Hybrid private connectivity
Attach external networks through approved private circuits or gateways with explicit route exchange.
Private connectivity links a regional network segment to an approved external network. It requires a managed connection, compatible address plan, and explicit route export on both sides.
Choose the connection boundary
Use project peering between supported managed networks. Use Networking → Private connections for a dedicated circuit or supported hybrid gateway into an owned environment. A direct connection is scoped to its region and authorized organization or project.
The connection request records provider or circuit identity, interface details, expected capacity, and allowed prefixes. An accepted request does not imply that the physical cross-connect is already installed or active.
Provision and validate
Complete the provider's circuit handoff, then validate link state and the selected routing mode. Static routes need explicit next hops. A supported BGP attachment also needs local and peer AS numbers, peer addresses, and approved prefix filters.
Reject overlapping exported ranges and default routes unless intentionally approved. A private circuit must not become an unrestricted transit path between every attached project and the external organization.
Routing and authorization
Route advertisements establish reachability, not firewall permission. Configure the managed side and external side for the actual source ranges and address families. DNS forwarding is another explicit dependency.
Connections are not automatically transitive through peering. A route visible at the circuit edge is not necessarily exported to another VPC segment. Inspect the effective route source and export policy at each boundary.
Redundancy and maintenance
A single circuit has its own failure domain. Use supported independent handoffs and a reviewed route preference when redundant access is required. Two logical interfaces on one physical circuit do not provide physical diversity.
Test failover in both directions and account for interrupted stateful sessions. Measure the real workload path, including MTU, rather than only the carrier's link health.
Withdrawal
Stop exporting dependent prefixes before removal. Confirm internal services, identity endpoints, backups, and management paths no longer use the circuit. Connection deletion cannot cancel the external provider's commercial agreement or physically remove a cross-connect.
Use VPC segments, route tables, and MTU diagnosis to inspect dependent traffic.