Work with hubs and spokes

Console

To enable the Network Connectivity API:

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. Click Enable.

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project.

3. Click Create hub.

4. Complete the Basic configuration section of the form:

   1. Enter a Hub name.
   2. Optional: Enter a Description.
   3. Optional: To add a label, click Add Item, and then enter a Key and Value.
   4. Verify that the form displays the correct Project ID. If the project ID is incorrect, select a different project by using the menu at the top of the page.

5. To enable Private Service Connect connection propagation, in the Private Service Connect connection propagation field, click On. This feature (Preview) only applies to VPC spokes.

6. Do one of the following:

   • If you want to create a spoke, click Next step and complete the spoke-creation section of the form. For instructions, see one of the following sections:
     • Create a VPC spoke
     • Create a producer VPC spoke (Preview)
     • Create a Router appliance spoke
     • Create a VLAN attachment spoke
     • Create a VPN spoke
   • If you don't want to create a spoke right now, click Create to finish creating your new hub.

gcloud

To create a hub, use the gcloud network-connectivity hubs create command.

  gcloud network-connectivity hubs create HUB_NAME \
      --description="DESCRIPTION" \
      --labels="KEY"="VALUE"

If you want to enable Private Service Connect propagated connection (Preview) globally for the Network Connectivity Center hub, use the --export-psc flag. This feature only applies to VPC spokes.

  gcloud network-connectivity hubs create HUB_NAME \
      --description="DESCRIPTION" \
      --labels="KEY"="VALUE" \
      [ --export-psc]

Replace the following values:

• HUB_NAME: the name of the new hub
• DESCRIPTION: optional text that describes the hub
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text

API

To create a hub, use the networkconnectivity.hubs.create method.

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs
  {
    "name":"HUB_NAME",
    "description":"DESCRIPTION",
    "labels": {
      "KEY": "VALUE"
    }
  }

If you want to enable Private Service Connect propagated connection (Preview) globally for the Network Connectivity Center hub, set the export-psc value to "true". This feature only applies to VPC spokes. Private Service Connect connection propagation doesn't propagate to on premises networks through hybrid spokes, such as Cloud Interconnect VLAN attachments, HA VPN tunnels, and Router appliance.

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs
  {
    "export_psc": true
  }

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the new hub
• HUB_NAME: the name of the new hub
• DESCRIPTION: optional text that describes the hub
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project.

   The page lists all hubs associated with the project, along with the following information about each hub:

   • The name of the hub
   • The description of the hub
   • Any labels that have been applied to the hub
   • The number of spokes associated with the hub
   • The types of spokes associated with the hub

gcloud

To list the hubs associated with a project, use the gcloud network-connectivity hubs list command.

  gcloud network-connectivity hubs list

The command output includes the name and description of each hub.

API

To list the hubs associated with a project, use the networkconnectivity.hubs.list method.

  GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs

Replace PROJECT_ID with the project ID of the project that contains the hubs to list.

For each hub, this method returns the following details:

• The name of the hub
• A timestamp that shows when the hub was created
• A timestamp of the last update
• Any labels applied to the hub
• The description of the hub, if one exists
• The unique ID of the hub
• The state of the hub
• A list of routingVpcs, which are VPC networks associated with the spokes for the hub

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project to view information about that project's hub.

3. To view details about the hub's spokes, click the Spokes tab.

gcloud

To get detailed information about an existing hub, use the gcloud network-connectivity hubs describe command.

gcloud network-connectivity hubs describe HUB_NAME

Replace HUB_NAME with the name of the hub.

Output from this command includes the following information:

• The time the hub was created
• The hub's description
• Any labels applied to the hub
• The VPC networks (routingVpcs) that are associated with this hub's spoke resources
• The hub's unique identifier
• The time the hub was last updated

If you want information about the spokes attached to a hub, see List spokes and Describe a spoke.

API

To get detailed information about an existing hub, use the networkconnectivity.hubs.get method.

  GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the hubs to describe
• HUB_NAME: the name of the hub to describe

Output from this command includes the following information:

• The time the hub was created
• The hub's description
• Any labels applied to the hub
• The VPC networks (routingVpcs) that are associated with this hub's spoke resources
• The hub's unique identifier
• The time the hub was last updated

The following snippet illustrates a typical response to this API call:

 {
   "name": "projects/myproject/locations/global/hubs/myhub",
   "createTime": "2021-08-29T23:40:25.844970812Z",
   "updateTime": "2021-08-30T04:20:36.738801209Z",
   "labels": {
     "environment": "test"
   },
   "description": "in review",
   "uniqueId": "d6d3e375-4224-4352-a3b6-776042419430",
   "state": "ACTIVE",
   "routingVpcs": [ {
     "uri": "https://www.googleapis.com/compute/v1/projects/myproject/global/networks/myvpcnetwork"
   } ]
 }
 

If you want information about the spokes attached to a hub, see List spokes and Describing a spoke.

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project.

3. Click the name of the hub that you want to modify.

4. On the Hub details page, click editEdit hub.

5. Update the hub description and labels.

6. To enable Private Service Connect connection propagation, click On. To disable Private Service Connect connection propagation, click Off. This feature (Preview) only applies to VPC spokes.

