<mxfile host="thecodeclouds.com" agent="hand-built" version="24.0.0" type="device">
<diagram id="hld" name="HLD: hub-and-spoke on Google Cloud"><mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1500" pageHeight="960" math="0" shadow="0"><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="c1" value="High-level design: one NCC hub, a center group that owns shared services and hybrid links, edge spokes per environment" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=17;fontColor=#232F3E;fontStyle=1;spacing=0;" vertex="1" parent="1"><mxGeometry x="20" y="16" width="1460" height="23" as="geometry"/></mxCell>
<mxCell id="dc" value='&lt;b&gt;On-premises&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;10.0.0.0/12&lt;/font&gt;' style="points=[];outlineConnect=0;gradientColor=none;html=1;whiteSpace=wrap;fontSize=12;fontStyle=0;container=0;pointerEvents=0;collapsible=0;recursiveResize=0;shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_corporate_data_center;strokeColor=#7D8998;fillColor=#F7F8FA;verticalAlign=top;align=left;spacingLeft=30;fontColor=#5A6C86;dashed=0;" vertex="1" parent="1"><mxGeometry x="20" y="360" width="210" height="210" as="geometry"/></mxCell>
<mxCell id="rtr" value='&lt;b&gt;Edge routers&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;2 colocation metros&lt;/font&gt;' style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="103" y="430" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="c3" value="&lt;b&gt;Google Cloud organization  ·  folders: network / prod / non-prod / dev / data&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#FFFFFF;strokeWidth=1.5;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="260" y="60" width="1220" height="880" as="geometry"/></mxCell>
<mxCell id="c4" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#4285F4;shape=mxgraph.gcp2.google_cloud_platform;" vertex="1" parent="1"><mxGeometry x="268" y="65" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="hubproj" value="&lt;b&gt;Network hub project (net-hub)&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="285" y="105" width="460" height="810" as="geometry"/></mxCell>
<mxCell id="rvpc" value='&lt;b&gt;Routing VPC  ·  center&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;10.40.0.0/24&lt;/font&gt;' style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="305" y="150" width="240" height="270" as="geometry"/></mxCell>
<mxCell id="c7" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="313" y="155" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="ic" value='&lt;b&gt;VLAN attachments&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;4, two metros&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.dedicated_interconnect;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="325" y="200" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="vpn" value='&lt;b&gt;HA VPN&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;backup&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_vpn;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="325" y="275" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="cr" value='&lt;b&gt;Cloud Routers&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;one per region&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_router;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="325" y="350" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="svpc" value='&lt;b&gt;Shared services VPC  ·  center&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;10.41.0.0/16&lt;/font&gt;' style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="305" y="610" width="240" height="270" as="geometry"/></mxCell>
<mxCell id="c9" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="313" y="615" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="dns" value='&lt;b&gt;Cloud DNS hub&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;forwarding + peering&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_dns;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="325" y="660" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="psc" value='&lt;b&gt;PSC endpoints&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;Google APIs, SaaS&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.gateway;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="328" y="735" width="40" height="40" as="geometry"/></mxCell>
<mxCell id="mon" value='&lt;b&gt;Flow logs sink&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;firewall logs&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.logging;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="325" y="805" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="hub" value='&lt;b&gt;NCC hub&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;star topology&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_network;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="640" y="472" width="60" height="53.15" as="geometry"/></mxCell>
<mxCell id="c10" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.25;entryDx=0;entryDy=0;" edge="1" parent="1" source="rvpc" target="hub"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="600" y="285"/><mxPoint x="600" y="485"/></Array></mxGeometry></mxCell>
<mxCell id="c11" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.75;entryDx=0;entryDy=0;" edge="1" parent="1" source="svpc" target="hub"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="600" y="745"/><mxPoint x="600" y="512"/></Array></mxGeometry></mxCell>
<mxCell id="c12" value="center group" style="text;html=1;whiteSpace=wrap;align=center;verticalAlign=top;fontSize=10;fontColor=#5F6368;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="560" y="545" width="70" height="16" as="geometry"/></mxCell>
<mxCell id="sp0" value='&lt;b&gt;Prod Shared VPC  ·  edge&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;host: net-prod  ·  10.32.0.0/14&lt;/font&gt;' style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="800" y="105" width="655" height="185" as="geometry"/></mxCell>
