# Configure Virtual Private Cloud (VPC) Peering with GCP
ScyllaDB Cloud allows you to connect your application’s private network
directly to the ScyllaDB clusters’ private network by using GCP’s VPC peering.
For more information on GCP’s VPC peering and its security advantages, please
read the [VPC Networking Overview](https://cloud.google.com/vpc/docs/vpc-peering).
If you are running ScyllaDB Cloud on AWS, refer to [Configure Virtual Private Cloud (VPC) Peering with AWS](https://cloud.docs.scylladb.com/stable/cluster-connections/vpc-peering/aws-vpc-peering.md).
## Set up VPC Peering on ScyllaDB Cloud with GCP
The procedure that follows includes instructions for setting up Virtual Private
Cloud (VPC) peering to connect your ScyllaDB cluster to your application on
Google Cloud Platform (GCP).
This will require you to have access to your instances on GCP and to create
a cluster with VPC peering in ScyllaDB Cloud.
**Before You Begin**
Verify that you have access to your GCP Console, and your user has view/edit
permissions for the VPC Peering settings.
**Workflow**
1. [Launch a ScyllaDB Cloud Cluster on GCP with VPC Peering Enabled](#gcp-vpc-launch-cluster)
2. [Configure the VPC Details on ScyllaDB Cloud](#gcp-vpc-configure-details)
3. [Configure the VPC Peering Route](#gcp-vpc-configure-route)
### Launch a ScyllaDB Cloud Cluster on GCP with VPC Peering Enabled
**Procedure**
1. Sign into [ScyllaDB Cloud](https://cloud.scylladb.com/). If you don’t have
an account you can register [here](https://auth.cloud.scylladb.com/oauth/account/sign-up).
2. From the right-side menu, click **Add New Cluster**.
3. In the *Provider* section, select **Google Cloud**.
4. In the *Where to Deploy* section, choose **Scylla Account**.
5. In the *Details* section, enter the following information:
* **Cluster Name** - human-readable text to help you identify your cluster.
* **Allowed IPs** - the list of IP addresses you want to allow to connect to
your cluster (in CIDR format).
6. Select the **Private Connection** option under **Network Types**.
7. In the **CIDR for ScyllaDB Cloud Network** field, you can specify the
desired IP range (in CIDR format). The default is 172.31.0.0/24. The allowed
CIDR blocks are all ranges from RFC 1918:
* 10.0.0.0/8
* 172.16.0.0/12 – with the exception of 172.17.0.0/16 (reserved for
the ScyllaDB Cloud infrastructure).
* 192.168.0.0/16
8. Scroll down the page and continue with the cluster creation process. Choose
the type of instances you want to use, the number of nodes, the RF, and any
other additional features you want to purchase.
9. When you’re finished choosing all the options you want, click **Launch
Cluster**. It will take a few minutes for your cluster to launch.
### Configure the VPC Details on ScyllaDB Cloud
This procedure is done only after you have successfully launched a cluster as
described in [Launch a ScyllaDB Cloud Cluster on GCP with VPC Peering Enabled](#gcp-vpc-launch-cluster).
**Procedure**
1. Click the **CONFIGURE CONNECTION** button displayed after your cluster is
launched or manually navigate to the **Connections** tab.
2. Click the **ADD VPC PEERING** button to open the **GCP Details** page.
3. On the **GCP Details** page, fill in the fields as follows:
* **GCP Project ID** - Enter your full unique GCP Project ID. You can copy
your project ID from the [Google Cloud Console](https://console.cloud.google.com/).
* **VPC Network Name** - Enter the network you would like to use under
the same project.
* **VPC Network** - The IPv4 subnet ranges used by your application in this
VPC, in CIDR format.
> * Your VPC can use private IPv4 ranges, shared address space
> (100.64.0.0/10), or privately used public IPv4 ranges supported by GCP.
> * The blocks must not overlap any network in your ScyllaDB cluster, including
> the [block you’ve set when creating the cluster](#gcp-vpc-create-cluster-cidr).
> * Your own VPC may use 172.17.0.0/16 as long as it does not overlap any
> cluster network.
