The gcp:compute/router:Router resource, part of the Pulumi GCP provider, defines a Cloud Router that enables dynamic BGP routing between your VPC and external networks. This guide focuses on three capabilities: BGP configuration with custom route advertisements, encrypted interconnect support, and Network Connectivity Center integration.
Cloud Routers belong to VPC networks and work alongside separate resources for router interfaces, BGP peers, and Cloud NAT gateways. The examples are intentionally small. Combine them with your own VPC infrastructure and peering configuration.
Configure BGP routing with custom advertisements
Cloud Router enables dynamic routing between your VPC and on-premises networks or other cloud environments through BGP peering.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const foobarNetwork = new gcp.compute.Network("foobar", {
name: "my-network",
autoCreateSubnetworks: false,
});
const foobar = new gcp.compute.Router("foobar", {
name: "my-router",
network: foobarNetwork.name,
bgp: {
asn: 64514,
advertiseMode: "CUSTOM",
advertisedGroups: ["ALL_SUBNETS"],
advertisedIpRanges: [
{
range: "1.2.3.4",
},
{
range: "6.7.0.0/16",
},
],
},
});
import pulumi
import pulumi_gcp as gcp
foobar_network = gcp.compute.Network("foobar",
name="my-network",
auto_create_subnetworks=False)
foobar = gcp.compute.Router("foobar",
name="my-router",
network=foobar_network.name,
bgp={
"asn": 64514,
"advertise_mode": "CUSTOM",
"advertised_groups": ["ALL_SUBNETS"],
"advertised_ip_ranges": [
{
"range": "1.2.3.4",
},
{
"range": "6.7.0.0/16",
},
],
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
foobarNetwork, err := compute.NewNetwork(ctx, "foobar", &compute.NetworkArgs{
Name: pulumi.String("my-network"),
AutoCreateSubnetworks: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = compute.NewRouter(ctx, "foobar", &compute.RouterArgs{
Name: pulumi.String("my-router"),
Network: foobarNetwork.Name,
Bgp: &compute.RouterBgpArgs{
Asn: pulumi.Int(64514),
AdvertiseMode: pulumi.String("CUSTOM"),
AdvertisedGroups: pulumi.StringArray{
pulumi.String("ALL_SUBNETS"),
},
AdvertisedIpRanges: compute.RouterBgpAdvertisedIpRangeArray{
&compute.RouterBgpAdvertisedIpRangeArgs{
Range: pulumi.String("1.2.3.4"),
},
&compute.RouterBgpAdvertisedIpRangeArgs{
Range: pulumi.String("6.7.0.0/16"),
},
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var foobarNetwork = new Gcp.Compute.Network("foobar", new()
{
Name = "my-network",
AutoCreateSubnetworks = false,
});
var foobar = new Gcp.Compute.Router("foobar", new()
{
Name = "my-router",
Network = foobarNetwork.Name,
Bgp = new Gcp.Compute.Inputs.RouterBgpArgs
{
Asn = 64514,
AdvertiseMode = "CUSTOM",
AdvertisedGroups = new[]
{
"ALL_SUBNETS",
},
AdvertisedIpRanges = new[]
{
new Gcp.Compute.Inputs.RouterBgpAdvertisedIpRangeArgs
{
Range = "1.2.3.4",
},
new Gcp.Compute.Inputs.RouterBgpAdvertisedIpRangeArgs
{
Range = "6.7.0.0/16",
},
},
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.Router;
import com.pulumi.gcp.compute.RouterArgs;
import com.pulumi.gcp.compute.inputs.RouterBgpArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var foobarNetwork = new Network("foobarNetwork", NetworkArgs.builder()
.name("my-network")
.autoCreateSubnetworks(false)
.build());
var foobar = new Router("foobar", RouterArgs.builder()
.name("my-router")
.network(foobarNetwork.name())
.bgp(RouterBgpArgs.builder()
.asn(64514)
.advertiseMode("CUSTOM")
.advertisedGroups("ALL_SUBNETS")
.advertisedIpRanges(
RouterBgpAdvertisedIpRangeArgs.builder()
.range("1.2.3.4")
.build(),
RouterBgpAdvertisedIpRangeArgs.builder()
.range("6.7.0.0/16")
.build())
.build())
.build());
}
}
resources:
foobar:
type: gcp:compute:Router
properties:
name: my-router
network: ${foobarNetwork.name}
bgp:
asn: 64514
advertiseMode: CUSTOM
advertisedGroups:
- ALL_SUBNETS
advertisedIpRanges:
- range: 1.2.3.4
- range: 6.7.0.0/16
foobarNetwork:
type: gcp:compute:Network
name: foobar
properties:
name: my-network
autoCreateSubnetworks: false
The bgp block configures Border Gateway Protocol settings. The asn property sets your autonomous system number for BGP peering. When advertiseMode is set to “CUSTOM”, you control which routes peers receive: advertisedGroups can include predefined sets like “ALL_SUBNETS”, while advertisedIpRanges lets you advertise specific CIDR blocks.