7. Click Save.

gcloud

To update a hub's description or add labels to a hub, use the gcloud network-connectivity hubs update command.

  gcloud network-connectivity hubs update HUB_NAME \
      --description="DESCRIPTION" \
      --update-labels="KEY"="VALUE"

If you want to enable Private Service Connect propagated connection (Preview) globally for the Network Connectivity Center hub, use the --export-psc flag. This feature only applies to VPC spokes.

  gcloud network-connectivity hubs update HUB_NAME \
      --description="DESCRIPTION" \
      --labels="KEY"="VALUE" \
      --export-psc

Replace the following values:

• HUB_NAME: the name of the hub
• DESCRIPTION: an optional new description for the hub
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text

You can disable the Private Service Connect connection propagation feature on existing hubs by using the --no-export-psc flag. Existing propagation connections are removed asynchronously.

To remove one or more labels, use the --remove-labels flag. To remove all labels, use the --clear-labels flag. For more information, see the gcloud network connectivity hubs update command.

API

To update a hub's description or add labels to a hub, use the networkconnectivity.hubs.patch method.

  PATCH https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME
  {
    "description": "DESCRIPTION",
    "labels": {
      "KEY": "VALUE"
    }
  }

If you want to enable Private Service Connect propagated connection (Preview) globally for the Network Connectivity Center hub, set the export-psc value to "true". This feature only applies to VPC spokes.

PATCH https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME
{
 "export_psc": true
}

Replace the following values:

• PROJECT_ID: the ID of the project that contains the hub
• HUB_NAME: the name of the hub
• DESCRIPTION: an optional description of the hub
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text

You can disable the Private Service Connect connection propagation feature on an existing hub by setting the export_psc value to "false". Existing propagation connections are removed asynchronously.

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project.

3. Click deleteDelete hub.

4. In the confirmation dialog, do one of the following:

   • Click Cancel if you don't want to delete the hub.
   • Click Delete to delete the hub.

gcloud

To delete a hub, use the gcloud network-connectivity hubs delete command.

  gcloud network-connectivity hubs delete HUB_NAME

Replace HUB_NAME with the name of the hub.

API

To delete a hub, use the networkconnectivity.hubs.delete method.

  DELETE https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the hub to delete
• HUB_NAME: the name of the hub to delete

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project in which you want to create the spoke.

3. Click the Spokes tab.

4. Click Add spokes.

5. In the Select hub section, select the hub location as follows:

   • To attach the new spoke to a hub in the same project, select In project PROJECT_NAME and select the hub name from the list.
   • If you want to attach the new spoke to a hub in another project, select In another project. Enter the Project ID and the Hub name to which you want to attach your new spoke.

   When you choose a hub in a different project, your spoke becomes active only when the hub administrator reviews and accepts your proposed spoke. For more details about creating spokes attached to a hub in a different project, see VPC spokes overview. If you are creating a VPC spoke in the same project as the hub, it is automatically accepted and activated.

6. Enter a Spoke name and optionally, a Description.

7. If the hub that you are connecting to is configured for star topology, select the Spoke group for your spoke. For detailed information about spoke groups, see Spoke groups.

8. Select VPC network as the Spoke type.

9. To add a VPC network to the spoke, select one from the Associated VPC network list.

10. Optional: add a VPC spoke filter to customize how routes are advertised by specifying IP address ranges to exclude or include export from the spoke to the hub. You can configure the spoke to export only subnet ranges that use private IPv4 addresses, only IPv6 subnet ranges (internal and external), or both subnet ranges that use private IPv4 addresses and internal and external IPv6 subnet ranges.

    1. IPv4 ranges: configure the export of IPv4 subnet ranges.

       • Include export IPv4 subnet ranges from spoke to hub: by default, this checkbox is selected and all subnet ranges that use private IPv4 addresses are exported.

         If you don't want to export IPv4 subnet ranges, clear this checkbox.

         If you only want to export specific IPv4 subnet ranges, select Specify IPv4 ranges and enter the address ranges that you want to export. The IPv4 subnet ranges that you specify must be private IPv4 address ranges, excluding privately used public IPv4 addresses. For more information, see Valid IPv4 ranges.

       • Exclude export IPv4 subnet ranges from spoke to hub: if the spoke exports IPv4 subnet ranges and you want to exclude specific ranges from export, enter those ranges in this field.

    2. IPv6 ranges (Preview): configure the export of IPv6 subnet ranges (internal and external).

       • Include export all IPv6 subnet ranges from spoke to hub: to export all IPv6 subnet ranges to the hub, select the checkbox.

