🌐 Multiple Network Interfaces (NICs) in GCP

 

🌐 Multiple Network Interfaces (NICs) in GCP

1. What is a Network Interface?

A NIC (Network Interface Card) is the network connection of a VM.

In Google Cloud, every VM starts with a default network interface:

nic0 = primary/default network interface

Normally:

VM
 │
 └── nic0
      │
      ▼
    VPC 1

With multiple NICs:

                 VM
          ┌──────┼──────┐
          │      │      │
        nic0   nic1   nic2
          │      │      │
         VPC1   VPC2   VPC3

So one VM can directly connect to multiple VPC networks.

2. Why would we need multiple NICs?

A common reason is traffic separation.

For example, a company may want to separate:

  • Management/control-plane traffic
  • Application/data-plane traffic

Example:

                 VM
          ┌──────┴──────┐
          │             │
       nic0           nic1
          │             │
   Management VPC    Application VPC
          │             │
      On-premises     Users/apps

This allows different traffic paths and security controls.

3. Important: VPCs are isolated by default

Different VPC networks are separate/isolated networking domains.

For example:

VPC 1                    VPC 2
 ┌─────┐                  ┌─────┐
 │ VM1 │                  │ VM2 │
 └─────┘                  └─────┘

VM1 and VM2 cannot simply communicate using their internal IP addresses just because they are in the same Google Cloud project.

You need a mechanism such as:

  • VPC Peering
  • VPN
  • Other appropriate connectivity mechanisms

4. Multiple NICs solve a different problem

Suppose you have a special VM acting as a network appliance.

              Network Appliance VM
             ┌────────────────────┐
             │                    │
 VPC1 ───────►│ nic0               │
 VPC2 ───────►│ nic1               │
 VPC3 ───────►│ nic2               │
 Internet ───►│ nic3               │
 On-prem ────►│ nic4               │
             └────────────────────┘

The VM itself has interfaces connected to different VPCs.

This is useful for things such as:

  • Load balancing
  • IDS — Intrusion Detection System
  • IPS — Intrusion Prevention System
  • WAF — Web Application Firewall
  • Security/network appliances
  • Separating management and application traffic

5. Each NIC connects to a different VPC

This is a very important GCP rule.

When you add NICs:

nic0 → VPC1
nic1 → VPC2
nic2 → VPC3

Each interface must connect to a different VPC network.

You cannot configure:

nic0 → VPC1
nic1 → VPC1   ❌

for the same VM.

Each interface also needs a subnet from that VPC.

6. Each NIC has an internal IP

Every network interface gets an internal IP address.

For example:

VM
│
├── nic0 → 10.10.0.5
├── nic1 → 10.20.0.5
└── nic2 → 10.30.0.5

Each interface can also have an external IP address, when required.

So:

Internal IP = private communication
External IP = communication involving the internet/public networking

7. Subnet ranges must NOT overlap

This is another important rule.

Suppose:

VPC1 → 10.10.0.0/24
VPC2 → 10.20.0.0/24
VPC3 → 10.30.0.0/24

✅ Good — ranges don't overlap.

But:

VPC1 → 10.10.0.0/24
VPC2 → 10.10.0.0/24

❌ Not allowed for the multiple interfaces of the same VM.

Remember:

Multiple NICs → different VPCs → non-overlapping subnet ranges

8. NICs must be configured when creating the VM ⚠️

This is probably the most important lab/exam point.

You must configure the required network interfaces when creating the VM.

You cannot create:

VM
 └── nic0

and later simply add nic1 to the existing VM.

The lesson states that you cannot add or remove a NIC from an instance after the instance is created.

Therefore:

Plan all required NICs before creating the VM.

Also, the additional VPC networks must already exist before you create the VM.

9. You cannot delete an individual NIC

You cannot remove a NIC independently from an existing VM.

To remove that network interface, you would need to delete the VM.

So planning is important.

10. Internal DNS has an important caveat

This is a slightly tricky concept.

Every VM has a primary interface:

nic0

When the VM's hostname is used in an internal DNS query, it resolves to the VM's primary NIC (nic0).

Example:

VM
├── nic0 → VPC1
├── nic1 → VPC2
└── nic2 → VPC3

The VM hostname resolves to the IP associated with:

nic0 → VPC1

Important consequence

If another VM is in VPC2 and tries to resolve this VM's hostname, but the target VM's nic0 is in VPC1, the internal DNS query can fail because the hostname resolution is tied to nic0.

This is one of those lab-specific caveats worth remembering.

11. Maximum number of NICs

The maximum number depends on the VM's machine type.