<mxCell id="c14" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="808" y="110" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="sp0i0" value="&lt;b&gt;GKE&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.container_engine;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="830" y="187" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="sp0i1" value="&lt;b&gt;External ALB&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_load_balancing;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="1040" y="187" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="sp0i2" value="&lt;b&gt;Cloud Armor&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_armor;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="1250" y="187" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c15" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="hub" target="sp0"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="sp1" value='&lt;b&gt;Non-prod Shared VPC  ·  edge&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;host: net-nonprod  ·  10.36.0.0/14&lt;/font&gt;' style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="800" y="310" width="655" height="185" as="geometry"/></mxCell>
<mxCell id="c17" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="808" y="315" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="sp1i0" value="&lt;b&gt;GKE&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.container_engine;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="830" y="392" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="sp1i1" value="&lt;b&gt;VMs&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.compute_engine;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="1040" y="392" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="sp1i2" value="&lt;b&gt;Cloud NAT&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_nat;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="1250" y="392" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c18" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="hub" target="sp1"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="sp2" value='&lt;b&gt;Dev Shared VPC  ·  edge&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;host: net-dev  ·  10.44.0.0/14&lt;/font&gt;' style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="800" y="515" width="655" height="185" as="geometry"/></mxCell>
<mxCell id="c20" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="808" y="520" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="sp2i0" value="&lt;b&gt;Cloud Run&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_run;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="830" y="597" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="sp2i1" value="&lt;b&gt;VMs&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.compute_engine;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="1040" y="597" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="sp2i2" value="&lt;b&gt;Cloud NAT&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_nat;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="1250" y="597" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c21" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="hub" target="sp2"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="sp3" value='&lt;b&gt;Data VPC  ·  edge&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;host: net-data  ·  10.48.0.0/14&lt;/font&gt;' style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="800" y="720" width="655" height="185" as="geometry"/></mxCell>
<mxCell id="c23" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="808" y="725" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="sp3i0" value="&lt;b&gt;Cloud SQL (PSC)&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_sql;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="830" y="802" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="sp3i1" value="&lt;b&gt;BigQuery&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.bigquery;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="1040" y="802" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="sp3i2" value="&lt;b&gt;Cloud Storage&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_storage;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="1250" y="802" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c24" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="hub" target="sp3"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c25" value="edge spokes: they reach the center group, never each other (star topology)" style="text;html=1;whiteSpace=wrap;align=center;verticalAlign=top;fontSize=11;fontColor=#D93025;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="800" y="920" width="655" height="17" as="geometry"/></mxCell>
<mxCell id="c26" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5A6C86;strokeWidth=3;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.4;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="dc" target="ic"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="260" y="444"/><mxPoint x="260" y="220.5"/></Array></mxGeometry></mxCell>
<mxCell id="c27" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2;dashed=1;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.6;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="dc" target="vpn"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="280" y="486"/><mxPoint x="280" y="295.5"/></Array></mxGeometry></mxCell>
<mxCell id="c28" value="Interconnect" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=10;fontColor=#5A6C86;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="236" y="190" width="90" height="16" as="geometry"/></mxCell>
<mxCell id="c29" value="VPN" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=10;fontColor=#E8710A;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="284" y="312" width="40" height="16" as="geometry"/></mxCell>
<mxCell id="c30" value="&lt;b&gt;Legend&lt;/b&gt;" style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="20" y="760" width="225" height="93" as="geometry"/></mxCell>
