Create VMs with multiple network interfaces

This page describes how to create VM instances with multiple networkinterfaces.

Before you begin

Before you begin, ensure that you're familiar with the characteristicsof instances with multiple network interfaces as described in theMultiple network interfaces overview.

IAM roles

To create an instance with multiple network interfaces, you must have one ofthe following roles:

Creating and deleting instances and instance templates with multipleinterfaces in a project not using a Shared VPC environment: A userwith the Owner, Editor, or Compute Instance Admin (v1) rolecan create an instance with multiple interfaces associated with VPCnetworks and subnets that are part of that same project.

Creating and deleting instances and instance templates with multipleinterfaces in Shared VPC environments:A user with the Owner, Editor, or Compute Instance Admin (v1) rolecan create an instance with multiple interfaces. If any of the interfaces areattached to a subnet in a Shared VPC host project, you must alsohave theCompute Network User role (roles/compute.networkUser)for the whole host project or for the subnets you need to use.

To learn more about permissions, read theCompute Engine IAM documentation.

Create VM instances with multiple network interfaces

This section describes how to create an instance with multiple network interfaces,including vNICs and Dynamic NICs. For general instructions about creating instances, seeCreate and start a VM instance.

The first interface is always created asnic0, and it is always the defaultinterface.

Console

  1. In the Google Cloud console, go to theCreate an instance page.

    Go to Create an instance

  2. In theMachine configuration pane, do the following:

    1. In theName field, enter a name for the instance.
    2. In theRegion field, select a region.
    3. In theZone field, select a zone.

  3. In the navigation menu, clickNetworking to view theNetworking pane.

  4. In theNetwork interfaces section, expand the network interface toedit it.

    1. ForNetwork andSubnetwork, select the networkand subnetwork that you want to use.

      If you want to configure IPv6 addresses on the interface, select asubnet that has an/64 IPv6 address range configured. The IPv6 access typeof the subnet determines whether the instance receives an internal/96 IPv6address range or an external/96 IPv6 address range.

    2. Select one of the following options for theIP stack type for theinterface:

      • IPv4 (single-stack)
      • IPv4 and IPv6 (dual-stack)
      • IPv6 (single-stack)

    3. For interfaces with IPv4 addresses, do the following:

      1. ForPrimary internal IPv4 address, select one of the following:

        • Ephemeral (Automatic) to automatically assign a newephemeral IPv4 address
        • Ephemeral (Custom) to manually specify a new ephemeral IPv4 address
        • A reserved static internal IPv4 address from the list
        • Reserve static internal IPv4 address to reserve and assign a new static internal IPv4 address

      2. ForExternal IPv4 address, select one of the following:

        • Ephemeral to assign a new ephemeral IPv4 address
        • None to not assign an external IPv4 address
        • A reserved static IPv4 address from the list
        • Reserve static external IP address to reserve and assign a new static external IPv4 address

      3. You can optionally assign one or morealias IP ranges to thenetwork interface. To assign an alias IP range, do the following:

        1. InAlias IP ranges, clickAdd IP range.
        2. InSubnet range, select a subnet primary IPv4 address rangeor a subnet secondary IPv4 address range to use.
        3. ForAlias IP range, enter an IP range in CIDR notation.This range must be an unused range of the subnet IP range thatyou selected.

        For more information about assigning alias IP ranges to VM networkinterfaces, seeConfigure alias IP ranges.

    4. For interfaces with IPv6 addresses, do the following, depending on the access type of the connected subnet:

      1. ForPrimary internal IPv6 address, select one of the following:
        • Ephemeral (Automatic) to automatically assign a new ephemeral internal IPv6 address range
        • Ephemeral (Custom) to manually specify a new ephemeral internal IPv6 address range
        • A reserved static internal IPv6 address range from the list
        • Reserve static internal IPv6 address to reserve and assign a new static internal IPv6 address range
      2. ForExternal IPv6 address, select one of the following:
        • Ephemeral (Automatic) to automatically assign a new ephemeral external IPv6 address range
        • Ephemeral (Custom) to manually specify a new ephemeral external IPv6 address range
        • A reserved static external IPv6 address range from the list
        • Reserve static external IPv6 address to reserve and assign a new static external IPv6 address range

    5. To finish modifying the network interface, clickDone.

  5. To add another network interface:

    1. To add a vNIC, clickAdd a network interface and complete the formby entering the details of the vNIC.

    2. To add a Dynamic NIC, clickAdd a Dynamic Network Interfaceand do the following:

      1. In theParent network interface field, select the parent vNIC forwhich to create the Dynamic NIC.
      2. In theVLAN ID field, enter the VLAN ID of the Dynamic NIC.
      3. Complete the form by entering the remaining details of the Dynamic NIC.

  6. Continue with the instance creation process.

  7. ClickCreate.

gcloud

To create network interfaces on a new instance, use thegcloud compute instances create command.

Include the--network-interface flag for each interface,followed by any appropriate networking keys, such asnetwork,subnet,private-network-ip,address,external-ipv6-addressandvlan.

