GCP Network Monitoring & Network Intelligence
- Get link
- X
- Other Apps
GCP Network Monitoring & Network Intelligence
1. Why Network Monitoring?
In a large Google Cloud environment, you may have:
- Multiple VPC networks
- Multiple network interconnections
- Many teams managing different parts of the network
This creates challenges such as:
- Lack of network visibility
- Performance issues
- Network bottlenecks
- Connectivity problems
- Difficulty analyzing network behavior
The goal of network monitoring is to get visibility + detect problems + troubleshoot + prevent outages.
2. Cloud Monitoring
Cloud Monitoring helps you monitor the performance and utilization of your Google Cloud resources.
You can create custom dashboards containing charts for the metrics you care about.
Example metrics
For VM instances, you can monitor:
- CPU utilization
- Packets sent
- Packets received
- Bytes sent
- Bytes received
- Packets dropped by firewall
So, simply:
Cloud Monitoring = See what is happening in your infrastructure.
Dashboard customization
Charts can be customized using:
- Filters → remove unwanted/noisy data
- Groups → reduce the number of time series
- Aggregates → combine multiple time series
Easy example
Suppose you have 100 VMs.
Instead of checking each VM individually, you can create a dashboard showing:
VM CPU Usage Network Bytes Sent Network Bytes Received Dropped Packets
This gives you a centralized view of your environment.
3. Alerting Policies
A dashboard is useful only when someone is looking at it.
For example:
Server problem occurs at 2 AM ↓ Nobody is watching dashboard ↓ Problem remains unnoticed
To solve this, use Alerting Policies.
What is an Alerting Policy?
An alerting policy defines:
When should I be alerted, and how should I be notified?
It can monitor:
- Cloud Monitoring time-series data
- Cloud Logging logs
When the defined condition is met:
Metric/Log ↓ Condition matches ↓ Incident created ↓ Notification sent
Example
Suppose:
VM Network Egress > Threshold for a specific period
Cloud Monitoring can automatically notify you through channels such as:
- SMS
- Other supported notification channels
Key difference
| Feature | Purpose |
|---|---|
| Dashboard | Human looks at metrics |
| Alerting Policy | System tells you when something is wrong |
4. Uptime Checks
Uptime checks are used to test whether a public service is available.
They can test services from locations around the world.
Supported protocols
- HTTP
- HTTPS
- TCP
What can be checked?
According to the source, the resource can include:
- App Engine application
- Compute Engine instance
- Host URL
- AWS instance
- AWS load balancer
You can also create an alerting policy for each uptime check.
The results can show latency from different global locations.
Why uptime checks matter?
They help monitor availability-related:
- SLI — Service Level Indicator
- SLA — Service Level Agreement
- SLO — Service Level Objective
5. Network Intelligence Center
A major problem in networking is misconfiguration.
The source states that many network outages are caused by configuration mistakes, and these mistakes are often discovered only after reaching production.
Examples:
- Incorrect firewall rule
- Incorrect routing rule
- Unexpected configuration change
This makes troubleshooting reactive.
Network Intelligence Center
Network Intelligence Center helps make network monitoring and troubleshooting more proactive.
It provides modules for:
- Network topology
- Connectivity tests
- Performance dashboard
- Firewall Insights
6. Connectivity Tests
Imagine:
VM A ───────────> VM B ❌ Connection
You need to determine:
Is the problem with the source, destination, firewall, route, or somewhere outside Google Cloud?
Connectivity Tests help diagnose connectivity issues.
They can test:
- Connectivity within Google Cloud
- Google Cloud → external IP
- Google Cloud → on-premises environment
- Google Cloud → another cloud
Important capability
You can:
- Create tests
- Save tests
- Run tests
This helps verify the expected impact of configuration changes and check that intended network behavior is not violated.
Simple real-world example
Before changing a firewall rule:
Current configuration ↓ Run Connectivity Test ↓ Change firewall rule ↓ Run test again ↓ Verify connectivity
This supports proactive troubleshooting and can help with security/compliance checks.
7. Performance Dashboard
Sometimes the question is:
"Is my application slow, or is the underlying network slow?"
The Network Intelligence Center Performance Dashboard helps investigate this.
It provides information such as:
- Network performance
- Latency
- Packet loss
- Performance between zones containing VMs
Example
VM in Zone A ↓ Network ↓ VM in Zone B
If packet loss is occurring, the performance dashboard can help identify where the network problem is occurring.
8. Firewall Insights
Firewall configuration can become complicated, especially in large VPC environments.
Firewall Insights helps understand:
Are my firewall rules actually being used as intended?
It provides reports about:
- Firewall rule usage
- Impact of firewall rules
- Traffic behavior
Important requirement
The source specifically says:
Enable firewall rules logging to view the reports.