<mxCell id="c31" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="34" y="798" as="sourcePoint"/><mxPoint x="74" y="798" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c32" value="NCC spoke attachment" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="86" y="791" width="149" height="17" as="geometry"/></mxCell>
<mxCell id="c33" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5A6C86;strokeWidth=3;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="34" y="819" as="sourcePoint"/><mxPoint x="74" y="819" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c34" value="Cloud Interconnect" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="86" y="812" width="149" height="17" as="geometry"/></mxCell>
<mxCell id="c35" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="34" y="840" as="sourcePoint"/><mxPoint x="74" y="840" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c36" value="HA VPN backup" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="86" y="833" width="149" height="17" as="geometry"/></mxCell></root></mxGraphModel></diagram>
<diagram id="subnets" name="LLD 1: subnets and IP plan"><mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1500" pageHeight="920" math="0" shadow="0"><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="c1" value="Low-level design 1: the prod Shared VPC, two regions, and where every address comes from" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=17;fontColor=#232F3E;fontStyle=1;spacing=0;" vertex="1" parent="1"><mxGeometry x="20" y="16" width="1460" height="23" as="geometry"/></mxCell>
<mxCell id="c2" value="&lt;b&gt;Prod Shared VPC  ·  host project net-prod  ·  10.32.0.0/14  ·  global dynamic routing  ·  MTU 1500&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="20" y="60" width="1460" height="680" as="geometry"/></mxCell>
<mxCell id="c3" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="28" y="65" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="c4" value="Rule: one /16 per region, one /14 per environment, pods from 100.64.0.0/10 kept out of NCC with an export exclude filter" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=12;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="45" y="105" width="1400" height="18" as="geometry"/></mxCell>
<mxCell id="c5" value="&lt;b&gt;europe-west2 (London)&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=none;strokeWidth=1;dashed=1;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="40" y="150" width="700" height="560" as="geometry"/></mxCell>
<mxCell id="c6" value='&lt;b&gt;gke-nodes  ·  10.32.0.0/20&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;secondary: pods 100.64.0.0/14 (not exported)  ·  services 10.32.16.0/22&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#AECBFA;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#1A73E8;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="60" y="195" width="660" height="80" as="geometry"/></mxCell>
<mxCell id="r32i0" value="&lt;b&gt;&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.container_engine;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="650" y="213" width="50" height="44.29" as="geometry"/></mxCell>
<mxCell id="c7" value='&lt;b&gt;workloads  ·  10.32.32.0/20&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;VMs, internal load balancer frontends&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#AECBFA;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#1A73E8;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="60" y="295" width="660" height="80" as="geometry"/></mxCell>
<mxCell id="r32i1" value="&lt;b&gt;&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.compute_engine;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="650" y="313" width="50" height="44.29" as="geometry"/></mxCell>
<mxCell id="c8" value='&lt;b&gt;proxy-only  ·  10.32.48.0/23&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;purpose REGIONAL_MANAGED_PROXY, for internal and regional ALBs&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#AECBFA;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#1A73E8;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="60" y="395" width="660" height="80" as="geometry"/></mxCell>
<mxCell id="r32i2" value="&lt;b&gt;&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_load_balancing;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="650" y="413" width="50" height="44.29" as="geometry"/></mxCell>
<mxCell id="c9" value='&lt;b&gt;psc  ·  10.32.50.0/24&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;Private Service Connect endpoints and NAT subnet for published services&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#AECBFA;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#1A73E8;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="60" y="495" width="660" height="80" as="geometry"/></mxCell>
<mxCell id="r32i3" value="&lt;b&gt;&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.gateway;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="655" y="513" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="nat32" value='&lt;b&gt;Cloud NAT + Cloud Router&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;dynamic port allocation, NAT logs on&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_nat;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="70" y="610" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c10" value="reserved for growth: 10.32.64.0/18 and up" style="text;html=1;whiteSpace=wrap;align=right;verticalAlign=top;fontSize=11;fontColor=#5F6368;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="440" y="625" width="280" height="17" as="geometry"/></mxCell>
<mxCell id="c11" value="&lt;b&gt;europe-west3 (Frankfurt)&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=none;strokeWidth=1;dashed=1;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="760" y="150" width="700" height="560" as="geometry"/></mxCell>