Including thevlan key creates a Dynamic NIC.If you create a Dynamic NIC, you must also follow the stepsforconfiguring the guest OS for Dynamic NICsafter you create the instance.

To view examples of how to create instances with multiple interfaces,seeexample configurations.

This snippet only illustrates the--network-interface flag, one ofmany possible parameters that you can specify when creating an instance.

gcloud compute instances createINSTANCE_NAME \    --zoneZONE \    --network-interface \        network=NETWORK_A,subnet=SUBNET_A, \        stack-type=STACK_TYPE, \        private-network-ip=INTERNAL_IPV4_ADDRESS, \        address=EXTERNAL_IPV4_ADDRESS | no-address, \        internal-ipv6-address=INTERNAL_IPV6_ADDRESS \    ...    --network-interface \        network=NETWORK_B,subnet=SUBNET_B, \        stack-type=STACK_TYPE, \        external-ipv6-address=EXTERNAL_IPV6_ADDRESS, \        external-ipv6-prefix-length=96, \        ipv6-network-tier=PREMIUM, \        vlan=VLAN_ID \    ...

Replace the following:

  • INSTANCE_NAME: the name of the instance to create.
  • ZONE: the zone where the instance is created.
  • NETWORK_A,NETWORK_B: the network where the interface attaches.
  • SUBNET_A,SUBNET_B: the subnet where the interface attaches.

  • STACK_TYPE: the stack type for the interface.

    The default value isIPV4_ONLY. SpecifyIPV4_IPV6 to configure adual-stack interface, orIPV6_ONLY to configure an IPv6-only interface.

  • Values for interfaces with IPv4 addresses:

    • INTERNAL_IPV4_ADDRESS: the internal IPv4 address that you want theinterface to have in the target subnet. Omit if you just want anyvalid address assigned.

    • EXTERNAL_IPV4_ADDRESS: the externalIPv4 address of the interface.

      You must have previously reserved anexternal IPv4 address. If you don't want the interface to have anexternal IP address, specify "no-address" instead ofaddress=EXTERNAL_IPV4_ADDRESS. If you want theinterface to receive an ephemeral external IP address, specifyaddress=''.

  • Values for interfaces with IPv6 addresses:

    • INTERNAL_IPV6_ADDRESS: the internal IPv6 address range thatyou want the interface to have in the target subnet. If not specified,Google Cloud automatically assigns an internal IPv6 address range fromthe subnet.
    • EXTERNAL_IPV6_ADDRESS: the external IPv6 address range thatyou want the interface to have in the target subnet. If not specified,Google Cloud automatically assigns an external IPv6 address range fromthe subnet.
    Note: An interface can have only one IPv6 address range, either internal or external, but not both.

  • VLAN_ID: a VLAN ID. Specifying a VLAN ID configuresthe network interface as a Dynamic NIC. You must place aDynamic NIC after its parent vNIC in the command.

API

Use theinstances.insert methodto create an instance with multiple network interfaces.

Including thevlan field creates a Dynamic NIC.If you create a Dynamic NIC, you must also follow the stepsforconfiguring the guest OS for Dynamic NICsafter you create the instance.

See the following examples:

  • To create an instance with only internal IPv4 addresses, do the following:

    POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances{...."networkInterfaces": [  {    "networkIP": "IPV4_ADDRESS_A",    "subnetwork": "regions/REGION/subnetworks/SUBNET_A"  },  {    "networkIP": "IPV4_ADDRESS_B",    "subnetwork": "regions/REGION/subnetworks/SUBNET_B",    "vlan": "VLAN_ID"  },    for each interface, specify a network...],other instance settings...}

    Replace the following:

    • PROJECT_ID: the ID of the project that contains theinstance.
    • ZONE: the zone that contains the instance.
    • IPV4_ADDRESS_A,IPV4_ADDRESS_B: the internal IPv4 addresses that youwant to assign to each network interface.
    • REGION: the region that contains the instance.
    • SUBNET_A,SUBNET_B: the subnets where each network interfaceis located.
    • VLAN_ID: a VLAN ID. Specifying a VLAN ID configuresthe network interface as a Dynamic NIC. You must place aDynamic NIC after its parent vNIC the request.

  • To create an instance with both internal IPv4 and internal IPv6 addresses, do the following:

    POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances{...."networkInterfaces": [  {    "subnetwork": "regions/REGION/subnetworks/SUBNET_A",    "ipv6Address": "IPV6_ADDRESS_A",    "internalIpv6PrefixLength": 96,    "stackType": IPV4_IPV6,    "ipv6AccessType": INTERNAL  },  {    "subnetwork": "regions/REGION/subnetworks/SUBNET_B",    "ipv6Address": "IPV6_ADDRESS_B",    "internalIpv6PrefixLength": 96,    "stackType": IPV4_IPV6,    "ipv6AccessType": INTERNAL,    "vlan": "VLAN_ID"  },    for each interface, specify a network...],other instance settings...}

    Replace the following:

    • PROJECT_ID: the ID of the project that contains theinstance.
    • ZONE: the zone that contains the instance.
    • REGION: the region that contains the instance.
    • SUBNET_A,SUBNET_B: the subnets where each network interfaceis located.
    • IPV6_ADDRESS_A,IPV6_ADDRESS_B: the internal IPv6 address range thatyou want the interface to have in the target subnet. If not specified,Google Cloud automatically assigns an internal IPv6 address range fromthe subnet.
    • VLAN_ID: a VLAN ID. Specifying a VLAN ID configuresthe network interface as a Dynamic NIC. You must place aDynamic NIC after its parent vNIC.

