Mesh or Star
| Topology | Who reaches whom | Good for |
|---|---|---|
| Mesh | Every VPC on the hub reaches every other | Projects that work together, such as one system in two regions |
| Star: Center | Reaches every VPC on the hub | Shared services, such as a database or monitoring every team uses |
| Star: Edge | Reaches the centers only. Edges reach each other only through the hub’s firewall | Teams, branches or customers who must stay apart from each other |
You choose the topology when you create the hub, and it can’t change later. On a Star, the hub owner can switch a spoke between Center and Edge at any time.
Create a hub
- Open Network Hub in the menu (next to VPC) and click Create Network Hub.
- Enter a Hub name and choose the Owner project (whoever can change that project manages the hub) and the Home region. The hub connects VPCs in every region; the home region is only where it lives.
- Choose Mesh or Star. Leave Attach this project’s VPC as the first spoke on and, on a Star, choose its role. A shared-services project is usually the Center.
- Click Create.
Attach more VPCs
- On the hub’s page, click Add spoke.
- Choose A project in this account and pick the project, or Another account and enter the email of that account’s owner and their project slug. On a Star, choose the role.
- Click Attach. A project in another account, or one you can’t change, gets a request by email and in the Console instead, and joins once its side clicks Accept.
Attaching opens nothing by itself. On the receiving side, add a security group rule whose source is Network Hub (every VPC reached through the hub, or one VPC on it), on the ports you need (see Security groups).
Rules to know
- A VPC can be on one hub. A hub takes up to 50 spokes, and an account can own up to 5 hubs.
- The IP ranges of the VPCs on a hub must not overlap each other or their peerings. Plan ranges before you attach (see Landing zone).
- What comes in through the hub can’t go out through a VPC peering, and the other way round.
- The Routing table on the hub’s page shows, for each spoke, the routes the hub uses now: the destination, the next hop (a VPC, a VPN gateway or the firewall) and where each route came from.
- Either side can leave: the hub owner clicks Detach, the spoke’s project clicks Leave hub. Deleting the hub detaches every VPC.
Each attached VPC has a monthly fee, billed to that VPC’s own project for the hours it is attached. Requests that are waiting or declined cost nothing. Traffic through the hub is billed like VPC peering: Intra transfer within a region, Inter-region transfer between regions (see the pricing page).
If something goes wrong
Both VPCs are attached but nothing gets through
Check that both show Attached, not Waiting for acceptance; that their roles let them reach each other (two Edges don’t, unless the hub’s firewall carries traffic between spokes); and that a security group rule on the receiving side has Network Hub as its source.
It says the IP ranges overlap
Another VPC on the hub, or a VPC one of them peers with, already uses that range. Move one VPC to a range that doesn’t overlap in VPC settings (see VPC and subnets), then attach again.
My project isn’t in the list when I add a spoke
A VPC can be on only one hub. Detach it from the other hub first.