<mxCell id="c12" value='&lt;b&gt;gke-nodes  ·  10.33.0.0/20&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;secondary: pods 100.68.0.0/14 (not exported)  ·  services 10.33.16.0/22&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#AECBFA;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#1A73E8;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="780" y="195" width="660" height="80" as="geometry"/></mxCell>
<mxCell id="r33i0" value="&lt;b&gt;&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.container_engine;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1370" y="213" width="50" height="44.29" as="geometry"/></mxCell>
<mxCell id="c13" value='&lt;b&gt;workloads  ·  10.33.32.0/20&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;VMs, internal load balancer frontends&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#AECBFA;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#1A73E8;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="780" y="295" width="660" height="80" as="geometry"/></mxCell>
<mxCell id="r33i1" value="&lt;b&gt;&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.compute_engine;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1370" y="313" width="50" height="44.29" as="geometry"/></mxCell>
<mxCell id="c14" value='&lt;b&gt;proxy-only  ·  10.33.48.0/23&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;purpose REGIONAL_MANAGED_PROXY, for internal and regional ALBs&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#AECBFA;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#1A73E8;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="780" y="395" width="660" height="80" as="geometry"/></mxCell>
<mxCell id="r33i2" value="&lt;b&gt;&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_load_balancing;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1370" y="413" width="50" height="44.29" as="geometry"/></mxCell>
<mxCell id="c15" value='&lt;b&gt;psc  ·  10.33.50.0/24&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;Private Service Connect endpoints and NAT subnet for published services&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#AECBFA;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#1A73E8;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="780" y="495" width="660" height="80" as="geometry"/></mxCell>
<mxCell id="r33i3" value="&lt;b&gt;&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.gateway;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1375" y="513" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="nat33" value='&lt;b&gt;Cloud NAT + Cloud Router&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;dynamic port allocation, NAT logs on&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_nat;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="790" y="610" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c16" value="reserved for growth: 10.33.64.0/18 and up" style="text;html=1;whiteSpace=wrap;align=right;verticalAlign=top;fontSize=11;fontColor=#5F6368;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1160" y="625" width="280" height="17" as="geometry"/></mxCell>
<mxCell id="c17" value="&lt;b&gt;Service projects attached to net-prod&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="20" y="770" width="1460" height="130" as="geometry"/></mxCell>
<mxCell id="iam" value='&lt;b&gt;roles/compute.networkUser&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;granted per subnet, not per project&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_iam;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="45" y="815" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c18" value='&lt;b&gt;prod-payments&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;uses: gke-nodes (both regions)&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="400" y="805" width="330" height="70" as="geometry"/></mxCell>
<mxCell id="c19" value='&lt;b&gt;prod-orders&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;uses: gke-nodes, workloads&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="760" y="805" width="330" height="70" as="geometry"/></mxCell>
<mxCell id="c20" value='&lt;b&gt;prod-batch&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;uses: workloads (europe-west2 only)&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="1120" y="805" width="330" height="70" as="geometry"/></mxCell></root></mxGraphModel></diagram>
<diagram id="hybrid" name="LLD 2: hybrid connectivity and routing"><mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1500" pageHeight="960" math="0" shadow="0"><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="c1" value="Low-level design 2: 99.99% Interconnect topology, HA VPN backup and what BGP advertises" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=17;fontColor=#232F3E;fontStyle=1;spacing=0;" vertex="1" parent="1"><mxGeometry x="20" y="16" width="1460" height="23" as="geometry"/></mxCell>
<mxCell id="rvpc" value="&lt;b&gt;Routing VPC (net-hub)  ·  global dynamic routing  ·  hybrid spokes in the NCC center group&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="340" y="60" width="640" height="880" as="geometry"/></mxCell>
<mxCell id="c3" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="348" y="65" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="c4" value="&lt;b&gt;europe-west2&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=none;strokeWidth=1;dashed=1;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="360" y="105" width="600" height="330" as="geometry"/></mxCell>
<mxCell id="c5" value="&lt;b&gt;europe-west3&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=none;strokeWidth=1;dashed=1;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="360" y="455" width="600" height="330" as="geometry"/></mxCell>
