sincecutoff.com
← all changes

Network Connectivity linked spokes support hybrid spoke filters

Introduced 2026-03-24 · score 0.96

HOW TO USE IT

When creating or updating a linked router appliance, interconnect attachment, or VPN tunnel spoke, set the include and exclude import/export range flags to filter routes. Supply only the ranges you need; on create, also provide the hub and linked resource arguments.

gcloud network-connectivity spokes linked-router-appliances update <SPOKE> --region=<REGION> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>
gcloud network-connectivity spokes linked-interconnect-attachments create <SPOKE> --region=<REGION> --hub=<HUB> --interconnect-attachments=<ATTACHMENT_URI,...> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>
gcloud network-connectivity spokes linked-vpn-tunnels create <SPOKE> --region=<REGION> --hub=<HUB> --vpn-tunnels=<TUNNEL_URI,...> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>

WHY THIS HELPS

Configure hybrid spoke filters for linked router appliances, interconnect attachments, or VPN tunnels.

REQUIREMENTS AND LIMITATIONS

  • <SPOKE> (required): Spoke ID or fully qualified spoke identifier.
  • --region (required): Spoke location; can be omitted if the spoke identifier is fully qualified.
  • --hub (required): Hub for the new spoke; it must already exist.
  • --interconnect-attachments (required): Existing VLAN attachment resources linked to the spoke.
  • --vpn-tunnels (required): Existing HA VPN tunnel resources linked to the spoke.
  • --include-import-ranges: Import hub routes fully encompassed by the ranges; empty means no hub subnets, with a site-to-site data transfer exception documented for IPv4 dynamic routes.
  • --exclude-import-ranges: Exclude hub routes overlapped or encompassed by these ranges during import.
  • --include-export-ranges: Export dynamic routes fully encompassed by these ranges; empty means export all dynamic routes.
  • --exclude-export-ranges: Exclude dynamic routes overlapped or encompassed by these ranges during export.
  • --router-appliance (required): On create, specify one or more router appliance instances and IP addresses; on update, optional and replaces the linked instance set when supplied.
  • Prerequisite: For create commands, the hub and linked resources must already exist.
  • Prerequisite: Updating spokes requires `networkconnectivity.spokes.update` permission; documented roles include Spoke Admin and Hub & Spoke Admin.
  • The flags apply to the listed linked-router-appliances, linked-interconnect-attachments, and linked-vpn-tunnels create and update commands.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card