11. Click Done.

12. If you want to add more spokes, click Add spoke and begin the process again, starting with entering a Spoke name.

13. When you have finished adding spokes, click Create. The Network Connectivity Center page updates to show details about the spokes that you created.

gcloud

To create a VPC spoke, use the gcloud network-connectivity spokes linked-vpc-network create command.

gcloud network-connectivity spokes linked-vpc-network create SPOKE_NAME \
    --hub=HUB \
    --description=DESCRIPTION \
    --vpc-network=VPC_URI \
    --include-export-ranges=[INCLUDE_RANGES] \
    --exclude-export-ranges=[EXCLUDE_IPV4_RANGES] \
    --global \
    --group=GROUP_NAME

Replace the following:

• SPOKE_NAME: the name of the spoke that you are creating, such as vpc-spoke1
• HUB: the hub for the spoke
• DESCRIPTION: (optional) text to describe the spoke
• VPC_URI: the VPC network that this spoke points to

• INCLUDE_RANGES: a comma-separated list of IP address ranges to export to the hub, specified as follows. You can configure the spoke to export only subnet ranges that use private IPv4 addresses, only IPv6 subnet ranges (internal and external), or both subnet ranges that use private IPv4 addresses and internal and external IPv6 subnet ranges. If not specified, the VPC spoke exports all subnet ranges that use private IPv4 addresses.

  • For IPv4, you can use one of the following options:

    • To export all subnet ranges that use private IPv4 addresses, enter ALL_PRIVATE_IPV4_RANGES.
    • To export specific IPv4 subnet ranges, enter a comma-separated list of IP address ranges (up to 16 CIDR ranges), such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The IPv4 subnet ranges that you specify must be private IPv4 address ranges, excluding privately used public IPv4 addresses. For more information, see Valid IPv4 ranges.

  • For IPv6 (Preview), you can export all IPv6 subnet ranges (internal and external) by entering ALL_IPV6_RANGES.

• EXCLUDE_IPV4_RANGES: a comma-separated list of IPv4 address ranges to be excluded from exporting to the hub (up to 16 CIDR ranges), such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The specified ranges must have a longer prefix or be equal to the individually configured subnets within the VPC.

• GROUP_NAME: the group this spoke belongs to—for example, center or edge. This field is required for spoke groups that use star topology. For detailed information about spoke groups, see Spoke groups.

API

To create a VPC spoke, use the networkconnectivity.spokes.create method.

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/spokes/SPOKE_NAME
  {
    "hub":"HUB_NAME",
    "linkedVpcNetwork": {
       "uri": VPC_URI,
       "include_export_ranges": "[INCLUDE_RANGES]",
       "exclude_export_ranges": "[EXCLUDE_IPV4_RANGES]",
       "group": "GROUP_NAME"
    },
  }

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the new spoke.
• HUB_NAME: the name of the hub that you are attaching the spoke to.
• VPC_URI: The VPC network that this spoke points to, such as vpc_uri.

• INCLUDE_RANGES: a comma-separated list of IP address ranges to export to the hub, specified as follows. You can configure the spoke to export only subnet ranges that use private IPv4 addresses, only IPv6 subnet ranges (internal and external), or both subnet ranges that use private IPv4 addresses and internal and external IPv6 subnet ranges. If not specified, the spoke exports all subnet ranges that use private IPv4 addresses.

  • For IPv4, you can use one of the following options:

    • To export all subnet ranges that use private IPv4 addresses, enter ALL_PRIVATE_IPV4_RANGES.
    • To export specific IPv4 subnet ranges, enter a comma-separated list of IP address ranges (up to 16 CIDR ranges), such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The IPv4 subnet ranges that you specify must be private IPv4 address ranges, excluding privately used public IPv4 addresses. For more information, see Valid IPv4 ranges.

  • For IPv6 (Preview), you can export all IPv6 subnet ranges (internal and external) by entering ALL_IPV6_RANGES.

• EXCLUDE_IPV4_RANGES: a comma-separated list of IPv4 address ranges to be excluded from exporting to the hub (up to 16 CIDR ranges), such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The specified ranges must have a longer prefix or be equal to the individually configured subnets within the VPC.

• GROUP_NAME: the group that this spoke belongs to. The name of the spoke group. Supported values are default for a mesh topology hub and center or edge for a star topology hub. This field is required for spoke groups that use star topology. For detailed information on spoke groups, see Spoke groups.

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project in which you want to create the spoke.

3. Click the Spokes tab.

4. Click Add spokes.

5. In the Select hub section, select the hub location as follows:

   • To attach the new spoke to a hub in the same project, select In project PROJECT_NAME and select the hub name from the list.
   • If you want to attach the new spoke to a hub in another project, select In another project. Enter the Project ID and the Hub name to which you want to attach your new spoke.

   When you choose a hub in a different project, your spoke becomes active only when the hub administrator reviews and accepts your proposed spoke. For more information about creating spokes attached to a hub in a different project, see VPC spokes overview. If you are creating a producer VPC spoke in the same project as the hub, the producer VPC spoke is automatically accepted and activated.

6. Enter a Spoke name and optionally, a Description.

7. Select Producer VPC network as the Spoke type.

8. Enter the name of an existing Consumer VPC spoke on the hub that consumes services from the producer VPC network through a VPC Network Peering connection. Google Cloud identifies the producer network through the peering connection.

9. Optionally, you can add a VPC spoke filter to customize how routes are advertised by entering an IP address range to exclude or include export from the spoke to hub. You cannot change this filter after the spoke is created.