<mxCell id="c6" value="&lt;b&gt;Colocation metro A (London)&lt;/b&gt;" style="points=[];outlineConnect=0;gradientColor=none;html=1;whiteSpace=wrap;fontSize=12;fontStyle=0;container=0;pointerEvents=0;collapsible=0;recursiveResize=0;shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_corporate_data_center;strokeColor=#7D8998;fillColor=#F7F8FA;verticalAlign=top;align=left;spacingLeft=30;fontColor=#5A6C86;dashed=0;" vertex="1" parent="1"><mxGeometry x="20" y="105" width="270" height="300" as="geometry"/></mxCell>
<mxCell id="crA" value='&lt;b&gt;cr-ew2&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;ASN 64514&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="820" y="228.5" width="60" height="53.15" as="geometry"/></mxCell>
<mxCell id="rA0" value='&lt;b&gt;edge router A1&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;ASN 65010&lt;/font&gt;' style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="100" y="173" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="aA0" value='&lt;b&gt;VLAN attachment&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;edge domain 1 · 10G · MTU 1500&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.dedicated_interconnect;labelPosition=center;verticalLabelPosition=top;align=center;verticalAlign=bottom;" vertex="1" parent="1"><mxGeometry x="470" y="174.7" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="c7" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5A6C86;strokeWidth=3;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="rA0" target="aA0"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c8" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="aA0" target="crA"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="720" y="195"/><mxPoint x="720" y="255"/></Array></mxGeometry></mxCell>
<mxCell id="rA1" value='&lt;b&gt;edge router A2&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;ASN 65010&lt;/font&gt;' style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="100" y="293" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="aA1" value='&lt;b&gt;VLAN attachment&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;edge domain 2 · 10G · MTU 1500&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.dedicated_interconnect;labelPosition=center;verticalLabelPosition=top;align=center;verticalAlign=bottom;" vertex="1" parent="1"><mxGeometry x="470" y="294.7" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="c9" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5A6C86;strokeWidth=3;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="rA1" target="aA1"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c10" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="aA1" target="crA"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="720" y="315"/><mxPoint x="720" y="255"/></Array></mxGeometry></mxCell>
<mxCell id="c11" value="&lt;b&gt;Colocation metro B (Frankfurt)&lt;/b&gt;" style="points=[];outlineConnect=0;gradientColor=none;html=1;whiteSpace=wrap;fontSize=12;fontStyle=0;container=0;pointerEvents=0;collapsible=0;recursiveResize=0;shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_corporate_data_center;strokeColor=#7D8998;fillColor=#F7F8FA;verticalAlign=top;align=left;spacingLeft=30;fontColor=#5A6C86;dashed=0;" vertex="1" parent="1"><mxGeometry x="20" y="455" width="270" height="300" as="geometry"/></mxCell>
<mxCell id="crB" value='&lt;b&gt;cr-ew3&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;ASN 64514&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="820" y="578.5" width="60" height="53.15" as="geometry"/></mxCell>
<mxCell id="rB0" value='&lt;b&gt;edge router B1&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;ASN 65010&lt;/font&gt;' style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="100" y="523" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="aB0" value='&lt;b&gt;VLAN attachment&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;edge domain 1 · 10G · MTU 1500&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.dedicated_interconnect;labelPosition=center;verticalLabelPosition=top;align=center;verticalAlign=bottom;" vertex="1" parent="1"><mxGeometry x="470" y="524.7" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="c12" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5A6C86;strokeWidth=3;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="rB0" target="aB0"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c13" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="aB0" target="crB"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="720" y="545"/><mxPoint x="720" y="605"/></Array></mxGeometry></mxCell>
<mxCell id="rB1" value='&lt;b&gt;edge router B2&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;ASN 65010&lt;/font&gt;' style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="100" y="643" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="aB1" value='&lt;b&gt;VLAN attachment&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;edge domain 2 · 10G · MTU 1500&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.dedicated_interconnect;labelPosition=center;verticalLabelPosition=top;align=center;verticalAlign=bottom;" vertex="1" parent="1"><mxGeometry x="470" y="644.7" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="c14" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5A6C86;strokeWidth=3;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="rB1" target="aB1"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c15" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="aB1" target="crB"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="720" y="665"/><mxPoint x="720" y="605"/></Array></mxGeometry></mxCell>
<mxCell id="c16" value="&lt;b&gt;Branch / DR site&lt;/b&gt;" style="points=[];outlineConnect=0;gradientColor=none;html=1;whiteSpace=wrap;fontSize=12;fontStyle=0;container=0;pointerEvents=0;collapsible=0;recursiveResize=0;shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_corporate_data_center;strokeColor=#7D8998;fillColor=#F7F8FA;verticalAlign=top;align=left;spacingLeft=30;fontColor=#5A6C86;dashed=0;" vertex="1" parent="1"><mxGeometry x="20" y="800" width="270" height="140" as="geometry"/></mxCell>
