Set up Network Connectivity Center and create a hub

This page describes how to create a Network Connectivity Center hub using the hybrid inspection topology so that you can add NCC Gateway spokes and VPC spokes to the hub.

For an introduction to NCC Gateway, see the NCC Gateway overview.

Before you begin

Before you get started, review the following sections.

Create or select a project

To make it easier to configure Network Connectivity Center, start by identifying a valid project.

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  3. Make sure that billing is enabled for your Google Cloud project.

  4. Install the Google Cloud CLI.

  5. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  6. To initialize the gcloud CLI, run the following command:

    gcloud init
  7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  8. Make sure that billing is enabled for your Google Cloud project.

  9. Install the Google Cloud CLI.

  10. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  11. To initialize the gcloud CLI, run the following command:

    gcloud init
  12. If you are using the Google Cloud CLI, set your project ID by using the gcloud config set command.

    gcloud config set project PROJECT_ID

    Replace PROJECT_ID with your unique project ID.

    The gcloud CLI instructions on this page assume that you have set your project ID.

  13. To confirm that you set the project ID correctly, use the gcloud config list command.

    gcloud config list --format='text(core.project)'

Enable the Network Connectivity API

Before you can perform any tasks using NCC Gateway, you must enable the Network Connectivity API.

Console

To enable the Network Connectivity API, do the following:

  1. In the Google Cloud console, go to the Network Connectivity Center page.

    Go to Network Connectivity Center

  2. Click Enable.

Alternatively, you can enable the API by using the Google Cloud console API Library, as described in Enabling APIs.

Get access

To work with Network Connectivity Center and NCC Gateway, you need the permissions described in Roles and permissions.

Identify resources

When you reference resources by using the gcloud CLI or the API, use the conventions described in the following table.

Convention Supported for Notes Example
Full URI All resources Use one of these methods to reference Router appliance instances.
"https://www.googleapis.com/compute/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME"

      
Relative resource name All resources
"projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME"

    
Name Regional and global resources Use this method for hubs, spokes, VPN tunnels, and VLAN attachments.
 "HUB_NAME"

    

Create a Network Connectivity Center hub

To create a Network Connectivity Center hub with the preset hybrid inspection topology, follow these steps:

gcloud

Use the gcloud network-connectivity hubs create command and specify the hybrid inspection preset topology.

gcloud network-connectivity hubs create HUB_NAME \
    --preset-topology=hybrid-inspection

Replace HUB_NAME with a name for the new hub.

API

Use the projects.locations.global.hubs.create method.

POST https://networkconnectivity.googleapis.com/v1beta/projects/PROJECT_ID/locations/global/hubs
{
  "name":"HUB_NAME",
  "description":"DESCRIPTION",
  "labels": {
    "KEY": "VALUE"
  },
  "presetTopology": "HYBRID_INSPECTION"
}

Replace the following:

  • PROJECT_ID: the project ID of the project that contains the new hub
  • HUB_NAME: the name of the new hub
  • DESCRIPTION: optional text that describes the hub
  • KEY: the key in the key-value pair for the optional label text
  • VALUE: the value in the key-value pair for the optional label text

Connect VPC networks to the hub

The process for connecting VPC networks to a hub differs depending on whether the network and hub are in the same project.

Connect VPC networks and hub from different projects

To connect VPC networks from different projects, use the following steps:

Connect VPC networks and hub in the same project

If the VPC networks and hub are in the same project, you can follow these steps in this section.

gcloud

Use the gcloud network-connectivity spokes linked-vpc-network create command:

gcloud network-connectivity spokes linked-vpc-network create SPOKE_NAME \
    --hub=HUB_NAME \
    --description=DESCRIPTION \
    --vpc-network=VPC_NETWORK_URI \
    --global \
    --group=GROUP_NAME

Replace the following:

  • SPOKE_NAME: the name of the spoke that you are creating, such as vpc-spoke1
  • HUB_NAME: the hub for the spoke
  • DESCRIPTION: an optional description of the spoke
  • VPC_NETWORK_URI: the VPC network that this spoke points to
  • GROUP_NAME: the group that this spoke belongs to

Because the hub uses the hybrid inspection topology, valid group names for VPC spokes are prod, non-prod, and services.

For additional options available when adding a VPC spoke, including details about export filters, see Create a VPC spoke.

API

Use the projects.locations.spokes.create method:

POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/spokes/SPOKE_NAME

{
 "hub":"HUB_NAME",
 "description": "DESCRIPTION",
 "linkedVpcNetwork": {
    "uri": "VPC_NETWORK_URI",
    "include_export_ranges": "[INCLUDE_RANGES]",
    "exclude_export_ranges": "[EXCLUDE_IPV4_RANGES]",
    "group": "GROUP_NAME"
 },
}

Replace the following:

  • SPOKE_NAME: the name of the spoke that you are creating, such as vpc-spoke1
  • HUB_NAME: the hub for the spoke
  • DESCRIPTION: an optional description of the spoke
  • VPC_NETWORK_URI: the VPC network that this spoke points to
  • GROUP_NAME: the group that this spoke belongs to

Because the hub uses the hybrid inspection topology, valid group names for VPC spokes are prod, non-prod, and services.

For additional options available when adding a VPC spoke, including details about export filters, see Create a VPC spoke.