Some or all of the information on this page might not apply to Cloud de Confiance by S3NS. See Differences from Google Cloud for more details.

Configure larger instance netmasks for all instances in a subnet

This page describes how to configure all Compute Engine instances in a subnet with larger than default netmasks. To use this configuration, you create a subnet and configure the Resolve subnet mask (--resolve-subnet-mask) setting. When you connect compute instances to the subnet, the instances are configured with a netmask that's the same size as the subnet's netmask, instead of /32. For more information about compute instance netmasks, see Compute instance netmasks.

Before you begin

In the Cloud de Confiance console, on the project selector page, select or create a Cloud de Confiance project.
Roles required to select or create a project
- Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
- Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector
If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.
Verify that billing is enabled for your Cloud de Confiance project.
Enable the Compute Engine API.
Roles required to enable APIs
To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.
Enable the API

Required roles

To get the permissions that you need to create a subnet, ask your administrator to grant you the Compute Network Admin (role/compute.networkAdmin) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Create a subnet to configure larger instance netmasks

Console

In the Cloud de Confiance console, go to the VPC networks page.

Go to VPC networks
Select a VPC network.
Click the Subnets tab.
Click Add subnet.
For Name, enter a name for the subnet.
For Region, select a region.
For Purpose, select None.
For IP stack type, select IPv4 (single stack).
For Primary IPv4 range, enter a valid IPv4 address range.
If you want to add a secondary IPv4 range, do the following:
1. For Subnet range name, enter a name for the secondary IPv4 range.
2. For Secondary IPv4 range, enter a valid IPv4 address range.
In Resolve subnet mask, select one of the following:
- All ranges
- Primary range only
Click Add.

gcloud

gcloud compute networks subnets create SUBNET_NAME \
    --network=NETWORK_NAME \
    --range=IP_RANGE \
    --region=REGION \
    --resolve-subnet-mask=ARP_RANGES

Replace the following:

SUBNET_NAME: a name for the subnet.
NETWORK_NAME: the network to create the subnet in.
IP_RANGE: the primary IPv4 address range for the subnet.
REGION: the region for the subnet.
ARP_RANGES: the ranges that you want to receive ARP replies from. Valid values are ARP_PRIMARY_RANGE and ARP_ALL_RANGES.

Create a compute instance in the subnet

Create a compute instance that is connected to the subnet. For more information about creating instances, see Create an instance in a specific subnet.

gcloud CLI

gcloud compute instances create INSTANCE_NAME \
    --zone=ZONE \
    --subnet=SUBNET_NAME

Replace the following:

INSTANCE_NAME: a name for your instance.
ZONE: the zone to create the instance in.
SUBNET_NAME: the name of the subnet to connect the instance to.

Verify the configuration

After you create a compute instance, you can verify that the DHCP server configures the correct netmask on the instance, and that the instance receives ARP replies. You can verify ARP replies by using only one instance because Cloud de Confiance always sends a reply for IP addresses in the subnet's range.

The following steps show you how to verify the configuration on a Linux instance.

Connect to your instance by using SSH.
Check the network interface configuration to verify that the netmask matches the subnet's netmask (not /32).
```
ip addr show
```
In the output, look for the inet line for your network interface, for example, ens4.
Verify that the instance can receive ARP replies for a different IP address in the subnet. You can use the ping command to trigger an ARP request. You can choose an IP address that's not in use—Cloud de Confiance sends an ARP reply even if there is no reply to the ping request.
```
ping -c 3 OTHER_IP_ADDRESS_IN_SUBNET
```
Replace OTHER_IP_ADDRESS_IN_SUBNET with an IP address from the same subnet. This IP address doesn't need to be in use.
Check the ARP table to see the MAC address associated with the other IP address.
```
ip neighbor
```
The output displays the MAC address of the other IP address.