<mxCell id="vpndev" value='&lt;b&gt;VPN device&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;public IP&lt;/font&gt;' style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="100" y="845" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="havpn" value='&lt;b&gt;HA VPN  ·  2 tunnels, BGP&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;advertised priority 10000&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_vpn;labelPosition=center;verticalLabelPosition=top;align=center;verticalAlign=bottom;" vertex="1" parent="1"><mxGeometry x="470" y="846.7" width="46" height="40.75" as="geometry"/></mxCell>
<mxCell id="c17" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2;dashed=1;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="vpndev" target="havpn"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c18" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="havpn" target="crA"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="930" y="867"/><mxPoint x="930" y="255"/></Array></mxGeometry></mxCell>
<mxCell id="c19" value="backup over the internet" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=10;fontColor=#E8710A;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="300" y="878" width="160" height="16" as="geometry"/></mxCell>
<mxCell id="hub" value="&lt;b&gt;NCC hub&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_network;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1030" y="455" width="56" height="49.61" as="geometry"/></mxCell>
<mxCell id="c20" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.53;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="rvpc" target="hub"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="sp" value='&lt;b&gt;VPC spokes learn on-prem routes&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;through dynamic route exchange&lt;/font&gt;' style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="1150" y="400" width="330" height="190" as="geometry"/></mxCell>
<mxCell id="c22" value="prod, non-prod, dev, data:&lt;br&gt;10.0.0.0/12 via hybrid spokes&lt;br&gt;region-wide or global, per the&lt;br&gt;routing VPC dynamic routing mode" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1165" y="455" width="310" height="62" as="geometry"/></mxCell>
<mxCell id="c23" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="hub" target="sp"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c24" value="&lt;b&gt;BGP policy on every Cloud Router&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="1030" y="60" width="450" height="310" as="geometry"/></mxCell>
<mxCell id="c25" value="Advertise (custom mode, summaries only):&lt;br&gt;  10.32.0.0/11      every Google Cloud VPC&lt;br&gt;  35.199.192.0/19   Cloud DNS forwarding source&lt;br&gt;  199.36.153.8/30   private.googleapis.com&lt;br&gt;&lt;br&gt;Learn from on-prem: 10.0.0.0/12 only&lt;br&gt;(prefix filter on the on-prem side too)&lt;br&gt;&lt;br&gt;Prefer Interconnect: advertised priority (MED)&lt;br&gt;  100 on VLAN attachments, 10000 on HA VPN" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1045" y="100" width="430" height="152" as="geometry"/></mxCell>
<mxCell id="c26" value="&lt;b&gt;Why four attachments&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="1030" y="630" width="450" height="310" as="geometry"/></mxCell>
<mxCell id="c27" value="99.99% needs two metros, two regions,&lt;br&gt;and two edge availability domains in each.&lt;br&gt;Lose one router, one attachment or a whole&lt;br&gt;metro, and BGP still has a path.&lt;br&gt;&lt;br&gt;Check after every change:&lt;br&gt;  gcloud compute routers get-status cr-ew2 \&lt;br&gt;    --region europe-west2&lt;br&gt;  (bestRoutes, BGP peer status per session)" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1045" y="670" width="430" height="137" as="geometry"/></mxCell></root></mxGraphModel></diagram>
<diagram id="flows" name="LLD 3: traffic flows and security controls"><mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1500" pageHeight="960" math="0" shadow="0"><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="c1" value="Low-level design 3: five traffic flows through the hub, and the control that guards each one" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=17;fontColor=#232F3E;fontStyle=1;spacing=0;" vertex="1" parent="1"><mxGeometry x="20" y="16" width="1460" height="23" as="geometry"/></mxCell>
<mxCell id="users" value="&lt;b&gt;Internet users&lt;/b&gt;" style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#232F3E;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.users;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="80" y="147" width="52" height="52" as="geometry"/></mxCell>
<mxCell id="inet" value='&lt;b&gt;Internet&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;OS repos, SaaS APIs&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="960" y="143" width="200" height="60" as="geometry"/></mxCell>
<mxCell id="c3" value="&lt;b&gt;Prod Shared VPC  ·  edge spoke  ·  net-prod  ·  10.32.0.0/14&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="270" y="60" width="640" height="560" as="geometry"/></mxCell>
<mxCell id="c4" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="278" y="65" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="armor" value='&lt;b&gt;Cloud Armor&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;WAF + rate limits&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_armor;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="300" y="150" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="alb" value='&lt;b&gt;Global external ALB&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;anycast IP, TLS&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_load_balancing;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="470" y="150" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="nat" value='&lt;b&gt;Cloud NAT&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;static egress IPs&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_nat;labelPosition=center;verticalLabelPosition=top;align=center;verticalAlign=bottom;" vertex="1" parent="1"><mxGeometry