[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2024-04-05。"],[[["\u003cp\u003eCross-Cloud Network enables the distribution of workloads and services across multiple cloud and on-premises networks, providing a unified cloud experience for application developers and operators.\u003c/p\u003e\n"],["\u003cp\u003eThis guide focuses on the design considerations for building distributed applications on Cross-Cloud Network, covering network segmentation, connectivity, service networking, and security.\u003c/p\u003e\n"],["\u003cp\u003eThe architecture is structured into functional layers, including network segmentation and connectivity, service networking, and network security, supporting both regional and global application stacks.\u003c/p\u003e\n"],["\u003cp\u003eInter-VPC connectivity within Cross-Cloud Network can be achieved through Network Connectivity Center or a combination of VPC Network Peering and HA VPN hub-and-spoke patterns.\u003c/p\u003e\n"],["\u003cp\u003eService networking patterns vary based on application deployment archetypes, with a focus on multi-regional and global deployments, allowing for regional failover and optimized access latency.\u003c/p\u003e\n"]]],[],null,["# Cross-Cloud Network for distributed applications\n\nCross-Cloud Network enables an architecture for the assembly of\ndistributed applications. Cross-Cloud Network lets you\ndistribute workloads and services across multiple cloud and on-premises\nnetworks. This solution provides application developers and operators the\nexperience of a single cloud across multiple clouds. This solution uses and also\nexpands the [established uses of hybrid and multicloud\nnetworking](/architecture/hybrid-multicloud-patterns).\n\nThis guide is intended for network architects and engineers who want to design\nand build distributed applications on Cross-Cloud Network. This\nguide provides you with a comprehensive understanding of\nCross-Cloud Network design considerations.\n\nThis design guide is a series that includes the following documents:\n\n- Cross-Cloud Network design for distributed applications (this document)\n- [Network segmentation and connectivity for distributed applications in Cross-Cloud Network](/architecture/ccn-distributed-apps-design/connectivity)\n- [Service networking for distributed applications in Cross-Cloud Network](/architecture/ccn-distributed-apps-design/service-networking)\n- [Network security for distributed applications in Cross-Cloud Network](/architecture/ccn-distributed-apps-design/security)\n\nThe architecture supports regional and global application stacks, and it's\norganized in the following functional layers:\n\n- **Network segmentation and connectivity**: involves the Virtual Private Cloud (VPC) segmentation structure and IP connectivity across VPCs and to external networks.\n- **Service networking**: involves the deployment of application services, which are load balanced and made available across projects and organizations.\n- **Network security**: enables the enforcement of security for intra-cloud and inter-cloud communications, using both built-in cloud security and network virtual appliances (NVAs).\n\nNetwork segmentation and connectivity\n-------------------------------------\n\nSegmentation structure and connectivity is the foundation of the design. The\nfollowing diagram shows a VPC segmentation structure, which you\ncan implement by using either a consolidated or segmented infrastructure. This\ndiagram doesn't show the connections between the networks.\n\nThis structure includes the following components:\n\n- **Transit VPC**: Handles external network connections and routing policies. This VPC can also provide connectivity between other VPCs.\n- **Services access VPCs**: Contain access points to different services. The service access points in these VPCs can be reached from other networks.\n- **Managed services VPCs**: Contain services produced by other entities. The services are made accessible to applications running in VPC networks by using Private Service Connect or private services access.\n- **Application VPCs**: Contain the workloads that make up the software services that your organization creates and hosts itself.\n\nYour choice of segmentation structure for the application VPCs\ndepends on the scale of application VPCs required, whether you\nplan to deploy perimeter firewalls in Cross-Cloud Network or\nexternally, and the choice of central or distributed service publication.\n\nCross-Cloud Network supports the deployment of regional\napplication stacks and global application stacks. Both of these\napplication resiliency archetypes are supported by the proposed segmentation\nstructure with the inter-VPC connectivity pattern.\n\nYou can achieve inter-VPC connectivity with Network Connectivity Center or by using\na combination of VPC Network Peering and HA VPN hub-and-spoke patterns.\n\nThe design of the DNS infrastructure is also defined in the context of the\nsegmentation structure, independent of the connectivity pattern.