As part of the NCC Gateway setup process, you must complete
several tasks. Depending on your configuration, the way that you complete these
tasks can vary significantly. The following set up instructions use a four
spoke group
network topology.
Set up NCC Gateway
The tasks to set up NCC Gateway include the following:
You first create a Network Connectivity Center hub to which you can attach
NCC Gateway spokes. The hub must use the
preset hybrid inspection topology.
Then, connect application Virtual Private Cloud (VPC) networks to the hub and
group them based on the hybrid inspection preset topology.
Your Google Cloud and on-premises environment or other cloud
environments must be connected through hybrid connectivity
by using Cloud Interconnect VLAN attachments with
Cloud Router.
Each NCC Gateway advertised route that you create is installed
in the route table of the Network Connectivity Center hub to which the
NCC Gateway spoke is connected. The NCC Gateway
gateway itself is the next hop for each route that it advertises.
Add regions
If you want to add NCC Gateway spokes and hybrid connections in other
regions, repeat steps 2-5 in the NCC Gateway setup. Adding more
connections is optional.
Manage NCC Gateway
After you have configured NCC Gateway, you can manage the
gateway. See the following resources for instructions.
You can't change the NCC Gateway linked with the
Cloud Router. However, you can change the custom route advertisements.
For detailed information about Cloud Router advertised routes, see
Advertised routes.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["# NCC Gateway setup overview\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis page gives you an overview of the steps required to set up NCC Gateway.\n\nBefore you begin the setup process for NCC Gateway, familiarize\nyourself with the following resources:\n\n- [Network Connectivity Center overview](/network-connectivity/docs/network-connectivity-center/concepts/overview)\n\n- [NCC Gateway overview](/network-connectivity/docs/network-connectivity-center/concepts/ncc-gateway-overview)\n\nAs part of the NCC Gateway setup process, you must complete\nseveral tasks. Depending on your configuration, the way that you complete these\ntasks can vary significantly. The following set up instructions use a four\n[spoke group](/network-connectivity/docs/network-connectivity-center/concepts/connectivity-topologies#hybrid-inspection-spoke-groups)\nnetwork topology.\n\nSet up NCC Gateway\n------------------\n\nThe tasks to set up NCC Gateway include the following:\n\n1. [Create a hub and connect it to a VPC network](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/create-hub-and-vpc)\n\n You first create a Network Connectivity Center hub to which you can attach\n NCC Gateway spokes. The hub must use the\n preset [hybrid inspection topology](/network-connectivity/docs/network-connectivity-center/concepts/connectivity-topologies).\n Then, connect application Virtual Private Cloud (VPC) networks to the hub and\n group them based on the hybrid inspection preset topology.\n2. [Create an NCC Gateway spoke](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/connect-spoke)\n\n You must create an [NCC Gateway spoke](/network-connectivity/docs/network-connectivity-center/concepts/overview#gateway-spokes)\n and attach it to the hub that you created.\n3. [Connect the Secure Access Connect attachment to NCC Gateway](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/connect-sac)\n\n The Secure Access Connect attachment lets you connect\n NCC Gateway with third-party Security Service Edge (SSE)\n products.\n\n NCC Gateway supports connections to the following SSE products:\n - [Symantec Cloud Secure Web Gateway (Cloud SWG)](https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/cloud-swg/help/conn-matrix/adm_addlocation_st/express-connect.html)\n - [Palo Alto Networks Prisma Access](https://docs.paloaltonetworks.com/prisma-access/integration/ncc-gateway-integration-in-prisma-access)\n\n To complete this step, you must already have an account with the provider.\n4. [Add hybrid connections to the NCC Gateway spoke](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/add-hybrid-connections)\n\n Your Google Cloud and on-premises environment or other cloud\n environments must be connected through [hybrid connectivity](https://cloud.google.com/hybrid-connectivity)\n by using Cloud Interconnect VLAN attachments with\n Cloud Router.\n5. [Create and manage NCC Gateway advertised routes](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/create-manage-advertised-routes)\n\n Each NCC Gateway advertised route that you create is installed\n in the route table of the Network Connectivity Center hub to which the\n NCC Gateway spoke is connected. The NCC Gateway\n gateway itself is the next hop for each route that it advertises.\n\n### Add regions\n\nIf you want to add NCC Gateway spokes and hybrid connections in other\nregions, repeat steps 2-5 in the NCC Gateway setup. Adding more\nconnections is optional.\n\nManage NCC Gateway\n------------------\n\nAfter you have configured NCC Gateway, you can manage the\ngateway. See the following resources for instructions.\n\n#### Hubs\n\n- [Update the hub](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#update_a_hub)\n- [Delete the hub](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#deleting-a-hub)\n\n#### Spokes\n\n- [Update the NCC Gateway spoke's capacity](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#update-gateway-spoke-capacity)\n\n#### Advertised routes\n\n- [Create and manage NCC Gateway advertised routes](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/create-manage-advertised-routes)\n\n#### Cloud Routers\n\n- [Manage Cloud Routers](/network-connectivity/docs/router/how-to/managing-routers)\n- [View router details](/network-connectivity/docs/router/how-to/viewing-router-details)\n\nYou can't change the NCC Gateway linked with the\nCloud Router. However, you can change the custom route advertisements.\nFor detailed information about Cloud Router advertised routes, see\n[Advertised routes](/network-connectivity/docs/router/concepts/advertised-routes).\n\nWhat's next?\n------------\n\n- To learn about NCC Gateway, see [NCC Gateway overview](/network-connectivity/docs/network-connectivity-center/concepts/ncc-gateway-overview).\n- To learn how to configure NCC Gateway, see [NCC Gateway setup overview](/network-connectivity/docs/network-connectivity-center/how-to/ncc-gateway/setup-overview).\n- To learn how to configure Secure Access Connect, see [Create a realm](/secure-access-connect/docs/create-realms)\n- To find solutions for common issues, see [Troubleshoot Network Connectivity Center](/network-connectivity/docs/network-connectivity-center/support/troubleshooting).\n- To get details about API and gcloud CLI commands, see [APIs and reference](/network-connectivity/docs/network-connectivity-center/apis)."]]