The general rule from this lesson is:

VM with ≤ 2 vCPUs

Can have up to:

2 NICs

Example machine types mentioned:

  • f1-micro
  • g1-small
  • n1-standard-1
  • Custom VMs with 1–2 vCPUs

VM with > 2 vCPUs

Can have:

1 NIC per vCPU, up to a maximum of 8 NICs

For example:

4 vCPU → up to 4 NICs
6 vCPU → up to 6 NICs
8 vCPU → up to 8 NICs
16 vCPU → maximum 8 NICs

So the simple formula is:

NIC limit = min(number of vCPUs, 8) for VMs with more than 2 vCPUs, while VMs with ≤2 vCPUs are limited to 2 NICs.

🔐 12. Security benefit of multiple NICs

Multiple NICs can help separate traffic.

For example:

                  Security Appliance
                 ┌───────────────────┐
Internet ───────►│ nic0              │
                 │                   │
Public VPC ─────►│ nic1              │
                 │                   │
Private VPC ────►│ nic2              │
                 │                   │
Management ─────►│ nic3              │
                 └───────────────────┘

You can then apply appropriate firewall rules and access controls to the different network paths.

This can help enforce a security boundary between:

Public → Private

and separate:

Management traffic → Application/data traffic

🧠 Easy Real-World Example

Imagine a bank has a web application.

It has:

                 Internet
                    │
                    ▼
              Security Appliance
              ┌─────┼─────┐
              │     │     │
            nic0  nic1   nic2
              │     │     │
           Internet App   Mgmt
            VPC     VPC    VPC
                           │
                           ▼
                      On-premises

The same VM/security appliance has connections to multiple networks.

This lets the organization control how traffic moves between these environments.

⭐ Final Revision Notes

ConceptRemember
NICNetwork interface of a VM
nic0Primary/default interface
Multiple NICsOne VM can connect directly to multiple VPCs
Different VPCsEach NIC must connect to a different VPC
SubnetsIP ranges must not overlap
Internal IPEvery NIC has one
External IPA NIC can also have one
NIC creationConfigure when creating the VM
Add/remove NIC later❌ Not supported
Additional VPCsMust exist before VM creation
NIC deletionRequires deleting the VM
Hostname DNSResolves to nic0
Common useNetwork/security appliance
Security useSeparate management/data traffic
Max NICsUp to 8, depending on machine type

🔑 One-line memory trick

Multiple NICs = One VM connected to multiple VPCs, with each NIC in a different VPC, using non-overlapping subnet ranges, configured at VM creation time.

Comments

Post a Comment

Popular posts from this blog

Async/await

  Async/await An async function is a function declared with the async keyword, and the await keyword is permitted within them. The async and await keywords enable asynchronous, promise-based behavior to be written in a cleaner style, avoiding the need to explicitly configure promise chains. "async and await make promises easier to write" async  makes a function return a Promise await  makes a function wait for a Promise  Async functions Let’s start with the async keyword. It can be placed before a function, like this: async function f() {   return 1; } The word “async” before a function means one simple thing: a function always returns a promise. Other values are wrapped in a resolved promise automatically. For instance, this function returns a resolved promise with the result of 1; let’s test it: async function f() {   return 1; } f().then(alert); // 1 …We could explicitly return a promise, which would be the same: async function f() {   return Promis...
Read more

First negative in every window of size k

 Given an array arr[]  and a positive integer k, find the first negative integer for each and every window(contiguous subarray) of size k. Note: If a window does not contain a negative integer, then return 0 for that window. Examples: Input: arr[] = [-8, 2, 3, -6, 10] , k = 2 Output: [-8, 0, -6, -6] Explanation: Window [-8, 2] First negative integer is -8. Window [2, 3] No negative integers, output is 0. Window [3, -6] First negative integer is -6. Window [-6, 10] First negative integer is -6. Input: arr[] = [12, -1, -7, 8, -15, 30, 16, 28] , k = 3 Output: [-1, -1, -7, -15, -15, 0]  Explanation: Window [12, -1, -7] First negative integer is -1. Window [-1, -7, 8] First negative integer is -1. Window [-7, 8, -15] First negative integer is -7. Window [8, -15, 30] First negative integer is -15. Window [-15, 30, 16] First negative integer is -15. Window [30, 16, 28] No negative integers, output is 0. Input: arr[] = [12, 1, 3, 5] , k = 3 Output: [0, 0]  Explanation: Windo...
Read more

Valid Parentheses

Given a string s containing just the characters '(', ')', '{', '}', '[' and ']', determine if the input string is valid. An input string is valid if: Open brackets must be closed by the same type of brackets. Open brackets must be closed in the correct order. Every close bracket has a corresponding open bracket of the same type.   Example 1: Input: s = "()" Output: true Example 2: Input: s = "()[]{}" Output: true Example 3: Input: s = "(]" Output: false Example 4: Input: s = "([])" Output: true   Stack-Based Logic: Traverse each character in the string. If it's an opening bracket ( '(' , '{' , '[' ), push it onto the stack. If it's a closing bracket ( ')' , '}' , ']' ): If the stack is empty , return false (nothing to match). If the top of the stack is the corresponding opening bracket , pop it. Otherwise, return false . ...
Read more