x="820" y="160" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="gke" value='&lt;b&gt;GKE payments&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;pods 100.64.0.0/14&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.container_engine;labelPosition=left;verticalLabelPosition=middle;align=right;verticalAlign=middle;spacingRight=4;" vertex="1" parent="1"><mxGeometry x="650" y="290" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="ilb" value='&lt;b&gt;Internal ALB&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;10.32.32.10&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_load_balancing;labelPosition=left;verticalLabelPosition=middle;align=right;verticalAlign=middle;spacingRight=4;" vertex="1" parent="1"><mxGeometry x="470" y="420" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="psc" value='&lt;b&gt;PSC endpoint&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;10.32.50.5&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.gateway;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="820" y="420" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="pdns" value='&lt;b&gt;Cloud DNS (prod)&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;peering zone to&lt;br&gt;shared services&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_dns;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="663" y="500" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c5" value="Network firewall policy:&lt;br&gt;secure tags, deny by default&lt;br&gt;VPC flow logs on every subnet" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="290" y="550" width="190" height="47" as="geometry"/></mxCell>
<mxCell id="c6" value="&lt;b&gt;Data project (producer)&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="960" y="380" width="220" height="200" as="geometry"/></mxCell>
<mxCell id="sql" value='&lt;b&gt;Cloud SQL&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;service attachment&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_sql;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1040" y="419" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="hub" value="&lt;b&gt;NCC hub&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_network;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="478" y="634" width="36" height="31.89" as="geometry"/></mxCell>
<mxCell id="c7" value="&lt;b&gt;On-premises&lt;/b&gt;" style="points=[];outlineConnect=0;gradientColor=none;html=1;whiteSpace=wrap;fontSize=12;fontStyle=0;container=0;pointerEvents=0;collapsible=0;recursiveResize=0;shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_corporate_data_center;strokeColor=#7D8998;fillColor=#F7F8FA;verticalAlign=top;align=left;spacingLeft=30;fontColor=#5A6C86;dashed=0;" vertex="1" parent="1"><mxGeometry x="20" y="680" width="220" height="260" as="geometry"/></mxCell>
<mxCell id="rtr" value="&lt;b&gt;Edge routers&lt;/b&gt;" style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="98" y="751" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="odns" value="&lt;b&gt;On-prem DNS 10.0.0.53&lt;/b&gt;" style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.traditional_server;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="98" y="860" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="c8" value="&lt;b&gt;Routing VPC  ·  center&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="270" y="680" width="310" height="260" as="geometry"/></mxCell>
<mxCell id="c9" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="278" y="685" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="ic" value='&lt;b&gt;VLAN&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;attachments&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.dedicated_interconnect;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="320" y="750" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="cr" value="&lt;b&gt;Cloud Router&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="470" y="750" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c10" value="&lt;b&gt;Shared services VPC  ·  center&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="600" y="680" width="310" height="260" as="geometry"/></mxCell>
<mxCell id="c11" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="608" y="685" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="sdns" value='&lt;b&gt;Forwarding zone&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;corp.example.com&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_dns;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="663" y="760" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c12" style="edgeStyle=none;html=1;rounded=0;strokeColor=#1E8E3E;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="users" target="armor"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c13" style="edgeStyle=none;html=1;rounded=0;strokeColor=#1E8E3E;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="armor" target="alb"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c14" style="edgeStyle=none;html=1;rounded=0;strokeColor=#1E8E3E;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="alb" target="gke"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="676" y="173"/></Array></mxGeometry></mxCell>
<mxCell id="c15" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="rtr" target="ic"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c16" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="ic" target="cr"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c17" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="cr" target="hub"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c18" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="hub" target="ilb"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c19" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0.3;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="ilb" target="gke"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="665.6" y="443"/></Array></mxGeometry></mxCell>
