The gcp:compute/router:Router resource, part of the Pulumi GCP provider, defines a Cloud Router that enables dynamic BGP routing between your VPC and external networks. This guide focuses on three capabilities: BGP configuration with custom route advertisements, encrypted interconnect support, and Network Connectivity Center integration.
Cloud Routers attach to VPC networks and enable dynamic routing via BGP. They may connect to on-premises networks via Cloud Interconnect, peer with other cloud providers, or integrate with Network Connectivity Center. The examples are intentionally small. Combine them with your own VPC infrastructure, interconnect attachments, or NCC topology.
Configure BGP routing with custom advertisements
Cloud Router enables dynamic routing between your VPC and external networks. Most deployments configure BGP with an ASN and control which routes the router advertises to peers.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const foobarNetwork = new gcp.compute.Network("foobar", {
name: "my-network",
autoCreateSubnetworks: false,
});
const foobar = new gcp.compute.Router("foobar", {
name: "my-router",
network: foobarNetwork.name,
bgp: {
asn: 64514,
advertiseMode: "CUSTOM",
advertisedGroups: ["ALL_SUBNETS"],
advertisedIpRanges: [
{
range: "1.2.3.4",
},
{
range: "6.7.0.0/16",
},
],
},
});
import pulumi
import pulumi_gcp as gcp
foobar_network = gcp.compute.Network("foobar",
name="my-network",
auto_create_subnetworks=False)
foobar = gcp.compute.Router("foobar",
name="my-router",
network=foobar_network.name,
bgp={
"asn": 64514,
"advertise_mode": "CUSTOM",
"advertised_groups": ["ALL_SUBNETS"],
"advertised_ip_ranges": [
{
"range": "1.2.3.4",
},
{
"range": "6.7.0.0/16",
},
],
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
foobarNetwork, err := compute.NewNetwork(ctx, "foobar", &compute.NetworkArgs{
Name: pulumi.String("my-network"),
AutoCreateSubnetworks: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = compute.NewRouter(ctx, "foobar", &compute.RouterArgs{
Name: pulumi.String("my-router"),
Network: foobarNetwork.Name,
Bgp: &compute.RouterBgpArgs{
Asn: pulumi.Int(64514),
AdvertiseMode: pulumi.String("CUSTOM"),
AdvertisedGroups: pulumi.StringArray{
pulumi.String("ALL_SUBNETS"),
},
AdvertisedIpRanges: compute.RouterBgpAdvertisedIpRangeArray{
&compute.RouterBgpAdvertisedIpRangeArgs{
Range: pulumi.String("1.2.3.4"),
},
&compute.RouterBgpAdvertisedIpRangeArgs{
Range: pulumi.String("6.7.0.0/16"),
},
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var foobarNetwork = new Gcp.Compute.Network("foobar", new()
{
Name = "my-network",
AutoCreateSubnetworks = false,
});
var foobar = new Gcp.Compute.Router("foobar", new()
{
Name = "my-router",
Network = foobarNetwork.Name,
Bgp = new Gcp.Compute.Inputs.RouterBgpArgs
{
Asn = 64514,
AdvertiseMode = "CUSTOM",
AdvertisedGroups = new[]
{
"ALL_SUBNETS",
},
AdvertisedIpRanges = new[]
{
new Gcp.Compute.Inputs.RouterBgpAdvertisedIpRangeArgs
{
Range = "1.2.3.4",
},
new Gcp.Compute.Inputs.RouterBgpAdvertisedIpRangeArgs
{
Range = "6.7.0.0/16",
},
},
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.Router;
import com.pulumi.gcp.compute.RouterArgs;
import com.pulumi.gcp.compute.inputs.RouterBgpArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var foobarNetwork = new Network("foobarNetwork", NetworkArgs.builder()
.name("my-network")
.autoCreateSubnetworks(false)
.build());
var foobar = new Router("foobar", RouterArgs.builder()
.name("my-router")
.network(foobarNetwork.name())
.bgp(RouterBgpArgs.builder()
.asn(64514)
.advertiseMode("CUSTOM")
.advertisedGroups("ALL_SUBNETS")
.advertisedIpRanges(
RouterBgpAdvertisedIpRangeArgs.builder()
.range("1.2.3.4")
.build(),
RouterBgpAdvertisedIpRangeArgs.builder()
.range("6.7.0.0/16")
.build())
.build())
.build());
}
}
resources:
foobar:
type: gcp:compute:Router
properties:
name: my-router
network: ${foobarNetwork.name}
bgp:
asn: 64514
advertiseMode: CUSTOM
advertisedGroups:
- ALL_SUBNETS
advertisedIpRanges:
- range: 1.2.3.4
- range: 6.7.0.0/16
foobarNetwork:
type: gcp:compute:Network
name: foobar
properties:
name: my-network
autoCreateSubnetworks: false
The bgp block configures Border Gateway Protocol settings. The asn property sets your autonomous system number for BGP peering. The advertiseMode property controls route advertisement: CUSTOM lets you specify exactly which routes to advertise via advertisedGroups (like ALL_SUBNETS) and advertisedIpRanges for specific CIDR blocks. The router dynamically exchanges routes with BGP peers based on this configuration.