10. Click Done.

11. If you want to add more spokes, click Add spoke and begin the process again, starting with entering a spoke name.

12. When you have finished adding spokes, click Create. The Network Connectivity Center page updates to show details about the spokes that you created.

gcloud

To create a producer VPC spoke, use the gcloud network-connectivity spokes linked-producer-vpc-network create command.

gcloud network-connectivity spokes linked-producer-vpc-network create SPOKE_NAME \
    --hub=HUB \
    --description=DESCRIPTION \
    --network=CONSUMER_VPC_URI \
    --peering=servicenetworking-googleapis-com \
    --exclude-export-ranges=[EXCLUDE_CIDR_RANGE] \
    --include-export-ranges=[INCLUDE_CIDR_RANGE] \
    --global \
    --group=GROUP_NAME

The --peering flag must be set to servicenetworking-googleapis-com.

Replace the following:

• SPOKE_NAME: the name of the spoke that you are creating, such as producer-vpc-spoke1
• HUB: the hub for the spoke
• DESCRIPTION: optional text to describe the spoke
• CONSUMER_VPC_URI: the VPC network that consumes services from the producer network through a VPC Network Peering connection. Google Cloud identifies the producer VPC network through the peering connection. The consumer network that you enter must also be a spoke in the hub. You can enter the full or relative URI. The following example shows the relative URI: projects/PROJECT_ID/global/networks/NETWORK_NAME.
• [EXCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be excluded from exporting to the hub—up to 16 CIDR ranges—such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The specified ranges must have a longer prefix or be equal to the individually configured subnets within the producer VPC.
• [INCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be included in exporting to the hub—up to 16 CIDR ranges—such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32.
• GROUP_NAME: the group this spoke belongs to—for example, center or edge. This field is required for spoke groups that use star topology. If using the star topology, you must place the producer VPC spoke in the same group as the existing consumer VPC spoke. For more information about spoke groups, see Spoke groups.

API

To create a producer VPC spoke, use the networkconnectivity.spokes.create method.

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/spokes/SPOKE_NAME
  {
    "hub":"HUB_NAME",
    "linkedProducerVpcNetwork": {
       "network": "CONSUMER_VPC_URI",
       "peering_name": "servicenetworking-googleapis-com",
       "include_export_ranges": "[INCLUDE_CIDR_RANGE]",
       "exclude_export_ranges": "[EXCLUDE_CIDR_RANGE]",
       "group": "GROUP_NAME"
    },
  }

The peering_name field must be set to servicenetworking-googleapis-com.

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the new spoke.
• HUB_NAME: the name of the hub that you are attaching the spoke to.
• SPOKE_NAME: the name of the spoke that you are creating.
• CONSUMER_VPC_URI: the VPC network that consumes services from the producer through a VPC Network Peering connection. Google Cloud identifies the producer VPC network through the peering connection. The consumer network that you enter must also be a spoke in the hub. You can enter the full or relative URI. The following example shows the relative URI: projects/PROJECT_ID/global/networks/NETWORK_NAME.
• [INCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be included in exporting to the hub—up to 16 CIDR ranges—such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The specified ranges must have a longer prefix or be equal to the individually configured subnets within the producer VPC network.
• [EXCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be excluded from exporting to the hub—up to 16 CIDR ranges—such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32.
• GROUP_NAME: the group that this spoke belongs to. Supported values are default for a mesh topology hub and center or edge for a star topology hub. This field is required for spoke groups that use star topology. If using the star topology, you must place the producer VPC spoke in the same group as the existing consumer VPC spoke. For more information about spoke groups, see Spoke groups.

Console

Enter basic spoke details

1. In the Google Cloud console, go to the Network Connectivity Center page.
Go to Network Connectivity Center
2. In the project menu, select a Google Cloud project.
3. Click the Spokes tab.
4. Click Add spokes.
5. In the New spoke form, set the Spoke type.
6. Enter a Spoke name and optionally, a Description.
7. Select the Region field for the new spoke.
8. Under Site-to-site data transfer, select On or Off. If the region you selected does not support data transfer, the field is disabled. For more information about this use case, see Site-to-site data transfer overview.
9. In the VPC network list, select a network. If you have more than one spoke that uses the data transfer feature, all of these spokes must be in the same VPC network. So if you have already created a spoke that uses data transfer, the VPC network value is prepopulated and cannot be changed.

Save your spoke

1. If you want to add more spokes, click Add spoke and begin the process again, starting with entering a Spoke name.
2. When you are finished adding spokes, click Create. The Network Connectivity Center page updates to show details about the spokes that you created.

gcloud

To create a Router appliance spoke, use the gcloud network-connectivity spokes linked-router-appliances create command.

For example, to create a spoke that has two router appliance instances and uses site-to-site data transfer, run the following command.

To enable import of subnet IP address ranges to this spoke (Preview), use the --include-import-ranges flag.

  gcloud network-connectivity spokes linked-router-appliances create NAME \
      --hub=HUB_NAME \
      --description="DESCRIPTION" \
      --router-appliance=instance="ROUTER_APPLIANCE_URI",ip=IP_ADDRESS \
      --router-appliance=instance="ROUTER_APPLIANCE_URI_2",ip=IP_ADDRESS_2 \
      --region=REGION \
      --labels="KEY"="VALUE" \
      --site-to-site-data-transfer \
      --include-import-ranges=[INCLUDE_IMPORT_RANGES,...]
 