9. Cloud Monitoring + Firewall Insights
Firewall Insights uses:
- Cloud Monitoring metrics
- Recommender insights
What is a Metric?
Cloud Monitoring collects measurements about applications and system services.
A collection of these measurements is called a metric.
Examples from the source:
- Request latency
- Available disk space
- Number of database tables
- Business measurements such as number of widgets sold
Monitored Resource
The application/system/service being monitored is called a:
Monitored resource
10. Recommender
Recommender provides recommendations and insights for Google Cloud resources.
Its recommendations/insights are generated using:
- Heuristic methods
- Machine learning
- Current resource usage
Important point
Insights and recommendations are related but can be used independently.
Each insight has a specific:
Insight type
An insight type is specific to a particular Google Cloud product and resource type.
11. Firewall Insights Metrics
Firewall Insights metrics are available through:
- Cloud Monitoring
- Google Cloud Console
These metrics are derived from firewall rules logging.
What can you do?
1. Analyze firewall rule usage
Determine whether firewall rules are being used as expected.
2. Track connection behavior
Check whether traffic is being:
Allowed ✅ or Blocked ❌
over a defined period.
3. Diagnose dropped connections
Investigate connections that might be unintentionally blocked.
4. Identify potential threats
Look for unusual/anomalous firewall rule hit counts that could indicate potentially malicious network activity.
12. Network Analyzer
Network Analyzer automatically examines your VPC network configuration.
Its purpose is to detect:
- Misconfigurations
- Suboptimal configurations
- Network failures
It provides insights about:
- Network topology
- Firewall rules
- Routes
- Configuration dependencies
- Connectivity to services/applications
Important feature
Network Analyzer runs continuously and performs analysis based on near-real-time configuration changes.
13. Network Analyzer — Root Cause Analysis
One of the most useful capabilities is identifying the possible root cause of a network failure.
It can correlate a failure with recent configuration changes and, when possible, provide recommendations for fixing the issue.
Example from the source
Problem:
GKE Node ↓ ❌ Cannot connect ↓ GKE Control Plane
Network Analyzer generates an insight.
Root cause
An ingress firewall rule is blocking the connection between:
GKE Node → Control Plane
The source explains that this can indicate that default firewall rules were:
- Modified
- Removed
- Shadowed by another firewall rule
Possible solution
If a required firewall rule was deleted:
Create a new firewall rule
If another rule is shadowing the required rule:
Review / increase the appropriate rule priority
The source also mentions using Gemini when you're unsure where to find a particular performance metric.
14. Gemini for Network Monitoring
Gemini can help you find information in Google Cloud.
Example question:
"How can I find the average latency between my VMs in US East 4 and US Central 1?"
Gemini can assist with identifying:
- Relevant dashboard
- Purpose of the dashboard
- Where to find the required metric
⭐ Most Important Concepts to Remember
Think of the whole topic like this:
GCP NETWORK MONITORING │ ┌────────────────┼─────────────────┐ ↓ ↓ ↓ Cloud Monitoring Alerting Uptime Checks │ │ │ ↓ ↓ ↓ Metrics Notifications Availability Dashboards Incidents Latency │ ↓ Network Intelligence Center │ ┌──────┼───────────┬──────────────┐ ↓ ↓ ↓ ↓ Topology Connectivity Performance Firewall Tests Dashboard Insights │ ↓ Firewall Metrics │ ↓ Cloud Monitoring
And separately:
VPC Configuration ↓ Network Analyzer ↓ Detect misconfiguration ↓ Find root cause ↓ Possible resolution
Quick Revision Table
| Tool | Main purpose |
|---|---|
| Cloud Monitoring | Monitor metrics and create dashboards |
| Alerting Policies | Automatically notify when conditions are met |
| Uptime Checks | Check service availability from global locations |
| Network Intelligence Center | Centralized network visibility and troubleshooting |
| Connectivity Tests | Diagnose connectivity problems |
| Performance Dashboard | Analyze latency and packet loss |
| Firewall Insights | Understand firewall rule usage and traffic |
| Recommender | Provide resource recommendations and insights |
| Network Analyzer | Detect network misconfigurations and failures |
| Gemini | Help find relevant metrics/dashboards and understand GCP information |
🧠 One-line memory trick
Monitoring = See → Alert → Check → Diagnose → Analyze → Prevent
- See → Cloud Monitoring
- Alert → Alerting Policies
- Check availability → Uptime Checks
- Diagnose connectivity → Connectivity Tests
- Analyze performance → Performance Dashboard
- Analyze firewall → Firewall Insights
- Detect configuration problems → Network Analyzer
- Get recommendations → Recommender
- Get help finding metrics → Gemini
These notes cover the complete content of the uploaded module without adding outside concepts
- Get link
- X
- Other Apps
Comments
Post a Comment