Configure a larger netmask for a single instance

This page describes how to create a Compute Engine instance that has a larger netmask—the same size as the subnet's netmask—by configuring a custom image.

As an alternative, you can create a subnet that configures larger netmasks for all compute instances that are connected to the subnet. For ease of maintenance and to get support for secondary ranges, we recommend configuring larger instance netmasks through a subnet instead of creating custom images.

If creating a subnet doesn't work for your use case, you can create a custom image and use this image to create compute instances that have larger netmasks. The DHCP server configures the instance interfaces with the subnet's netmask, instead of /32, and the instance can directly communicate with other instances that are connected to the primary IPv4 range of the subnet. Secondary IPv4 ranges are not affected.

For more information about compute instance netmasks, see Compute instance netmasks.

Before you begin

1. Read the following guides about Compute Engine images:
   • OS images
   • Create custom images

2. In the Cloud de Confiance console, on the project selector page, select or create a Cloud de Confiance project.

   Roles required to select or create a project

   • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
   • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

   Go to project selector

3. If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

4. Verify that billing is enabled for your Cloud de Confiance project.

5. Enable the Compute Engine API.

   Roles required to enable APIs

   To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

   Enable the API

Required roles

To get the permissions that you need to create a custom image and an instance, ask your administrator to grant you the Compute Instance Admin (v1) (role/compute.instanceAdmin.v1) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Create a custom image that configures the MULTI_IP_SUBNET option

There are multiple ways to specify a source image when you create a custom image. The following example shows you how to create a custom image based on an image family. For more information about creating custom images, see Create custom images.

gcloud compute images create IMAGE_NAME \
    --source-image-family=SOURCE_IMAGE_FAMILY \
    --source-image-project=PROJECT \
    --guest-os-features=MULTI_IP_SUBNET

Create a compute instance from a MULTI_IP_SUBNET custom image

To create a compute instance that uses the custom image, specify the image that you created. For more information about creating instances, see Create an instance from a custom image.

gcloud compute instances create INSTANCE_NAME \
    --image=IMAGE_NAME \
    --zone=ZONE \
    --subnet=SUBNET_NAME

Verify the configuration

After you create a compute instance, you can verify that the DHCP server configures the correct netmask on the instance, and that the instance receives ARP replies. You can verify ARP replies by using only one instance because Cloud de Confiance always sends a reply for IP addresses in the subnet's range.

The following steps show you how to verify the configuration on a Linux instance.

1. Connect to your instance by using SSH.

2. Check the network interface configuration to verify that the netmask matches the subnet's netmask (not /32).

   ip addr show
   

   In the output, look for the inet line for your network interface, for example, ens4.

3. Verify that the instance can receive ARP replies for a different IP address in the subnet. You can use the ping command to trigger an ARP request. You can choose an IP address that's not in use—Cloud de Confiance sends an ARP reply even if there is no reply to the ping request.

   ping -c 3 OTHER_IP_ADDRESS_IN_SUBNET
   

   Replace OTHER_IP_ADDRESS_IN_SUBNET with an IP address from the same subnet. This IP address doesn't need to be in use.

4. Check the ARP table to see the MAC address associated with the other IP address.

   ip neighbor
   

   The output displays the MAC address of the other IP address.