Enable encrypted interconnect attachments
When connecting to on-premises networks via Cloud Interconnect, you can enable encryption at the router level to secure traffic over VLAN attachments.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const network = new gcp.compute.Network("network", {
name: "test-network",
autoCreateSubnetworks: false,
});
const encrypted_interconnect_router = new gcp.compute.Router("encrypted-interconnect-router", {
name: "test-router",
network: network.name,
encryptedInterconnectRouter: true,
bgp: {
asn: 64514,
},
});
import pulumi
import pulumi_gcp as gcp
network = gcp.compute.Network("network",
name="test-network",
auto_create_subnetworks=False)
encrypted_interconnect_router = gcp.compute.Router("encrypted-interconnect-router",
name="test-router",
network=network.name,
encrypted_interconnect_router=True,
bgp={
"asn": 64514,
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
network, err := compute.NewNetwork(ctx, "network", &compute.NetworkArgs{
Name: pulumi.String("test-network"),
AutoCreateSubnetworks: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = compute.NewRouter(ctx, "encrypted-interconnect-router", &compute.RouterArgs{
Name: pulumi.String("test-router"),
Network: network.Name,
EncryptedInterconnectRouter: pulumi.Bool(true),
Bgp: &compute.RouterBgpArgs{
Asn: pulumi.Int(64514),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var network = new Gcp.Compute.Network("network", new()
{
Name = "test-network",
AutoCreateSubnetworks = false,
});
var encrypted_interconnect_router = new Gcp.Compute.Router("encrypted-interconnect-router", new()
{
Name = "test-router",
Network = network.Name,
EncryptedInterconnectRouter = true,
Bgp = new Gcp.Compute.Inputs.RouterBgpArgs
{
Asn = 64514,
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.Router;
import com.pulumi.gcp.compute.RouterArgs;
import com.pulumi.gcp.compute.inputs.RouterBgpArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var network = new Network("network", NetworkArgs.builder()
.name("test-network")
.autoCreateSubnetworks(false)
.build());
var encrypted_interconnect_router = new Router("encrypted-interconnect-router", RouterArgs.builder()
.name("test-router")
.network(network.name())
.encryptedInterconnectRouter(true)
.bgp(RouterBgpArgs.builder()
.asn(64514)
.build())
.build());
}
}
resources:
encrypted-interconnect-router:
type: gcp:compute:Router
properties:
name: test-router
network: ${network.name}
encryptedInterconnectRouter: true
bgp:
asn: 64514
network:
type: gcp:compute:Network
properties:
name: test-network
autoCreateSubnetworks: false
The encryptedInterconnectRouter property dedicates this router for use with encrypted VLAN attachments. When set to true, the router can only be used with interconnect attachments that support encryption. This provides an additional security layer for hybrid connectivity without requiring separate encryption appliances.