Replace the following values:

• NAME: the name of the spoke
• HUB_NAME: the name of the hub
• DESCRIPTION: optional text that describes the spoke
• ROUTER_APPLIANCE_URI: the URI of the first router appliance instance—for example,

  https://www.googleapis.com/compute/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME 

• IP_ADDRESS: the internal IP address of the first router appliance instance
• ROUTER_APPLIANCE_URI_2: the URI of the second router appliance instance
• IP_ADDRESS_2: the internal IP address of the second router appliance instance
• REGION: the Google Cloud region where the spoke is located—for example, us-west1
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text
• [INCLUDE_IMPORT_RANGES,...]: the IP address ranges that are specified to be imported from hub subnets. You can only add ALL_IPV4_RANGES to the list. If it is empty, the spoke doesn't import any subnets from the hub.

Use the site-to-site-data-transfer flag if you want to enable data transfer for the spoke. For more information about this use case, see Site-to-site data transfer overview.

API

To create a Router appliance spoke, use the networkconnectivity.spokes.create method. For example, to create a spoke that contains two router appliance instances, use the following request:

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/REGION/spokes/SPOKE_NAME
  {
    "hub": "HUB_NAME",
    "labels": {"KEY": "VALUE"},
    "linkedRouterApplianceInstances": {
      "instances": [
        {
          "virtualMachine": "ROUTER_APPLIANCE_URI",
          "ipAddress": "IP_ADDRESS",
        },
        {
          "virtualMachine": "ROUTER_APPLIANCE_URI_2,
          "ipAddress": "IP_ADDRESS_2",
        }
      ],
      "siteToSiteDataTransfer": BOOLEAN
      "includeImportRanges": [INCLUDE_IMPORT_RANGES,...]
    }
  }
 

Replace the following values:

• PROJECT_ID: the project ID of your project
• REGION: the Google Cloud region where you want to locate the spoke—for example, us-west1
• SPOKE_NAME: the name for the spoke
• HUB_NAME: the name of the hub that you are attaching the spoke to
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text
• ROUTER_APPLIANCE_URI: the URI of the first router appliance instance—for example,

  https://www.googleapis.com/compute/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME 

• IP_ADDRESS: the internal IP address of the first router appliance instance
• ROUTER_APPLIANCE_URI_2: the URI of the second router appliance instance
• IP_ADDRESS_2: the internal IP address of the second router appliance instance
• [INCLUDE_IMPORT_RANGES,...]: the IP address ranges that are specified to be imported from hub subnets. You can only add ALL_IPV4_RANGES to the list. If it is empty, the spoke doesn't import any subnets from the hub.

Console

Enter basic spoke details

1. In the Google Cloud console, go to the Network Connectivity Center page.
Go to Network Connectivity Center
2. In the project menu, select a Google Cloud project.
3. Click the Spokes tab.
4. Click Add spokes.
5. In the New spoke form, set the Spoke type.
6. Enter a Spoke name and optionally, a Description.
7. Select the Region field for the new spoke.
8. Under Site-to-site data transfer, select On or Off. If the region you selected does not support data transfer, the field is disabled. For more information about this use case, see Site-to-site data transfer overview.
9. In the VPC network list, select a network. If you have more than one spoke that uses the data transfer feature, all of these spokes must be in the same VPC network. So if you have already created a spoke that uses data transfer, the VPC network value is prepopulated and cannot be changed.

Save your spoke

1. If you want to add more spokes, click Add spoke and begin the process again, starting with entering a Spoke name.
2. When you are finished adding spokes, click Create. The Network Connectivity Center page updates to show details about the spokes that you created.

gcloud

To create a VLAN attachment spoke, use the gcloud network-connectivity spokes linked-interconnect-attachments create command.

For example, to create a spoke that has two VLAN attachments and uses site-to-site data transfer, run the following command.

To enable import of subnet IP address ranges to this spoke (Preview), use the --include-import-ranges flag.

  gcloud network-connectivity spokes linked-interconnect-attachments create SPOKE_NAME \
      --hub=HUB_NAME \
      --description="DESCRIPTION" \
      --interconnect-attachments=VLAN_ATTACHMENT_NAME,VLAN_ATTACHMENT_NAME_2 \
      --region=REGION \
      --labels="KEY"="VALUE" \
      --site-to-site-data-transfer \
      --include-import-ranges=[INCLUDE_IMPORT_RANGES,...]

Replace the following values:

• SPOKE_NAME: the name for the spoke
• HUB_NAME: the name of the hub, in URI format, that you are attaching the spoke to—for example,
  projects/myproject/locations/global/hubs/us-west-to-uk
• DESCRIPTION: optional text that describes the spoke
• VLAN_ATTACHMENT_NAME: the name of the first VLAN attachment to add to the spoke
• VLAN_ATTACHMENT_NAME_2: the name of the second VLAN attachment; if you include a second attachment, make sure you omit a space between the comma and the name of the attachment
• REGION: the Google Cloud region where the spoke is located
• KEY: the key in the key-value pair for the label text
• VALUE: the value in the key-value pair for the label text
• [INCLUDE_IMPORT_RANGES,...]: the IP address ranges that are specified to be imported from hub subnets. You can only add ALL_IPV4_RANGES to the list. If it is empty, the spoke doesn't import any subnets from the hub.