> * CIDRs must not overlap 0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16,
> 224.0.0.0/4, or 255.255.255.255/32.
> * If there are multiple CIDR blocks in your VPC, list them all separated by commas.
From the [GCP Network](https://console.cloud.google.com/networking/networks/list),
identify the CIDR subnets you would like to use under the chosen VPC subnets tab.
If you select **Add your VPC network addresses to the cluster’s allowed
address list**, new firewall rules normally require a /16 or more specific
prefix.
4. Click **Submit VPC Peering Request**.
#### NOTE
If a customer CIDR uses an address range that GCP classifies as privately
used public IPv4 addresses, ScyllaDB Cloud enables importing public subnet
routes for the peering. This imports all public subnet routes exported by
your VPC over that peering, including routes outside the CIDRs entered above.
Removing the last configured CIDR that requires public subnet imports
disables those imports for the entire peering, including routes outside
the configured CIDR list.
Edits involving only ranges that GCP classifies as private preserve the
existing public subnet import setting. Importing these routes does not
itself grant firewall access to your cluster. GCP treats addresses within
100.64.0.0/10 as private IPv4 space, so these subnets alone do not require
public subnet route imports.
Your side of the peering must export subnet routes with public IP
addresses. GCP enables this export by default. If you previously disabled it,
enable it with `--export-subnet-routes-with-public-ip` when updating your
peering.
See [GCP VPC Network Peering route exchange](https://docs.cloud.google.com/vpc/docs/vpc-peering#options_for_exchanging_subnet_routes)
and [gcloud compute networks peerings update](https://cloud.google.com/sdk/gcloud/reference/compute/networks/peerings/update).
### Configure the VPC Peering Route
This procedure requires you to access the
[VPC Peering console](https://console.cloud.google.com/networking/networks/)
on GCP and complete the Peering setup. You have 2 options to configure
VPC Peering:
* [Manual Setup with a GCP Console](#gcp-vpc-manual-setup)
* [Run the GCP CLI](#gcp-vpc-gcloud-cli)
#### Manual Setup with a GCP Console
**Procedure**
1. Access the [GCP VPC network peering console](https://console.cloud.google.com/networking/peering/add)
to open the *VPC Network Peering> Create peering connection* page.
2. Ensure that the right project is selected.
3. Click **Continue** to create a peering connection.
#### NOTE
Remember to use the same Project ID that you entered in Configure the VPC Details on ScyllaDB Cloud.
4. Fill in all the required fields:
* **Peering connection name** - Provide your VPC peering connection name.
* **Your VPC network** - Choose your GCP Network from the drop-down menu.
* **Peered VPC network** - Select the current project
(**In project **) or specify another project.
* **Project ID** - Enter the ScyllaDB Cloud GCP Project name:
* **VPC Network name** - Specify the network name (you can find the VPC Network name
in *VPC network/VPC networks*): .
5. Leave all other settings as they are.
6. Click **Create**.
#### Run the GCP CLI
Do not use this method if you already completed the [Manual Setup with a GCP Console](#gcp-vpc-manual-setup).
**Procedure**
An alternative way to Configure VPC Routing is to run the following GCP CLI
with your values.
If you are connecting two VPCs from the same project:
```none
gcloud compute networks peerings create [peering name] --network [your network name] --peer-network [URI] --project=[your project name]
```
If you are connecting VPC from different projects:
```none
gcloud compute networks peerings create [peering name] --network [your network name] --peer-network [URI] --project=[your project name] --peer-project [Project_name]
```
To list projects accessible by your account, you can use the `gcloud projects list`
command with the `--filter=` flag. See the
[gcloud Reference](https://cloud.google.com/sdk/gcloud/reference/projects/list)
for details.
## Confirm Connectivity
This procedure gives you some ways to test the VPC Peering between ScyllaDB
Cloud and your GCP instances.
Test connectivity of your VPC: from a VM instance within the VPC network, try
to connect to port 9042 with nc, telnet, or cqlsh (the required credentials are
on the Cluster page):
For example, with `nc`:
```none
nc -z 198.51.100.0 9042 && echo ok!
```
Using the `telnet` command, telnet to the IP address:
```none
telnet 198.51.100.0 9042
```