application.properties
ldap.server.url=ldap://10.3.100.10/  # Finance department PSC endpoint

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# Sales system verification
systemctl status sales-app
● sales-app.service - Sales Management Application
   Loaded: loaded
   Active: active (running)
   Status: "Connected to AD via PSC endpoint"

# Development system verification  
kubectl get pods -n production
NAME                    READY   STATUS    RESTARTS   AGE
api-server-7d4f8b9c     1/1     Running   0          2h
database-proxy-5c7d9    1/1     Running   0          2h
monitoring-agent-3x8k   1/1     Running   0          2h

1
2
3

Sales Manager: Customer management system normal
Sales Manager: Email & calendar also restored
Sales Manager: Made it in time for today's presentation!

1
2
3

Dev Manager: Both production & staging environments normal  
Dev Manager: CI/CD pipeline restored
Dev Manager: Monitoring system also no problems

1
2
3

Finance Manager: Payroll & accounting systems restored
Finance Manager: Can start month-end closing process
Finance Manager: Thank you for your hard work!

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

Network connection status:
- Connection success rate: 99.98%
- Average response time: 1.2ms (previously 2.5ms)
- Error rate: 0.02% (previously 3.2%)

System operation status:
- Active Directory authentication: 100% success
- DNS resolution: 99.99% success  
- Monitoring system: All metrics normal

Inter-department communication:
- Unnecessary inter-department communication: Completely blocked
- Necessary shared service access: 100% success
- Security policies: Fully applied

1
2
3

× VPC Peering is "easy and universal" connection method
× IP address conflicts are "no problem if VPCs are different"
× Routing is "automatically optimized"

1
2
3

○ VPC Peering is connection method suitable for specific purposes
○ IP address design requires careful consideration of overall picture
○ Routing requires explicit design & management

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Suitable cases:
  - Direct connection within same organization
  - Full mesh connection needed
  - Low latency & high throughput requirements
  - Minimize management costs

Unsuitable cases:
  - Complex hub & spoke topology
  - Service provider/consumer relationship
  - Granular access control requirements
  - IP address conflict environments

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Suitable cases:
  - Service provider/consumer relationship
  - Complex multi-tenant environments
  - IP address conflicts exist
  - Granular access control needed

Unsuitable cases:
  - Simple direct connection
  - Low latency is most important
  - Minimize setup/operation costs
  - No protocol-level control needed

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

## Network Design Validation Checklist

### Design Phase
- [ ] IP address conflict check
- [ ] Routing table design
- [ ] Connectivity matrix creation
- [ ] Security policy definition

### Implementation Phase  
- [ ] Phased construction (VPC by VPC)
- [ ] Connection testing at each phase
- [ ] Load testing & failure testing
- [ ] Rollback procedure confirmation

### Pre-Production Testing
- [ ] All system connection verification
- [ ] Performance measurement
- [ ] Security testing
- [ ] Operations procedure confirmation

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

                [Shared Services VPC]
                 (Service Producer)
                ┌─ AD Service (PSC)
                ├─ DNS Service (PSC)
                └─ Monitor Service (PSC)
                         ↑
                PSC Service Attachment
                         ↑
    ┌─────────────────────┼─────────────────────┐
    ↓                     ↓                     ↓
[Sales VPC]              [Dev VPC]               [Finance VPC]  
PSC Endpoint          PSC Endpoint           PSC Endpoint
├─ AD: 10.1.100.10    ├─ AD: 10.2.100.10    ├─ AD: 10.3.100.10
├─ DNS: 10.1.100.11   ├─ DNS: 10.2.100.11   ├─ DNS: 10.3.100.11
└─ Mon: 10.1.100.12   └─ Mon: 10.2.100.12   └─ Mon: 10.3.100.12

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Network connection requirements
        ↓
┌─ IP address conflicts? ─ YES → Consider PSC
│        ↓ NO
├─ Service provider/consumer? ─ YES → PSC recommended  
│        ↓ NO
├─ Complex control needed? ─ YES → Consider PSC or Proxy
│        ↓ NO  
├─ Ultra-low latency needed? ─ YES → VPC Peering recommended
│        ↓ NO
└─ Simple direct connection? ─ YES → VPC Peering possible

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# IP address overlap check script example
#!/bin/bash
echo "=== IP Address Overlap Check ==="
for vpc in $(gcloud compute networks list --format="value(name)"); do
    echo "VPC: $vpc"
    gcloud compute networks subnets list --network=$vpc \
        --format="table(name,ipCidrRange)" --sort-by=ipCidrRange
    echo ""
done

# Overlap check logic  
python3 check_ip_overlap.py --vpc-list=vpc_list.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Routing table visualization
gcloud compute routes list --format="table(
    name,
    destRange,
    nextHopInstance,
    nextHopVpnTunnel,
    nextHopPeering,
    priority
)" --sort-by=destRange

# Routing loop detection
./detect_routing_loops.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# Connection testing automation (Cloud Build)
steps:
- name: 'gcr.io/cloud-builders/gcloud'
  script: |
    # Reachability testing from each VPC
    for source_vpc in sales-vpc dev-vpc finance-vpc; do
      for target_service in ad-service dns-service; do
        echo "Testing $source_vpc -> $target_service"
        gcloud compute ssh test-vm --zone=asia-northeast1-a \
          --project=${source_vpc}-project \
          --command="nc -zv ${target_service}.internal 389"
      done
    done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

PSC Operations Guidelines:
  Monitoring_Targets:
    - Endpoint connection status
    - Service health
    - Data transfer volume & costs
    
  Alert_Settings:
    - Connection failure rate > 1%
    - Response time > 5 seconds
    - Monthly cost > 80% of budget
    
  Regular_Tasks:
    - Monthly connection status report
    - Quarterly cost optimization review
    - Semi-annual security audit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

## PSC Failure Response Flowchart

### Level 1: Endpoint Failure
1. Switch to other endpoints
2. Contact service provider
3. Notify users of impact scope

### Level 2: Service Provider Failure  
1. Switch to backup service
2. Enable emergency VPC Peering
3. Begin recovery work

### Level 3: Complete Failure
1. Switch back to on-premises environment
2. Execute business continuity plan
3. Request external support