Enable encrypted interconnect attachments
When connecting to on-premises networks via Cloud Interconnect, you can enable encryption at the router level to secure traffic over VLAN attachments.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const network = new gcp.compute.Network("network", {
name: "test-network",
autoCreateSubnetworks: false,
});
const encrypted_interconnect_router = new gcp.compute.Router("encrypted-interconnect-router", {
name: "test-router",
network: network.name,
encryptedInterconnectRouter: true,
bgp: {
asn: 64514,
},
});
import pulumi
import pulumi_gcp as gcp
network = gcp.compute.Network("network",
name="test-network",
auto_create_subnetworks=False)
encrypted_interconnect_router = gcp.compute.Router("encrypted-interconnect-router",
name="test-router",
network=network.name,
encrypted_interconnect_router=True,
bgp={
"asn": 64514,
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
network, err := compute.NewNetwork(ctx, "network", &compute.NetworkArgs{
Name: pulumi.String("test-network"),
AutoCreateSubnetworks: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = compute.NewRouter(ctx, "encrypted-interconnect-router", &compute.RouterArgs{
Name: pulumi.String("test-router"),
Network: network.Name,
EncryptedInterconnectRouter: pulumi.Bool(true),
Bgp: &compute.RouterBgpArgs{
Asn: pulumi.Int(64514),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var network = new Gcp.Compute.Network("network", new()
{
Name = "test-network",
AutoCreateSubnetworks = false,
});
var encrypted_interconnect_router = new Gcp.Compute.Router("encrypted-interconnect-router", new()
{
Name = "test-router",
Network = network.Name,
EncryptedInterconnectRouter = true,
Bgp = new Gcp.Compute.Inputs.RouterBgpArgs
{
Asn = 64514,
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.Router;
import com.pulumi.gcp.compute.RouterArgs;
import com.pulumi.gcp.compute.inputs.RouterBgpArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var network = new Network("network", NetworkArgs.builder()
.name("test-network")
.autoCreateSubnetworks(false)
.build());
var encrypted_interconnect_router = new Router("encrypted-interconnect-router", RouterArgs.builder()
.name("test-router")
.network(network.name())
.encryptedInterconnectRouter(true)
.bgp(RouterBgpArgs.builder()
.asn(64514)
.build())
.build());
}
}
resources:
encrypted-interconnect-router:
type: gcp:compute:Router
properties:
name: test-router
network: ${network.name}
encryptedInterconnectRouter: true
bgp:
asn: 64514
network:
type: gcp:compute:Network
properties:
name: test-network
autoCreateSubnetworks: false
Setting encryptedInterconnectRouter to true dedicates the router for use with encrypted VLAN attachments. This property is immutable; once set, the router can only be used with encrypted interconnect connections. The bgp block still requires an ASN, but route advertisement defaults to standard behavior.