Use the site-to-site-data-transfer flag if you want to enable data transfer for the spoke. For more information about this use case, see Site-to-site data transfer overview.

API

To create a VLAN attachment spoke, use the networkconnectivity.spokes.create method. For example, to create a spoke that contains two VLAN attachments and has the import of subnet IP address ranges to this spoke enabled (Preview), use the following request:

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/REGION/spokes/SPOKE_NAME
  {
    "hub": "HUB_NAME",
    "labels": {"KEY": "VALUE"},
    "linkedInterconnectAttachments": {
      "uris": [
        "VLAN_ATTACHMENT_NAME",
        "VLAN_ATTACHMENT_NAME_2"
      ],
      "siteToSiteDataTransfer": BOOLEAN
      "includeImportRanges": [INCLUDE_IMPORT_RANGES,...]
    }
  }

Replace the following values:

• PROJECT_ID: the project ID of your project
• REGION: the Google Cloud region where you want to locate the spoke—for example, us-west1
• SPOKE_NAME: the name for the spoke
• HUB_NAME: the name of the hub that you are attaching the spoke to
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text
• VLAN_ATTACHMENT_NAME: the name of the first VLAN attachment to add to the spoke
• VLAN_ATTACHMENT_NAME_2: the name of the second VLAN attachment
• BOOLEAN: a value that determines whether site-to-site data transfer is enabled for this spoke; for more information about this use case, see Site-to-site data transfer overview
• [INCLUDE_IMPORT_RANGES,...]: the IP address ranges that are specified to be imported from hub subnets. You can only add ALL_IPV4_RANGES to the list. If it is empty, the spoke doesn't import any subnets from the hub.

Console

Enter basic spoke details

1. In the Google Cloud console, go to the Network Connectivity Center page.
Go to Network Connectivity Center
2. In the project menu, select a Google Cloud project.
3. Click the Spokes tab.
4. Click Add spokes.
5. In the New spoke form, set the Spoke type.
6. Enter a Spoke name and optionally, a Description.
7. Select the Region field for the new spoke.
8. Under Site-to-site data transfer, select On or Off. If the region you selected does not support data transfer, the field is disabled. For more information about this use case, see Site-to-site data transfer overview.
9. In the VPC network list, select a network. If you have more than one spoke that uses the data transfer feature, all of these spokes must be in the same VPC network. So if you have already created a spoke that uses data transfer, the VPC network value is prepopulated and cannot be changed.

Save your spoke

1. If you want to add more spokes, click Add spoke and begin the process again, starting with entering a Spoke name.
2. When you are finished adding spokes, click Create. The Network Connectivity Center page updates to show details about the spokes that you created.

gcloud

To create a spoke that contains an HA VPN tunnel, use the gcloud network-connectivity spokes linked-vpn-tunnels create command.

For example, to create a spoke that has two HA VPN tunnels and uses site-to-site data transfer, enter the following command.

To enable import of subnet IP address ranges to this spoke (Preview), use the --include-import-ranges flag.

  gcloud network-connectivity spokes linked-vpn-tunnels create SPOKE_NAME \
      --hub=HUB_NAME \
      --description="DESCRIPTION" \
      --vpn-tunnels=TUNNEL_NAME,TUNNEL_NAME_2 \
      --region=REGION \
      --labels="KEY"="VALUE" \
      --site-to-site-data-transfer \
      --include-import-ranges=[INCLUDE_IMPORT_RANGES,...]

Replace the following values:

• SPOKE_NAME: the name for the spoke
• HUB_NAME: the name of the hub, in URI format, that you are attaching the spoke to—for example,
  projects/PROJECT_ID/locations/global/hubs/us-west-to-uk
• DESCRIPTION: optional text that describes the spoke—for example, us-vpn-spoke
• TUNNEL_NAME: the name of the first HA VPN tunnel to add to the spoke
• TUNNEL_NAME_2: the name of the second HA VPN tunnel; if you use a second tunnel, make sure you omit a space between the comma and the name of second tunnel
• REGION: the Google Cloud region where the spoke is located
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text
• [INCLUDE_IMPORT_RANGES,...]: the IP address ranges that are specified to be imported from hub subnets. You can only add ALL_IPV4_RANGES to the list. If it is empty, the spoke doesn't import any subnets from the hub.

Use the site-to-site-data-transfer flag if you want to enable data transfer for the spoke. For more information about this use case, see Site-to-site data transfer overview.