<mxCell id="c20" style="edgeStyle=none;html=1;rounded=0;strokeColor=#8430CE;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.75;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="gke" target="psc"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="842" y="324.5"/></Array></mxGeometry></mxCell>
<mxCell id="c21" style="edgeStyle=none;html=1;rounded=0;strokeColor=#8430CE;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="psc" target="sql"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c22" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.25;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="gke" target="nat"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="846" y="301.5"/></Array></mxGeometry></mxCell>
<mxCell id="c23" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="nat" target="inet"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c24" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5F6368;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.75;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="gke" target="pdns"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c25" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5F6368;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="pdns" target="sdns"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c26" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5F6368;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="sdns" target="odns"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="689" y="882"/></Array></mxGeometry></mxCell>
<mxCell id="c27" value="queries leave from 35.199.192.0/19" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=10;fontColor=#5F6368;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="300" y="888" width="260" height="16" as="geometry"/></mxCell>
<mxCell id="c28" value="1" style="ellipse;html=1;fillColor=#1E8E3E;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="200" y="140" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c29" value="2" style="ellipse;html=1;fillColor=#4285F4;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="255" y="738" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c30" value="3" style="ellipse;html=1;fillColor=#8430CE;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="900" y="410" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c31" value="4" style="ellipse;html=1;fillColor=#E8710A;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="900" y="150" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c32" value="5" style="ellipse;html=1;fillColor=#5F6368;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="700" y="640" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c33" value="&lt;b&gt;Legend&lt;/b&gt;" style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="960" y="620" width="220" height="135" as="geometry"/></mxCell>
<mxCell id="c34" style="edgeStyle=none;html=1;rounded=0;strokeColor=#1E8E3E;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="658" as="sourcePoint"/><mxPoint x="1014" y="658" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c35" value="1  internet ingress" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="651" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c36" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="679" as="sourcePoint"/><mxPoint x="1014" y="679" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c37" value="2  on-prem to prod" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="672" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c38" style="edgeStyle=none;html=1;rounded=0;strokeColor=#8430CE;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="700" as="sourcePoint"/><mxPoint x="1014" y="700" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c39" value="3  consumer to producer" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="693" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c40" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="721" as="sourcePoint"/><mxPoint x="1014" y="721" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c41" value="4  egress to internet" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="714" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c42" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5F6368;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="742" as="sourcePoint"/><mxPoint x="1014" y="742" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c43" value="5  DNS resolution" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="735" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c44" value="&lt;b&gt;The control on each flow&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="1210" y="60" width="270" height="880" as="geometry"/></mxCell>
<mxCell id="c45" value="1  Cloud Armor on the backend service.&lt;br&gt;Firewall allows only the Google&lt;br&gt;front ends: 35.191.0.0/16 and&lt;br&gt;130.211.0.0/22.&lt;br&gt;&lt;br&gt;2  Cloud Router advertises summaries,&lt;br&gt;learns 10.0.0.0/12 only. Firewall&lt;br&gt;rule: on-prem ranges to tag&lt;br&gt;payments-api on 443.&lt;br&gt;&lt;br&gt;3  Prod never routes to the data VPC&lt;br&gt;(edge to edge is blocked in star).&lt;br&gt;It reaches Cloud SQL through its&lt;br&gt;own PSC endpoint. The producer&lt;br&gt;accepts consumers by project.&lt;br&gt;&lt;br&gt;4  Cloud NAT with static IPs so&lt;br&gt;SaaS vendors can allow-list you.&lt;br&gt;Egress firewall: FQDN objects,&lt;br&gt;deny the rest.&lt;br&gt;&lt;br&gt;5  Spokes peer DNS to shared&lt;br&gt;services. One forwarding zone&lt;br&gt;sends corp.example.com on-prem.&lt;br&gt;On-prem routers must accept&lt;br&gt;35.199.192.0/19.&lt;br&gt;&lt;br&gt;Everywhere:&lt;br&gt;hierarchical firewall policy at&lt;br&gt;the org node, IAP for admin SSH&lt;br&gt;from 35.235.240.0/20, VPC Service&lt;br&gt;Controls around data projects." style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1225" y="100" width="250" height="482" as="geometry"/></mxCell></root></mxGraphModel></diagram>
</mxfile>
