Hands-on Lab — PCNE Google Cloud Professional Cloud Network Engineer

Overview

Prerequisites

Steps

1. 1.Provider, project services, naming

   Enable Compute, DNS, and Logging APIs.

   Copy

   terraform {
     required_version = ">= 1.5"
   
     required_providers {
       google = { source = "hashicorp/google", version = "~> 6.0" }
     }
   }
   
   provider "google" {
     project = "your-project-id" # REPLACE
     region  = "us-central1"
   }
   
   locals {
     labels = {
       project    = "certlabpro-pcne"
       managed_by = "terraform"
     }
   }
   
   resource "google_project_service" "compute" {
     service            = "compute.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "dns" {
     service            = "dns.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "logging" {
     service            = "logging.googleapis.com"
     disable_on_destroy = false
   }

2. 2.Enable Shared VPC host-project mode + carve a regional subnet

   Provisions:

   • VPC
   • Shared VPC

   Shared VPC is the PCNE-canonical multi-project networking pattern — one host project owns the VPC, multiple service projects consume it via attachments. Workloads in service projects get IPs from the host VPC's subnets without the host project owning the workload-tier resources. PCNE exam tests this host vs service separation as the load-bearing scale pattern.

   We enable host-project mode on the current project (google_compute_shared_vpc_host_project), then carve a /20 subnet with Private Google Access enabled (lets VMs without external IPs reach *.googleapis.com) and VPC Flow Logs turned on.

   Copy

   data "google_project" "current" {}
   
   resource "google_compute_shared_vpc_host_project" "host" {
     project = data.google_project.current.project_id
   
     depends_on = [google_project_service.compute]
   }
   
   resource "google_compute_network" "main" {
     name                    = "certlabpro-pcne-vpc"
     auto_create_subnetworks = false
     routing_mode            = "REGIONAL"
   
     depends_on = [google_project_service.compute]
   }
   
   resource "google_compute_subnetwork" "main" {
     name                     = "certlabpro-pcne-subnet"
     ip_cidr_range            = "10.10.0.0/20"
     region                   = "us-central1"
     network                  = google_compute_network.main.id
     private_ip_google_access = true
   
     log_config {
       aggregation_interval = "INTERVAL_5_SEC"
       flow_sampling        = 0.5
       metadata             = "INCLUDE_ALL_METADATA"
     }
   }

3. 3.Add Cloud Router + Cloud NAT for outbound-only egress

   Provisions:

   • Cloud NAT
   • Cloud Router

   Cloud NAT gives subnets outbound internet access without per-VM external IPs — the PCNE-canonical private-by-default egress pattern. The shape: a Cloud Router is the BGP control-plane primitive (used by NAT, VPN, Interconnect); a Cloud NAT attaches to it and provides the data plane.

   We enable NAT with AUTO_ONLY NAT IP allocation (Google picks the addresses; production deployments pin to specific reserved IPs for upstream firewall allowlists). Logging on errors only — full-log mode generates substantial Cloud Logging volume.

   Copy

   resource "google_compute_router" "nat_router" {
     name    = "certlabpro-pcne-router"
     region  = "us-central1"
     network = google_compute_network.main.id
   }
   
   resource "google_compute_router_nat" "nat" {
     name                               = "certlabpro-pcne-nat"
     router                             = google_compute_router.nat_router.name
     region                             = "us-central1"
     nat_ip_allocate_option             = "AUTO_ONLY"
     source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
   
     subnetwork {
       name                    = google_compute_subnetwork.main.id
       source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
     }
   
     log_config {
       enable = true
       filter = "ERRORS_ONLY"
     }
   }

4. 4.Add two firewall rules (internal + IAP SSH)

   Provisions:

   • VPC

   PCNE-recommended firewall posture: default-deny ingress (GCP's default), allow only what's necessary. We add internal allow-all (any TCP / UDP / ICMP between VMs in the subnet) + IAP SSH allow (TCP/22 from Google's IAP gateway range, so VMs without public IPs are still SSH-reachable via gcloud compute ssh --tunnel-through-iap).

   This is the same two-rule pattern as the ACE lab — PCNE deepens it with firewall policies at org / folder scope (hierarchical firewalls that compose with project-level rules; out of scope here).

   Copy

   resource "google_compute_firewall" "allow_internal" {
     name      = "certlabpro-pcne-allow-internal"
     network   = google_compute_network.main.name
     direction = "INGRESS"
   
     source_ranges = ["10.10.0.0/20"]
   
     allow {
       protocol = "tcp"
     }
     allow {
       protocol = "udp"
     }
     allow {
       protocol = "icmp"
     }
   }
   
   resource "google_compute_firewall" "allow_iap_ssh" {
     name      = "certlabpro-pcne-allow-iap-ssh"
     network   = google_compute_network.main.name
     direction = "INGRESS"
   
     source_ranges = ["35.235.240.0/20"]
   
     allow {
       protocol = "tcp"
       ports    = ["22"]
     }
   }

5. 5.Create a Cloud DNS private zone for internal name resolution

   Provisions:

   • Cloud DNS

   PCNE-canonical pattern: internal hostnames resolve via a Cloud DNS private zone attached to the VPC. VMs in the VPC see this zone's records; VMs outside don't. Use case: stable, human-readable hostnames for services (api.internal.acme.com, db.internal.acme.com) that resolve to the VM's private IP.

   We create the zone internal.acme.com + one example A record. Production deployments often pair this with Cloud DNS DNS forwarding for hybrid setups (on-prem DNS queries forward to the cloud zone, and vice versa via inbound server policies). With five blocks in place (provider+APIs, Shared VPC + subnet + flow logs, Cloud NAT, firewalls, Cloud DNS private zone), the PCNE substrate is complete.

   Copy

   resource "google_dns_managed_zone" "internal" {
     name        = "certlabpro-pcne-internal"
     dns_name    = "internal.acme.com."
     description = "PCNE lab private DNS zone"
     visibility  = "private"
   
     private_visibility_config {
       networks {
         network_url = google_compute_network.main.id
       }
     }
   
     labels = local.labels
   
     depends_on = [google_project_service.dns]
   }
   
   resource "google_dns_record_set" "api_example" {
     managed_zone = google_dns_managed_zone.internal.name
     name         = "api.${google_dns_managed_zone.internal.dns_name}"
     type         = "A"
     ttl          = 300
     rrdatas      = ["10.10.0.10"]
   }

Cleanup