Connect to Network Connectivity Center gateway
Network Connectivity Center provides a hub-and-spoke topology for connecting VPCs and on-premises networks. Routers can attach to NCC gateway spokes to participate in this centralized routing architecture.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const network = new gcp.compute.Network("network", {
name: "net-spoke",
autoCreateSubnetworks: false,
});
const subnetwork = new gcp.compute.Subnetwork("subnetwork", {
name: "tf-test-subnet_21197",
ipCidrRange: "10.0.0.0/28",
region: "us-central1",
network: network.selfLink,
});
const basicHub = new gcp.networkconnectivity.Hub("basic_hub", {
name: "hub",
description: "A sample hub",
labels: {
"label-two": "value-one",
},
presetTopology: "HYBRID_INSPECTION",
});
const primary = new gcp.networkconnectivity.Spoke("primary", {
name: "my-ncc-gw",
location: "us-central1",
description: "A sample spoke of type Gateway",
labels: {
"label-one": "value-one",
},
hub: basicHub.id,
gateway: {
ipRangeReservations: [{
ipRange: "10.0.0.0/23",
}],
capacity: "CAPACITY_1_GBPS",
},
group: "gateways",
});
const foobar = new gcp.compute.Router("foobar", {
name: "my-router",
bgp: {
asn: 64514,
advertiseMode: "CUSTOM",
advertisedGroups: ["ALL_SUBNETS"],
advertisedIpRanges: [
{
range: "1.2.3.4",
},
{
range: "6.7.0.0/16",
},
],
},
nccGateway: primary.id,
});
import pulumi
import pulumi_gcp as gcp
network = gcp.compute.Network("network",
name="net-spoke",
auto_create_subnetworks=False)
subnetwork = gcp.compute.Subnetwork("subnetwork",
name="tf-test-subnet_21197",
ip_cidr_range="10.0.0.0/28",
region="us-central1",
network=network.self_link)
basic_hub = gcp.networkconnectivity.Hub("basic_hub",
name="hub",
description="A sample hub",
labels={
"label-two": "value-one",
},
preset_topology="HYBRID_INSPECTION")
primary = gcp.networkconnectivity.Spoke("primary",
name="my-ncc-gw",
location="us-central1",
description="A sample spoke of type Gateway",
labels={
"label-one": "value-one",
},
hub=basic_hub.id,
gateway={
"ip_range_reservations": [{
"ip_range": "10.0.0.0/23",
}],
"capacity": "CAPACITY_1_GBPS",
},
group="gateways")
foobar = gcp.compute.Router("foobar",
name="my-router",
bgp={
"asn": 64514,
"advertise_mode": "CUSTOM",
"advertised_groups": ["ALL_SUBNETS"],
"advertised_ip_ranges": [
{
"range": "1.2.3.4",
},
{
"range": "6.7.0.0/16",
},
],
},
ncc_gateway=primary.id)
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/networkconnectivity"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
network, err := compute.NewNetwork(ctx, "network", &compute.NetworkArgs{
Name: pulumi.String("net-spoke"),
AutoCreateSubnetworks: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = compute.NewSubnetwork(ctx, "subnetwork", &compute.SubnetworkArgs{
Name: pulumi.String("tf-test-subnet_21197"),
IpCidrRange: pulumi.String("10.0.0.0/28"),
Region: pulumi.String("us-central1"),
Network: network.SelfLink,
})
if err != nil {
return err
}
basicHub, err := networkconnectivity.NewHub(ctx, "basic_hub", &networkconnectivity.HubArgs{
Name: pulumi.String("hub"),
Description: pulumi.String("A sample hub"),
Labels: pulumi.StringMap{
"label-two": pulumi.String("value-one"),
},
PresetTopology: pulumi.String("HYBRID_INSPECTION"),
})
if err != nil {
return err
}
primary, err := networkconnectivity.NewSpoke(ctx, "primary", &networkconnectivity.SpokeArgs{
Name: pulumi.String("my-ncc-gw"),
Location: pulumi.String("us-central1"),
Description: pulumi.String("A sample spoke of type Gateway"),
Labels: pulumi.StringMap{
"label-one": pulumi.String("value-one"),
},
Hub: basicHub.ID(),
Gateway: &networkconnectivity.SpokeGatewayArgs{
IpRangeReservations: networkconnectivity.SpokeGatewayIpRangeReservationArray{
&networkconnectivity.SpokeGatewayIpRangeReservationArgs{
IpRange: pulumi.String("10.0.0.0/23"),
},
},
Capacity: pulumi.String("CAPACITY_1_GBPS"),
},
Group: pulumi.String("gateways"),
})
if err != nil {
return err
}