Connect to Network Connectivity Center gateways
Network Connectivity Center provides a hub-and-spoke topology for connecting VPCs and on-premises networks through a centralized routing architecture.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const network = new gcp.compute.Network("network", {
name: "net-spoke",
autoCreateSubnetworks: false,
});
const subnetwork = new gcp.compute.Subnetwork("subnetwork", {
name: "tf-test-subnet_64336",
ipCidrRange: "10.0.0.0/28",
region: "us-central1",
network: network.selfLink,
});
const basicHub = new gcp.networkconnectivity.Hub("basic_hub", {
name: "hub",
description: "A sample hub",
labels: {
"label-two": "value-one",
},
presetTopology: "HYBRID_INSPECTION",
});
const primary = new gcp.networkconnectivity.Spoke("primary", {
name: "my-ncc-gw",
location: "us-central1",
description: "A sample spoke of type Gateway",
labels: {
"label-one": "value-one",
},
hub: basicHub.id,
gateway: {
ipRangeReservations: [{
ipRange: "10.0.0.0/23",
}],
capacity: "CAPACITY_1_GBPS",
},
group: "gateways",
});
const foobar = new gcp.compute.Router("foobar", {
name: "my-router",
bgp: {
asn: 64514,
advertiseMode: "CUSTOM",
advertisedGroups: ["ALL_SUBNETS"],
advertisedIpRanges: [
{
range: "1.2.3.4",
},
{
range: "6.7.0.0/16",
},
],
},
nccGateway: primary.id,
});
import pulumi
import pulumi_gcp as gcp
network = gcp.compute.Network("network",
name="net-spoke",
auto_create_subnetworks=False)
subnetwork = gcp.compute.Subnetwork("subnetwork",
name="tf-test-subnet_64336",
ip_cidr_range="10.0.0.0/28",
region="us-central1",
network=network.self_link)
basic_hub = gcp.networkconnectivity.Hub("basic_hub",
name="hub",
description="A sample hub",
labels={
"label-two": "value-one",
},
preset_topology="HYBRID_INSPECTION")
primary = gcp.networkconnectivity.Spoke("primary",
name="my-ncc-gw",
location="us-central1",
description="A sample spoke of type Gateway",
labels={
"label-one": "value-one",
},
hub=basic_hub.id,
gateway={
"ip_range_reservations": [{
"ip_range": "10.0.0.0/23",
}],
"capacity": "CAPACITY_1_GBPS",
},
group="gateways")
foobar = gcp.compute.Router("foobar",
name="my-router",
bgp={
"asn": 64514,
"advertise_mode": "CUSTOM",
"advertised_groups": ["ALL_SUBNETS"],
"advertised_ip_ranges": [
{
"range": "1.2.3.4",
},
{
"range": "6.7.0.0/16",
},
],
},
ncc_gateway=primary.id)
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/networkconnectivity"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
network, err := compute.NewNetwork(ctx, "network", &compute.NetworkArgs{
Name: pulumi.String("net-spoke"),
AutoCreateSubnetworks: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = compute.NewSubnetwork(ctx, "subnetwork", &compute.SubnetworkArgs{
Name: pulumi.String("tf-test-subnet_64336"),
IpCidrRange: pulumi.String("10.0.0.0/28"),
Region: pulumi.String("us-central1"),
Network: network.SelfLink,
})
if err != nil {
return err
}
basicHub, err := networkconnectivity.NewHub(ctx, "basic_hub", &networkconnectivity.HubArgs{
Name: pulumi.String("hub"),
Description: pulumi.String("A sample hub"),
Labels: pulumi.StringMap{
"label-two": pulumi.String("value-one"),
},
PresetTopology: pulumi.String("HYBRID_INSPECTION"),
})
if err != nil {
return err
}
primary, err := networkconnectivity.NewSpoke(ctx, "primary", &networkconnectivity.SpokeArgs{
Name: pulumi.String("my-ncc-gw"),
Location: pulumi.String("us-central1"),
Description: pulumi.String("A sample spoke of type Gateway"),
Labels: pulumi.StringMap{
"label-one": pulumi.String("value-one"),
},
Hub: basicHub.ID(),
Gateway: &networkconnectivity.SpokeGatewayArgs{
IpRangeReservations: networkconnectivity.SpokeGatewayIpRangeReservationArray{
&networkconnectivity.SpokeGatewayIpRangeReservationArgs{
IpRange: pulumi.String("10.0.0.0/23"),
},
},
Capacity: pulumi.String("CAPACITY_1_GBPS"),
},
Group: pulumi.String("gateways"),
})
if err != nil {
return err
}