API

To create a VPN spoke, use the networkconnectivity.spokes.create method. For example, to create a spoke that contains two HA VPN tunnels and has include import subnet IP address ranges enabled, use the following request:

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/REGION/spokes/SPOKE_NAME
  {
    "hub": "HUB_NAME",
    "labels": {"KEY": "VALUE"},
    "linkedVpnTunnels": {
      "uris": [
        "TUNNEL_NAME",
        "TUNNEL_NAME_2"
      ],
      "siteToSiteDataTransfer": BOOLEAN,
      "includeImportRanges": [INCLUDE_IMPORT_RANGES,...]
    }
  }

Replace the following values:

• PROJECT_ID: the project ID of your project
• REGION: the Google Cloud region where you want to locate the spoke—for example, us-west1
• SPOKE_NAME: the name for the spoke
• HUB_NAME: the name of the hub that you are attaching the spoke to
• KEY: the key in the key-value pair for the optional label text
• VALUE: the value in the key-value pair for the optional label text
• TUNNEL_NAME: the name of the first HA VPN tunnel to add to the spoke
• TUNNEL_NAME_2: the name of the second HA VPN tunnel
• BOOLEAN: a value that determines whether site-to-site data transfer is enabled for this spoke; for more information about this use case, see Site-to-site data transfer overview
• [INCLUDE_IMPORT_RANGES,...]: the IP address ranges that are specified to be imported from hub subnets. You can only add ALL_IPV4_RANGES to the list. If it is empty, the spoke doesn't import any subnets from the hub.

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select the project that contains the hub for which you want to list the existing spokes.

3. On the Hub tab, select the hub.

4. Click the Spoke tab. All the spokes attached to that hub are listed.

5. Use the Filter field to sort spokes by name, type, status, ID, region, resource count, BGP sessions, or description.

6. To view details for a specific spoke, click the spoke name.

gcloud

To list existing spokes in a project, use the gcloud network-connectivity spokes list command.

gcloud network-connectivity spokes list \
    --region=LOCATION

Replace LOCATION with the appropriate region.

To list existing VPC spokes in a project, use the same command with the --global flag:

gcloud network-connectivity spokes list \
    --global

To list all spokes associated with a hub across all projects use the gcloud network-connectivity hubs list-spokes command.

gcloud network-connectivity hubs list-spokes HUB_NAME

Replace HUB_NAME with the name of the hub for which you want to list spokes, such as my-hub.

Filters

To list all VPC spokes that belong to a specific group, use the gcloud network-connectivity hubs list-spokes command and specify the group filter.

gcloud network-connectivity hubs list-spokes HUB_NAME \
    --filter="group:GROUP_NAME"

Replace the following values:

• HUB_NAME: the name of the hub for which you want to list spokes
• GROUP_NAME: the name of the spoke group. Supported values are default for mesh topology and center or edge for a star topology hub.

To list all VPC spokes associated with a hub that are pending review by the hub administrator, use the same command and specify the reason filter.

gcloud network-connectivity hubs list-spokes HUB_NAME \
    --filter="reason:PENDING_REVIEW"

Replace HUB_NAME with the name of the hub for which you want to list spokes.

To list all inactive VPC spokes associated with a hub, use the same command and specify the state filter.

gcloud network-connectivity hubs list-spokes HUB_NAME \
    --filter="state:INACTIVE"

Replace HUB_NAME with the name of the hub for which you want to list inactive spokes.

API

To list existing spokes in a project, use the networkconnectivity.spokes.list method.

  GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/spokes

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the spokes to list
• LOCATION: the region where the spoke is located—for example, us-west1 or global for VPC spokes

To list all spokes associated with a hub across all projects, use the networkconnectivity.hubs.listSpokes method.

  GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME:listSpokes

Replace the following values:

• PROJECT_ID: the project ID of the hub
• HUB_NAME: the name of the hub for which you want to list spokes

To get an aggregated list of existing spokes, where the values of multiple rows are grouped together to form a single summary value, use the networkconnectivity.spokes.list method with a hyphen (-) after locations as a wildcard.

  GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/-/spokes

Replace PROJECT_ID with the project ID of the project that contains the spokes to list.

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project.

3. On the Hub tab, select the hub. All the spokes attached to that hub are listed.

4. To view details for a specific spoke, do one of the following:

   • In the Spoke name column, select a spoke to view the Spoke details page.
   • On the Spokes tab, click the Spoke name column, and then select a spoke to view the Spoke details page.

gcloud

To describe a spoke, use the gcloud network-connectivity spokes describe command.

  gcloud network-connectivity spokes describe SPOKE_NAME \
      --region=LOCATION

Replace the following values:

• SPOKE_NAME: the name of the spoke
• LOCATION: the region where the spoke is located

To describe a VPC spoke, use the same command with the --global flag:

  gcloud network-connectivity spokes describe SPOKE_NAME \
      --global

Replace SPOKE_NAME with the name of the spoke.

API

To describe a spoke, use the networkconnectivity.spokes.get method.

 GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/spokes/SPOKE_NAME

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the spoke
• LOCATION: the region where the spoke is located—for example, us-west1 or global for VPC spokes
• SPOKE_NAME: the name of the spoke

Console

To change the resources used by a Router appliance spoke, complete the following steps:

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project.