\n\nService networking\n------------------\n\nDifferent application [deployment\narchetypes](/architecture/deployment-archetypes) lead to different patterns for\nservice networking. For Cross-Cloud Network design, focus on\nthe [Multi-regional deployment\narchetype](/architecture/deployment-archetypes/multiregional), in which an\napplication stack runs independently in multiple zones across two or more\nGoogle Cloud regions.\n\nA multi-regional deployment archetype has the following features that are useful\nfor Cross-Cloud Network design:\n\n- You can use DNS routing policies to route incoming traffic to the regional load balancers.\n- The regional load balancers can then distribute the traffic to the application stack.\n- You can implement regional failover by re-anchoring the DNS mappings of the application stack with a [DNS failover routing\n policy](/dns/docs/policies-overview#failover-policy).\n\nAn alternative to the multi-regional deployment archetype would be the [global\ndeployment archetype](/architecture/deployment-archetypes/global), in which a\nsingle stack is built on global load balancers and spans multiple regions.\nConsider the following features of this archetype when working with\nCross-Cloud Network design:\n\n- The load balancers distribute traffic to the region that's nearest to the user.\n- The internet-facing frontends are global, but the internal-facing frontends are regional with global access, so you can reach them in failover scenarios.\n- You can use geolocation DNS routing policies and DNS health checks on the internal service layers of the application stack.\n\nHow you provide access to managed published services depends on the service that\nneeds to be reached. The different private reachability models are modularized\nand orthogonal to the design of the application stack.\n\nDepending on the service, you can use Private Service Connect or\nprivate services access for private access. You can build an application\nstack by combining built-in services and services published by other\norganizations. The service stacks can be regional or global to meet your\nrequired level of resiliency and optimized access latency.\n\nNetwork security\n----------------\n\nFor workload security, we recommend that you use [firewall\npolicies](/firewall/docs/firewall-policies-overview) from Google Cloud.\n\nIf your organization requires additional advanced capabilities to meet security\nor compliance requirements, you can incorporate perimeter security firewalls\nby inserting Next-Generation Firewall (NGFW) Network Virtual Appliances (NVAs).\n\nYou can insert NGFW NVAs in a single network interface (single-NIC mode) or over\nmultiple network interfaces (multi-NIC mode). The NGFW NVAs can support security\nzones or Classless Inter-Domain Routing (CIDR)-based perimeter policies.\nCross-Cloud Network deploys perimeter NGFW NVAs by using a\ntransit VPC and VPC routing policies.\n\nWhat's next\n-----------\n\n- Design the [network segmentation and connectivity](/architecture/ccn-distributed-apps-design/connectivity) for Cross-Cloud Network applications.\n- Learn more about the Google Cloud products used in this design guide:\n - [VPC networks](/vpc/docs/vpc)\n - [Shared VPC](/vpc/docs/shared-vpc)\n - [VPC Network Peering](/vpc/docs/vpc-peering)\n - [Private Service Connect](/vpc/docs/private-service-connect)\n - [Private services access](/vpc/docs/private-services-access)\n- For more reference architectures, design guides, and best practices, explore the [Cloud Architecture Center](/architecture).\n\nContributors\n------------\n\nAuthors:\n\n- [Victor Moreno](https://www.linkedin.com/in/vimoreno) \\| Product Manager, Cloud Networking\n- [Ghaleb Al-habian](https://www.linkedin.com/in/galhabian) \\| Network Specialist\n- Deepak Michael \\| Networking Specialist Customer Engineer\n- [Osvaldo Costa](https://www.linkedin.com/in/osvaldocostajr) \\| Networking Specialist Customer Engineer\n- [Jonathan Almaleh](https://www.linkedin.com/in/jonathan-almaleh) \\| Staff Technical Solutions Consultant\n\n\u003cbr /\u003e\n\nOther contributors:\n\n- [Zach Seils](https://www.linkedin.com/in/zachseils) \\| Networking Specialist\n- [Christopher Abraham](https://www.linkedin.com/in/christopher-abraham-33291b) \\| Networking Specialist Customer Engineer\n- [Emanuele Mazza](https://www.linkedin.com/in/emanuelemazza) \\| Networking Product Specialist\n- [Aurélien Legrand](https://www.linkedin.com/in/aurelienlegrand) \\| Strategic Cloud Engineer\n- [Eric Yu](https://www.linkedin.com/in/eyu719) \\| Networking Specialist Customer Engineer\n- [Kumar Dhanagopal](https://www.linkedin.com/in/kumardhanagopal) \\| Cross-Product Solution Developer\n- [Mark Schlagenhauf](https://www.linkedin.com/in/mark-schlagenhauf-63b98) \\| Technical Writer, Networking\n- [Marwan Al Shawi](https://www.linkedin.com/in/marwanalshawi) \\| Partner Customer Engineer\n- [Ammett Williams](https://www.linkedin.com/in/ammett) \\| Developer Relations Engineer\n\n\u003cbr /\u003e"]]