_, err = compute.NewRouter(ctx, "foobar", &compute.RouterArgs{
Name: pulumi.String("my-router"),
Bgp: &compute.RouterBgpArgs{
Asn: pulumi.Int(64514),
AdvertiseMode: pulumi.String("CUSTOM"),
AdvertisedGroups: pulumi.StringArray{
pulumi.String("ALL_SUBNETS"),
},
AdvertisedIpRanges: compute.RouterBgpAdvertisedIpRangeArray{
&compute.RouterBgpAdvertisedIpRangeArgs{
Range: pulumi.String("1.2.3.4"),
},
&compute.RouterBgpAdvertisedIpRangeArgs{
Range: pulumi.String("6.7.0.0/16"),
},
},
},
NccGateway: primary.ID(),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var network = new Gcp.Compute.Network("network", new()
{
Name = "net-spoke",
AutoCreateSubnetworks = false,
});
var subnetwork = new Gcp.Compute.Subnetwork("subnetwork", new()
{
Name = "tf-test-subnet_21197",
IpCidrRange = "10.0.0.0/28",
Region = "us-central1",
Network = network.SelfLink,
});
var basicHub = new Gcp.NetworkConnectivity.Hub("basic_hub", new()
{
Name = "hub",
Description = "A sample hub",
Labels =
{
{ "label-two", "value-one" },
},
PresetTopology = "HYBRID_INSPECTION",
});
var primary = new Gcp.NetworkConnectivity.Spoke("primary", new()
{
Name = "my-ncc-gw",
Location = "us-central1",
Description = "A sample spoke of type Gateway",
Labels =
{
{ "label-one", "value-one" },
},
Hub = basicHub.Id,
Gateway = new Gcp.NetworkConnectivity.Inputs.SpokeGatewayArgs
{
IpRangeReservations = new[]
{
new Gcp.NetworkConnectivity.Inputs.SpokeGatewayIpRangeReservationArgs
{
IpRange = "10.0.0.0/23",
},
},
Capacity = "CAPACITY_1_GBPS",
},
Group = "gateways",
});
var foobar = new Gcp.Compute.Router("foobar", new()
{
Name = "my-router",
Bgp = new Gcp.Compute.Inputs.RouterBgpArgs
{
Asn = 64514,
AdvertiseMode = "CUSTOM",
AdvertisedGroups = new[]
{
"ALL_SUBNETS",
},
AdvertisedIpRanges = new[]
{
new Gcp.Compute.Inputs.RouterBgpAdvertisedIpRangeArgs
{
Range = "1.2.3.4",
},
new Gcp.Compute.Inputs.RouterBgpAdvertisedIpRangeArgs
{
Range = "6.7.0.0/16",
},
},
},
NccGateway = primary.Id,
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.Subnetwork;
import com.pulumi.gcp.compute.SubnetworkArgs;
import com.pulumi.gcp.networkconnectivity.Hub;
import com.pulumi.gcp.networkconnectivity.HubArgs;
import com.pulumi.gcp.networkconnectivity.Spoke;
import com.pulumi.gcp.networkconnectivity.SpokeArgs;
import com.pulumi.gcp.networkconnectivity.inputs.SpokeGatewayArgs;
import com.pulumi.gcp.compute.Router;
import com.pulumi.gcp.compute.RouterArgs;
import com.pulumi.gcp.compute.inputs.RouterBgpArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var network = new Network("network", NetworkArgs.builder()
.name("net-spoke")
.autoCreateSubnetworks(false)
.build());
var subnetwork = new Subnetwork("subnetwork", SubnetworkArgs.builder()
.name("tf-test-subnet_21197")
.ipCidrRange("10.0.0.0/28")
.region("us-central1")
.network(network.selfLink())
.build());
var basicHub = new Hub("basicHub", HubArgs.builder()
.name("hub")
.description("A sample hub")
.labels(Map.of("label-two", "value-one"))
.presetTopology("HYBRID_INSPECTION")
.build());
var primary = new Spoke("primary", SpokeArgs.builder()
.name("my-ncc-gw")
.location("us-central1")
.description("A sample spoke of type Gateway")
.labels(Map.of("label-one", "value-one"))
.hub(basicHub.id())
.gateway(SpokeGatewayArgs.builder()
.ipRangeReservations(SpokeGatewayIpRangeReservationArgs.builder()
.ipRange("10.0.0.0/23")
.build())
.capacity("CAPACITY_1_GBPS")
.build())
.group("gateways")
.build());
var foobar = new Router("foobar", RouterArgs.builder()
.name("my-router")
.bgp(RouterBgpArgs.builder()
.asn(64514)
.advertiseMode("CUSTOM")
.advertisedGroups("ALL_SUBNETS")
.advertisedIpRanges(
RouterBgpAdvertisedIpRangeArgs.builder()
.range("1.2.3.4")
.build(),
RouterBgpAdvertisedIpRangeArgs.builder()
.range("6.7.0.0/16")
.build())
.build())
.nccGateway(primary.id())
.build());
}
}
resources:
network:
type: gcp:compute:Network
properties:
name: net-spoke
autoCreateSubnetworks: false
subnetwork:
type: gcp:compute:Subnetwork
properties:
name: tf-test-subnet_21197
ipCidrRange: 10.0.0.0/28
region: us-central1
network: ${network.selfLink}
basicHub:
type: gcp:networkconnectivity:Hub
name: basic_hub
properties:
name: hub
description: A sample hub
labels:
label-two: value-one
presetTopology: HYBRID_INSPECTION
primary:
type: gcp:networkconnectivity:Spoke
properties:
name: my-ncc-gw
location: us-central1
description: A sample spoke of type Gateway
labels:
label-one: value-one
hub: ${basicHub.id}
gateway:
ipRangeReservations:
- ipRange: 10.0.0.0/23
capacity: CAPACITY_1_GBPS
group: gateways
foobar:
type: gcp:compute:Router
properties:
name: my-router
bgp:
asn: 64514
advertiseMode: CUSTOM
advertisedGroups:
- ALL_SUBNETS
advertisedIpRanges:
- range: 1.2.3.4
- range: 6.7.0.0/16
nccGateway: ${primary.id}
The nccGateway property references an NCC spoke ID, integrating the router into a hub-and-spoke topology. This enables centralized routing policies and connectivity across multiple VPCs and on-premises locations. The router still requires BGP configuration to exchange routes within the NCC topology.
Beyond these examples
These snippets focus on specific router-level features: BGP configuration and route advertisement, encrypted interconnect support, and Network Connectivity Center integration. They’re intentionally minimal rather than full hybrid networking solutions.
The examples may reference pre-existing infrastructure such as VPC networks (examples create them inline, but production typically references existing networks) and NCC hubs and spokes for the gateway example. They focus on configuring the router rather than provisioning complete hybrid connectivity.
To keep things focused, common router patterns are omitted, including:
- MD5 authentication for BGP peers (md5AuthenticationKeys)
- Router interface configuration (separate resource)
- NAT gateway configuration (separate resource)
- Route policies and filters
These omissions are intentional: the goal is to illustrate how each router feature is wired, not provide drop-in hybrid networking modules. See the Cloud Router resource reference for all available configuration options.
Let's configure GCP Cloud Routers
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Configuration & Immutability
What properties can't I change after creating a Cloud Router?
The
name, network, region, encryptedInterconnectRouter, nccGateway, project, and params properties are immutable. Changing any of these forces router recreation.What are the naming requirements for a Cloud Router?
Router names must be 1-63 characters long, start with a lowercase letter, contain only lowercase letters, digits, or dashes, and cannot end with a dash (RFC1035 compliant).
What properties are required to create a Cloud Router?
You must specify
name, network, region, and project (or use the provider default project).BGP Configuration
How do I configure BGP on a Cloud Router?
Set the
bgp property with an asn (required). Optionally configure advertiseMode, advertisedGroups, and advertisedIpRanges for custom route advertisements.What BGP advertise modes are available?
You can use
CUSTOM mode to explicitly control advertised routes via advertisedGroups (like ALL_SUBNETS) and advertisedIpRanges, as shown in the examples.Advanced Features
How do I create a router for encrypted interconnect attachments?
Set
encryptedInterconnectRouter to true and configure bgp with an asn. This dedicates the router for use with encrypted VLAN attachments.How do I integrate a Cloud Router with Network Connectivity Center?
Set the
nccGateway property to the ID of an NCC Gateway spoke resource, as demonstrated in the Router Ncc Gw example.What import formats are supported for existing routers?
You can import using
projects/{{project}}/regions/{{region}}/routers/{{name}}, {{project}}/{{region}}/{{name}}, {{region}}/{{name}}, or just {{name}}.Using a different cloud?
Explore networking guides for other cloud providers: