Multiple VPC Networks
In this next topic you will find out how to utilize multiple VPCs  to build roburst networking solutions. Shared VPC allows an organisation to conect resources from multiple projects to a common VPC network. This allows the resources to communicate with each other securely and efficiently using internal IPs from that network. In this diagram there is one network that belongs to the web application service project, this network is shared with three other projects namely the recommendation service, personalization service and analytics service. Each of these service projects has instances that are in the same network as the web application server allowing for private communication to that server using internal IP addresses. The web application server communicates with clients and on-premises using the service external IP address the backend services on the other hand cannot be reached externally because they only communicate using internal IP addresses. When you use shared vpc you designate a project as a host project and attach one or more other service projects to it in this case the web application service project is the host project and the three other projects are the service projects the overall VPC network is called the shared vpc network. VPC network peering allows private RFC 1918 connectivity across two vpc networks regardless of whether they belong to the same project or the same organisation. Now remember that each VPC network will have firewall rules that define what traffic is allowed or denied between the networks. In this diagram there are two organisations that represent a consumer and a producer respectively. Each organisation has its own organisation node, VPC network VM instances, network admin and instance admin. In order for VPC network peering to be established successfully the producer network admin needs to peer the producer network with the consumer  network and the consumer network admin needs to peer the consumer network with the producer network when both peering connections are created the VPC network peering session becomes active and routes are exchanged this allows the VM instances to communicate privately using their internal IP addresses. VPC network peering is a decentralized or distributed approach to multi project networking because each VPC network may remain under the control of separate administrative groups and maintain its own global firewall and routing tables. Historically such projects would consider external IP addresses or vpns to facilitate private communication between VPC network’s. However VPC network theory does not incur the network latency security and cost drawbacks that are present when using external IP addresses or vpns there are some things to remember when using VPC network peering. VPC network peering works with compute engine, Google Kubernetes engine and app Engine flexible environment. Peered VPC networks remain administratively separate which means that routes firewalls, vpns and other traffic management tools are administered and applied separately in each of the VPC networks each side of a peering association is set up independently so peering will be active only when the configuration from both sides match this allows side to delete the peering association at anytime. A subnet inside of prefix in one peered VPC network cannot overlap with the subnet side of prefix and another peer network this means that two auto mode VPC networks that only have the default subnet cannot PEER there is one more thing to remember when using VPC network peering only directly peered networks can communicate meaning that the transition peering is not supported in other words if VPC network N one is peered with N2 and N3 but n2 and n3 are not directly connected VPC network n1 and n2 can not communicate with VPC network n3 over the peering.  This is critical if n one is a software-as-a-service organisation offering services to n2 and n3 now that you learnt about shared VPC and VPC network peering let’s compare both of these configurations to help you decide which is appropriate for a given situation. If you want to configure private communication between VPC networks in different organizations you have to use VPC network peering shared VPC only works within the same organisation somewhat similarly if you want to configure private communication between VPC networks in the same project you have to use VPC network peering this doesn’t mean that the network needs to be in the same project but they can be as you will explore in the upcoming lab. Shared vpc only works across projects, in a shared vpc the network administration is centralised in a VPC network peering situation the network administration is decentralized.