3. Click the Spokes tab.

4. Click the name of the spoke that you want to modify.

5. Do either of the following:

   • To add resources, click Add instances and follow the prompts to select one or more VMs. When you have finished, click OK.
   • To remove resources, select the VMs that you want to remove and click deleteRemove instances. In the confirmation dialog, click OK.

gcloud

To update a spoke, use one of the following commands:

• gcloud network-connectivity spokes linked-router-appliances update
• gcloud network-connectivity spokes linked-interconnect-attachments update
• gcloud network-connectivity spokes linked-vpn-tunnels update
• gcloud network-connectivity spokes linked-vpc-network update
• gcloud network-connectivity spokes linked-producer-vpc-network update

You can update the IP address ranges that are specified to be imported from hub subnets by adding ALL_IPV4_RANGES to the list for all hybrid spoke types.

Update description, labels, and include IP address ranges

To update a Router appliance spoke's description, label, and include IP address ranges, run the following command:

  gcloud network-connectivity spokes linked-router-appliances update SPOKE_NAME \
      --description="DESCRIPTION" \
      --region=LOCATION \
      --update-labels="KEY"="VALUE" \
      --include-import-ranges="[INCLUDE_IMPORT_RANGES,...]"

Replace the following values:

• SPOKE_NAME: the name of the spoke to update
• DESCRIPTION: a new description for the spoke
• LOCATION: the Google Cloud region where the spoke is located—for example, us-west1 or global
• KEY: the key in the key-value pair
• VALUE: the value in the key-value pair
• [INCLUDE_IMPORT_RANGES,...]: the IP address ranges that are specified to be imported from hub subnets. You can only add ALL_IPV4_RANGES to the list. If it is empty, the spoke doesn't import any subnets from the hub.

Update a Router appliance spoke's underlying resources

If needed, you can update a Router appliance spoke to use a different router appliance instance, as long as the new resource is in the same VPC network as the original one. To replace the existing resource with a new one, run the following command:

  gcloud network-connectivity spokes linked-router-appliances update SPOKE_NAME \
      --region=LOCATION \
      --router-appliance=instance="ROUTER_APPLIANCE_URI",ip=IP_ADDRESS

Replace the following values:

• SPOKE_NAME: the name of the spoke
• LOCATION: the Google Cloud region where the spoke is located—for example, us-west1
• ROUTER_APPLIANCE_URI: the URI of the new router appliance instance to associate with the spoke—for example,

  "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME"

• IP_ADDRESS: the internal IP address of the new router appliance instance

API

To update a spoke, use the networkconnectivity.spokes.patch method.

Update description and labels

To update a Router appliance spoke's description and label, use the following request:

 PATCH https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/REGION/spokes/SPOKE_NAME
 {
   "description": "DESCRIPTION"
   "labels": {
     "KEY": "VALUE"
     "includeImportRanges": [INCLUDE_IMPORT_RANGES,...]
   }
 }

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the spoke
• REGION: the region where the spoke is located—for example, us-west1
• SPOKE_NAME: the name of the spoke to update
• DESCRIPTION: a new description for the spoke
• KEY: the key in the key-value pair
• VALUE: the value in the key-value pair
• [INCLUDE_IMPORT_RANGES,...]: the IP address ranges that are specified to be imported from hub subnets. You can only add ALL_IPV4_RANGES to the list. If it is empty, the spoke doesn't import any subnets from the hub.

Update a Router appliance spoke's underlying resources

If needed, you can update a Router appliance spoke to use a different router appliance instance, as long as the new resource is in the same VPC network as the original one. To replace the existing resource with a new one, use the following request:

 PATCH https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/REGION/spokes/SPOKE
 {
   "linkedRouterApplianceInstances": {
     "instances": [
       {
         "virtualMachine": "ROUTER_APPLIANCE_URI",
         "ipAddress": "IP_ADDRESS",
       }
     ]
   }
 }

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the spoke
• REGION: the region where the spoke is located—for example, us-west1
• SPOKE: the name of the spoke
• ROUTER_APPLIANCE_URI: the URI of the new router appliance instance to associate with the spoke—for example,

  "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME"

• IP_ADDRESS: the internal IP address of the new router appliance instance

Console

1. In the Google Cloud console, go to the Network Connectivity Center page.

   Go to Network Connectivity Center

2. In the project menu, select a project.

3. Click the Spokes tab.

4. View the list of Spoke names for the project.

5. Select the spokes to delete.

6. Click deleteDelete spokes.

7. In the confirmation dialog, do one of the following:

   • Click Cancel if you don't want to delete the spokes.
   • Click Delete to delete the spokes.

gcloud

To delete a spoke, use the gcloud network-connectivity spokes delete command.

  gcloud network-connectivity spokes delete SPOKE_NAME \
      --region=REGION

Replace the following values:

• SPOKE_NAME: the name of the spoke to delete
• REGION: the region where the spoke is located; this option is required in addition to the region listed in the full spoke name. If you are deleting a VPC spoke, you must specify --global.

API

To delete an existing spoke, use the networkconnectivity.spokes.delete method.

  DELETE https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/spokes/SPOKE_NAME

Replace the following values:

• PROJECT_ID: the project ID of the project that contains the spoke to delete
• LOCATION: the region where the spoke is located—for example, us-west1 or --global for VPC spokes
• SPOKE_NAME: the name of the spoke to delete