[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# Networking best practices\n=========================\n\nThis page presents networking best practices for Google Cloud VMware Engine.\n\nPrevent routing issues\n----------------------\n\nCommunications within VMware Engine and with the rest of the internet\nare routed at Layer 3, except for networks that are stretched from on-premises\nor from other VMware Engine private clouds.\n\nTo prevent issues with configuration and possibly performance or limits when\nsetting up routing to and from the VMware Engine environment, follow\nthese best practices:\n\n- Configure the Cloud Router associated with the on-premises hybrid Cloud VPN or Cloud Interconnect connection with summary [custom advertisements](/network-connectivity/docs/router/concepts/advertised-routes#am-custom) for VMware Engine ranges and the ranges of other Google compute services, such as Google Kubernetes Engine and Compute Engine.\n- Use contiguous IP address space for NSX segment subnets.\n- To minimize the number of routes that are announced to the\n rest of Google, summarize the NSX segment routes at tier-0 as follows:\n\n - If NAT is required, summarize the NAT IPs out of tier-0 rather than /32's.\n - Summarize IPsec endpoint IPs (/32's) at tier-0.\n - Summarize DNS profile IPs (/32's) at tier-0.\n- Enable [NSX-T DHCP Relay](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-C534FAED-EF68-4004-9487-FE4DFE83EDAA.html)\n based on whether DHCP services will reside in VMware Engine or\n elsewhere.\n\n- When redistributing tier-0 static routes into BGP, apply a route map to\n prevent 0/0 from being redistributed.\n\nChoose a suitable internet access option\n----------------------------------------\n\nVMware Engine offers the following options to configure internet access\nand public IP addresses. Consider the advantages and disadvantages of each, as\nlisted in the following table, to choose the most appropriate option:\n\nFor more information, see [Configure internet access for workload VMs](/vmware-engine/docs/networking/workload-internet-access).\n\nImplement service chaining using third-party virtual network appliances\n-----------------------------------------------------------------------\n\nVMware Engine supports chaining of network services by using Layer 3\nrouted topologies. In this mode, you can deploy and connect\na third-party network virtual appliance in VMware Engine to\nprovide inline network services to VMware VMs, such as load balancing,\nnext-generation firewalling (NGFW), and intrusion detection and prevention. You\ncan deploy these appliances in a number of ways, depending on the segmentation\nand connectivity requirements of applications.\n\nSeveral deployment topologies are possible, with richer configurations and\nlinks in the service chain (for example, load balancers in front of firewalls).\nIt's also possible to deploy these appliances in active-active topologies by\nusing dataplane-based heartbeats and redundancy, if the vendor supports them.\n\nThe following sections show sample deployment topologies that use a\nVM-based firewall device.\n\n### Behind a tier-1 gateway\n\nIn this deployment topology, the third-party appliance serves as the default\ngateway for several networks in the environment. You can use the appliance\nto inspect the traffic between them as well as the traffic entering and\nexiting the VMware Engine environment.\n\nThe following diagram shows how a tier-1 gateway works in VMware Engine:\n\nTo implement this topology, do the following:\n\n1. Configure static routes on tier-1 to point to the appliance VM and reach the networks behind it.\n2. On tier 0, redistribute tier-1 static routes into BGP.\n3. With regard to support for [guest inter-VLAN routing](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/administration/GUID-08930EDF-C0BE-435C-A9EC-CA1303A9AA30.html), VMware guest workloads are limited to 10 virtual NICs. In some use cases, you need to connect into more than 10 VLANs to produce the firewall segmentation required. In this case, you can use VLAN tagging to the ISV. The guest VMs of independent software vendors (ISVs) should be sized to support and distribute the traffic between multiple sets of ISV appliances as required.\n\n### Behind a tier-0 gateway\n\nIn this deployment topology, a tier-0 gateway serves as the default gateway for\nthe third-party appliance with one or more tier-1 gateways behind the appliance.\nThe tier-0 gateway can be used to provide routed connectivity for the same\nsecurity zone and support inspection across security zones or with the rest of\nGoogle Cloud. This topology allows for large-scale segment-to-segment\ncommunications without Layer 7 inspection.\n\nThe following diagram shows how a tier-0 gateway works in VMware Engine:\n\nTo implement this topology, do the following:\n\n1. Configure a default static route on each tier-1 gateway pointing to the NGFW.\n2. Configure static routes to reach workload segments on tier-0 with the NGFW as the next hop.\n3. Redistribute these static routes into BGP with a route map to prevent 0/0 from being redistributed.\n\nWhat's next\n-----------\n\n- Read about best practices for [compute](/vmware-engine/docs/best-practices-compute), [security](/vmware-engine/docs/best-practices-security), [storage](/vmware-engine/docs/best-practices-storage), [migration](/vmware-engine/docs/best-practices-migration), and [costs](/vmware-engine/docs/best-practices-costs).\n- Try out VMware Engine. Visit [features, benefits, and use\n cases](/vmware-engine/docs/overview) for more information.\n- Explore reference architectures, diagrams, tutorials, and best practices about Google Cloud. Visit [Cloud Architecture Center](/architecture) for more information."]]