_, err = compute.NewRouter(ctx, "foobar", &compute.RouterArgs{
Name: pulumi.String("my-router"),
Bgp: &compute.RouterBgpArgs{
Asn: pulumi.Int(64514),
AdvertiseMode: pulumi.String("CUSTOM"),
AdvertisedGroups: pulumi.StringArray{
pulumi.String("ALL_SUBNETS"),
},
AdvertisedIpRanges: compute.RouterBgpAdvertisedIpRangeArray{
&compute.RouterBgpAdvertisedIpRangeArgs{
Range: pulumi.String("1.2.3.4"),
},
&compute.RouterBgpAdvertisedIpRangeArgs{
Range: pulumi.String("6.7.0.0/16"),
},
},
},
NccGateway: primary.ID(),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var network = new Gcp.Compute.Network("network", new()
{
Name = "net-spoke",
AutoCreateSubnetworks = false,
});
var subnetwork = new Gcp.Compute.Subnetwork("subnetwork", new()
{
Name = "tf-test-subnet_64336",
IpCidrRange = "10.0.0.0/28",
Region = "us-central1",
Network = network.SelfLink,
});
var basicHub = new Gcp.NetworkConnectivity.Hub("basic_hub", new()
{
Name = "hub",
Description = "A sample hub",
Labels =
{
{ "label-two", "value-one" },
},
PresetTopology = "HYBRID_INSPECTION",
});
var primary = new Gcp.NetworkConnectivity.Spoke("primary", new()
{
Name = "my-ncc-gw",
Location = "us-central1",
Description = "A sample spoke of type Gateway",
Labels =
{
{ "label-one", "value-one" },
},
Hub = basicHub.Id,
Gateway = new Gcp.NetworkConnectivity.Inputs.SpokeGatewayArgs
{
IpRangeReservations = new[]
{
new Gcp.NetworkConnectivity.Inputs.SpokeGatewayIpRangeReservationArgs
{
IpRange = "10.0.0.0/23",
},
},
Capacity = "CAPACITY_1_GBPS",
},
Group = "gateways",
});
var foobar = new Gcp.Compute.Router("foobar", new()
{
Name = "my-router",
Bgp = new Gcp.Compute.Inputs.RouterBgpArgs
{
Asn = 64514,
AdvertiseMode = "CUSTOM",
AdvertisedGroups = new[]
{
"ALL_SUBNETS",
},
AdvertisedIpRanges = new[]
{
new Gcp.Compute.Inputs.RouterBgpAdvertisedIpRangeArgs
{
Range = "1.2.3.4",
},
new Gcp.Compute.Inputs.RouterBgpAdvertisedIpRangeArgs
{
Range = "6.7.0.0/16",
},
},
},
NccGateway = primary.Id,
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.Subnetwork;
import com.pulumi.gcp.compute.SubnetworkArgs;
import com.pulumi.gcp.networkconnectivity.Hub;
import com.pulumi.gcp.networkconnectivity.HubArgs;
import com.pulumi.gcp.networkconnectivity.Spoke;
import com.pulumi.gcp.networkconnectivity.SpokeArgs;
import com.pulumi.gcp.networkconnectivity.inputs.SpokeGatewayArgs;
import com.pulumi.gcp.compute.Router;
import com.pulumi.gcp.compute.RouterArgs;
import com.pulumi.gcp.compute.inputs.RouterBgpArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var network = new Network("network", NetworkArgs.builder()
.name("net-spoke")
.autoCreateSubnetworks(false)
.build());
var subnetwork = new Subnetwork("subnetwork", SubnetworkArgs.builder()
.name("tf-test-subnet_64336")
.ipCidrRange("10.0.0.0/28")
.region("us-central1")
.network(network.selfLink())
.build());
var basicHub = new Hub("basicHub", HubArgs.builder()
.name("hub")
.description("A sample hub")
.labels(Map.of("label-two", "value-one"))
.presetTopology("HYBRID_INSPECTION")
.build());
var primary = new Spoke("primary", SpokeArgs.builder()
.name("my-ncc-gw")
.location("us-central1")
.description("A sample spoke of type Gateway")
.labels(Map.of("label-one", "value-one"))
.hub(basicHub.id())
.gateway(SpokeGatewayArgs.builder()
.ipRangeReservations(SpokeGatewayIpRangeReservationArgs.builder()
.ipRange("10.0.0.0/23")
.build())
.capacity("CAPACITY_1_GBPS")
.build())
.group("gateways")
.build());
var foobar = new Router("foobar", RouterArgs.builder()
.name("my-router")
.bgp(RouterBgpArgs.builder()
.asn(64514)
.advertiseMode("CUSTOM")
.advertisedGroups("ALL_SUBNETS")
.advertisedIpRanges(
RouterBgpAdvertisedIpRangeArgs.builder()
.range("1.2.3.4")
.build(),
RouterBgpAdvertisedIpRangeArgs.builder()
.range("6.7.0.0/16")
.build())
.build())
.nccGateway(primary.id())
.build());
}
}
resources:
network:
type: gcp:compute:Network
properties:
