The Centralized Inspection architecture, also known as the hub-and-spoke model, is the design most closely associated with Google Cloud Interconnect. In this model, the Cloud Interconnect connection terminates in a central "hub" VPC. This hub VPC contains a cluster of FortiGate-VMs that act as a centralized security services point. All traffic from the on-premises network entering Google Cloud via the Interconnect is routed through these FortiGates for inspection before being forwarded to the appropriate "spoke" VPCs. This approach centralizes security policy management, simplifies routing, and provides a scalable method for inspecting all traffic entering or leaving the cloud environment from a trusted on-premises network.

Distributed Inspection: This model places security appliances in each VPC. It is less efficient for Interconnect traffic, as it would require complex routing to direct traffic from the central connection point to multiple inspection points.

East-West Inspection: This architecture specifically focuses on inspecting traffic between workloads within the Google Cloud environment (e.g., between different VPCs or subnets), not traffic originating from an on-premises network via Cloud Interconnect.

Standalone Inspection: This typically refers to a single FortiGate protecting a single VPC. It is not a scalable architectural pattern for handling enterprise-grade connectivity like Cloud Interconnect that serves multiple VPCs.

References

1. Fortinet Document Library: Fortinet Security Fabric on Google Cloud Reference Architecture.

Reference: The section on "Centralized Security Services VPC (Hub-and-Spoke)" explicitly details this architecture. The diagram on page 11 shows the "On-Premises Data Center" connecting via "Cloud Interconnect/VPN" directly to the "Hub VPC" where the FortiGate VM cluster is deployed for traffic inspection. This document establishes the hub-and-spoke model as the standard for inspecting traffic from on-premises connections.

2. Fortinet Document Library: FortiGate-VM on Google Cloud Platform Deployment Guide.

Reference: The "Hub-and-spoke model" section describes how to configure a central hub VPC for security inspection. It states, "The hub VPC connects to the on-premises network through a VPN or Interconnect connection... The FortiGate-VMs in the hub VPC inspect all traffic between the on-premises network and the spoke VPCs." This directly links the architecture to Cloud Interconnect.

3. Google Cloud Architecture Center: Centralized network appliances in a hub-and-spoke architecture.

Reference: This official Google Cloud document describes the hub-and-spoke topology as a best practice. It states, "You can use this architecture to inspect traffic that is... between on-premises networks and VPC spoke networks that are connected by using Cloud VPN tunnels or Cloud Interconnect attachments." This corroborates the Fortinet recommendation from the cloud provider's perspective.

1. Google Cloud Architecture Center – “Select an inspection architecture on Google Cloud”, Table 1 “Hybrid connectivity (Cloud Interconnect/Cloud VPN)” (doc updated 2023-11-07).

2. Google Cloud Architecture Center – “Design network security for hybrid connectivity”, Sections “Use Cloud Interconnect or VPN” & “Inspection path for hybrid connectivity” (para 2-3).

3. Fortinet “FortiGate-VM on Google Cloud Deployment Guide 7.6”, §4.3 “Hybrid connectivity inspection with Cloud Interconnect”, pp. 42-45.