01 Run compute networks create command (Windows/macOS/Linux) to create a new, custom Virtual Private Cloud (VPC) network within the GCP project referenced as value for the --project parameter:
gcloud compute networks create cc-new-vpc-network
--project cc-project5-stack-123456
--subnet-mode=custom
--bgp-routing-mode=regional
02 The command output should return the configuration metadata available for the newly created VPC network:
Created [https://www.googleapis.com/compute/v1/projects/cc-project5-stack-123456/global/networks/cc-new-vpc-network].
NAME SUBNET_MODE BGP_ROUTING_MODE IPV4_RANGE GATEWAY_IPV4
cc-new-vpc-network CUSTOM REGIONAL
Instances on this network will not be reachable until firewall rules are created. As an example, you can allow all
internal traffic between instances as well as SSH, RDP, and ICMP by running:
$ gcloud compute firewall-rules create <FIREWALL_NAME> --network cc-new-vpc-network --allow tcp,udp,icmp --source-ranges <IP_RANGE>
$ gcloud compute firewall-rules create <FIREWALL_NAME> --network cc-new-vpc-network --allow tcp:22,tcp:3389,icmp
03 Run compute networks subnets create command (Windows/macOS/Linux) to create a custom subnet into the VPC network created at the previous steps. The following command example creates a VPC network subnet named "cc-us-west1-subnet", in the Oregon, US (us-west1) region with the primary IP address range set to 10.0.0.0/24. Use the compute networks subnets create command to create as many VPC subnets as you need:
gcloud compute networks subnets create cc-us-west1-subnet
--network=cc-new-vpc-network
--range=10.0.0.0/24
--region=us-west1
04 The command output should return the VPC subnet configuration metadata:
Created
[https://www.googleapis.com/compute/v1/projects/cc-project5-stack-123456/regions/europe-west2/subnetworks/cc-us-west1-subnet].
NAME REGION NETWORK RANGE
cc-us-west1-subnet us-west1 cc-new-vpc-network 10.0.0.0/24
05 Run compute firewall-rules create command (Windows/macOS/Linux) to create the necessary firewall rules for your new Virtual Private Cloud (VPC) network. Firewall rules control incoming and/or outgoing traffic to GCP resources such as VM instances. The following command example creates a firewall rule that allows inbound traffic to all the virtual machines (VMs) within the VPC network through TCP port 80 (HTTP) and TCP port 443 (HTTPS):
gcloud compute firewall-rules create allow-http-https-traffic
--network cc-new-vpc-network
--allow tcp:80,tcp:443
--direction ingress
--source-ranges 0.0.0.0/0
--enable-logging
06 The command output should return the VPC firewall rule configuration metadata:
Created [https://www.googleapis.com/compute/v1/projects/cc-project5-stack-123456/global/firewalls/allow-https-traffic].
NAME NETWORK DIRECTION PRIORITY ALLOW DENY DISABLED
allow-http-https-traffic cc-new-vpc-network INGRESS 1000 tcp:80,tcp:443 False
07 Now it's time to migrate your cloud applications from the legacy network to the newly created Virtual Private Cloud (VPC) network.
08 Once your applications are migrated to the new Virtual Private Cloud (VPC) and the legacy network is not in use anymore, it is safe remove it from your GCP project. Before you can delete a legacy network, make sure that the network is not used by any GCP resources. For example, run compute firewall-rules delete command (Windows/macOS/Linux) to delete a firewall rule named "allow-ssh-traffic" from the legacy network firewall:
gcloud compute firewall-rules delete allow-ssh-traffic
09 The compute firewall-rules delete command request should ask you for confirmation. Type Y to confirm the deletion. Once removed, the command output should return the ID of the deleted rule:
The following firewalls will be deleted:
- [allow-ssh-traffic]
Do you want to continue (Y/n)? Y
Deleted [https://www.googleapis.com/compute/v1/projects/cc-project5-stack-123456/global/firewalls/allow-ssh-traffic].
10 Run compute networks delete command (Windows/macOS/Linux) to remove the specified legacy network from the selected GCP project:
gcloud compute networks delete cc-web-stack-network
11 The compute networks delete command request should ask you for confirmation. Type Y to confirm the removal action. Once the resource is deleted, the command output should return the ID of the removed network:
The following networks will be deleted:
- [cc-web-stack-network]
Do you want to continue (Y/n)? Y
Deleted [https://www.googleapis.com/compute/v1/projects/cc-project5-stack-123456/global/networks/cc-web-stack-network].
12 Repeat steps no. 1 – 11 for each GCP project available within your Google Cloud account.
Security 
Reliability 
Performance