name: net-spoke
autoCreateSubnetworks: false
subnetwork:
type: gcp:compute:Subnetwork
properties:
name: tf-test-subnet_64336
ipCidrRange: 10.0.0.0/28
region: us-central1
network: ${network.selfLink}
basicHub:
type: gcp:networkconnectivity:Hub
name: basic_hub
properties:
name: hub
description: A sample hub
labels:
label-two: value-one
presetTopology: HYBRID_INSPECTION
primary:
type: gcp:networkconnectivity:Spoke
properties:
name: my-ncc-gw
location: us-central1
description: A sample spoke of type Gateway
labels:
label-one: value-one
hub: ${basicHub.id}
gateway:
ipRangeReservations:
- ipRange: 10.0.0.0/23
capacity: CAPACITY_1_GBPS
group: gateways
foobar:
type: gcp:compute:Router
properties:
name: my-router
bgp:
asn: 64514
advertiseMode: CUSTOM
advertisedGroups:
- ALL_SUBNETS
advertisedIpRanges:
- range: 1.2.3.4
- range: 6.7.0.0/16
nccGateway: ${primary.id}
The nccGateway property links the router to an NCC gateway spoke, integrating it into the hub-and-spoke topology. The spoke defines gateway capacity and IP range reservations, while the router handles BGP configuration. This pattern centralizes routing policy through the NCC hub rather than managing peer-to-peer connections.
Beyond these examples
These snippets focus on specific router-level features: BGP configuration and route advertisement, encrypted interconnect support, and Network Connectivity Center integration. They’re intentionally minimal rather than full networking solutions.
The examples may reference pre-existing infrastructure such as VPC networks (examples create them inline but typically reference existing), Cloud Interconnect VLAN attachments (for encrypted interconnect), and NCC hubs and spokes (for gateway integration). They focus on configuring the router rather than provisioning complete network architectures.
To keep things focused, common router patterns are omitted, including:
- MD5 authentication for BGP peers (md5AuthenticationKeys)
- Router interface configuration (separate resource)
- BGP peer configuration (separate resource)
- NAT gateway configuration (separate resource)
These omissions are intentional: the goal is to illustrate how each router feature is wired, not provide drop-in networking modules. See the Cloud Router resource reference for all available configuration options.
Let's configure GCP Cloud Routers
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Configuration & Immutability
What properties can't I change after creating a Cloud Router?
The following properties are immutable and require router replacement if changed:
name, network, region, project, encryptedInterconnectRouter, nccGateway, and params.What are the naming requirements for a Cloud Router?
Router names must be 1-63 characters long, start with a lowercase letter, contain only lowercase letters, digits, and dashes, and cannot end with a dash (RFC1035 compliant).
BGP Configuration
How do I advertise custom IP ranges via BGP?
Configure
bgp.advertiseMode to CUSTOM and specify your desired ranges in bgp.advertisedIpRanges. You can also set bgp.advertisedGroups to include predefined groups like ALL_SUBNETS.What BGP advertise modes are available?
The examples show
CUSTOM mode, which allows you to specify custom advertised groups and IP ranges. When using CUSTOM, you can configure advertisedGroups and advertisedIpRanges.Advanced Features
Can I use a Cloud Router with encrypted interconnect attachments?
Yes, set
encryptedInterconnectRouter to true when creating the router. This property is immutable and dedicates the router for use with encrypted VLAN attachments.How do I integrate a Cloud Router with Network Connectivity Center?
Set the
nccGateway property to the URI of your NCC Gateway spoke. This is a Beta feature and the property is immutable after creation.Using a different cloud?
Explore networking guides for other cloud providers: