Legacy networks

Legacy networks are not recommended and can no longer be created. Many newer Google Cloud features are not supported in legacy networks. Instead, use Virtual Private Cloud (VPC) networks. For more information, see the VPC network overview.

If you already have a legacy network, you can migrate your virtual machine (VM) instances out of your legacy network to a VPC network. For instructions, see Migrating a VM between networks.

Legacy networks have a single RFC 1918 range, which you specify when you create the network. The network is global in scope and spans all cloud regions.

In a legacy network, instance IP addresses are not grouped by region or zone. One IP address can appear in one region, and the following IP address can be in a different region. Any given range of IPs can be spread across all regions, and the IP addresses of instances created within a region are not necessarily contiguous.

The figure below shows a legacy (non-VPC) network. Traffic from the Internet passes through a global switching function in the network (shown in the diagram as a virtual switch), then down to individual instances.

Instances in a region can have IP addresses that are not grouped in any way. As shown in the example, instances from are spread unpredictably across regions 1 and 2. For example, is in region 2, is in region 1, and is in region 2.

Diagram of a legacy network (click to enlarge)
Diagram of a legacy network (click to enlarge)

It is not possible to create regional subnets with a legacy network.

Differences between legacy and VPC networks

  • Legacy networks have a single global IP range that cannot be divided into subnets. VPC networks are divided into subnets. Each Google Cloud region can have one or more subnets in a VPC network.
  • Some Google Cloud networking features are not available in legacy networks.


Legacy networks start with only two routes, the default route to outside the network and the route to the overall legacy network IP range. See Using routes for instructions on creating routes.

Firewall rules

User-created networks have a default Allow-all firewall rule for outbound traffic and a default Deny-all firewall rule for inbound traffic. See Using firewall rules for instructions on creating firewall rules.

What's next