  • To create an instance with only internal IPv6 addresses,do the following:

    POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances{...."networkInterfaces": [  {    "subnetwork": "regions/REGION/subnetworks/SUBNET_A",    "ipv6Address": "IPV6_ADDRESS_A",    "internalIpv6PrefixLength": 96,    "stackType": IPV6_ONLY,    "ipv6AccessType": INTERNAL  },  {    "subnetwork": "regions/REGION/subnetworks/SUBNET_B",    "ipv6Address": "IPV6_ADDRESS_B",    "internalIpv6PrefixLength": 96,    "stackType": IPV6_ONLY,    "ipv6AccessType": INTERNAL,    "vlan": "VLAN_ID"  },    for each interface, specify a network...],other instance settings...}

    Replace the following:

    • PROJECT_ID: the ID of the project that contains theinstance.
    • ZONE: the zone that contains the instance.
    • REGION: the region that contains the instance.
    • SUBNET_A,SUBNET_B: the subnets where each network interfaceis located.
    • IPV6_ADDRESS_A,IPV6_ADDRESS_B: the internal IPv6 address range thatyou want the interface to have in the target subnet. If not specified,Google Cloud automatically assigns an internal IPv6 address range fromthe subnet.
    • VLAN_ID: a VLAN ID. Specifying a VLAN ID configuresthe network interface as a Dynamic NIC. You must place aDynamic NIC after its parent vNIC.

Terraform

You can use aTerraformresourceto create an instance with multiple network interfaces.

The Terraform arguments have example values that you can change.

resource "google_compute_instance" "default" {  project      = var.project_id # Replace with your project ID in quotes  zone         = "us-central1-b"  name         = "backend-instance"  machine_type = "e2-medium"  boot_disk {    initialize_params {      image = "debian-cloud/debian-9"    }  }  network_interface {    subnetwork = var.subnet_1 # Replace with self link to a subnetwork in quotes    network_ip = "10.0.0.14"  }  network_interface {    subnetwork = var.subnet_2 # Replace with self link to a subnetwork in quotes    network_ip = "10.10.20.14"  }}

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

Example configurations

The following sections show how to create instances with multiple interfaces.

Configure multiple vNICs and Dynamic NICs

The following sample command creates an instance with the following networkinterfaces:

  • A vNIC namednic0 that is the parent of the following:
    • A Dynamic NIC namednic0.2
  • A vNIC namednic1 that is the parent of the following:
    • A Dynamic NIC namednic1.4
    • A Dynamic NIC namednic1.5
gcloud compute instances create vm1 \    --zone zone-a \    --network-interface=network=network-a,subnet=subnet-a \    --network-interface=network=network-b,subnet=subnet-b,vlan=2 \    --network-interface=network=network-c,subnet=subnet-c \    --network-interface=network=network-d,subnet=subnet-d,vlan=4 \    --network-interface=network=network-e,subnet=subnet-e,vlan=5

After you create an instance with Dynamic NICs, you must alsoconfigure the guest OS for Dynamic NICs.

Configure multiple network interfaces with only IPv4 addresses

The following sample command creates an instance with three network interfaces.

gcloud compute instances create vm1 --machine-type=n1-standard-4 \    --network-interface '' \    --network-interface network=net1,subnet=subnet-a,private-network-ip=10.10.10.2,address=EXTERNAL_IPV4_ADDRESS \    --network-interface network=net2,subnet=subnet-b,private-network-ip=10.10.20.2,no-address

The interfaces are created as follows:

  • nic0 is created with default settings. The interface is attached to asubnet in the default VPC network, with an automaticallyallocated internal IP address and an ephemeral external IP address.

  • nic1 is attached to subnetsubnet-a in networknet1, with an internalIPv4 address of10.10.10.2 and a static external IPv4 address,EXTERNAL_IPV4_ADDRESS.

  • nic2 is attached to subnetsubnet-b in networknet2, with an internalIPv4 address of10.10.20.2 and no external IP address.

For a complete description of thegcloud compute instances createcommand and the--network-interface flag, read thedocumentation for thecommand.

You can use the IP address from the network interface that you have added to setup DNS forwarding. To learn more about configuring Cloud DNS forwardingzones, seeForwarding zones.

Configure multiple network interfaces with both IPv4 and IPv6 addresses

The following sample command creates a dual-stack instance with two networkinterfaces.

gcloud compute instances create vm1 \    --network-interface network=dual-int,subnet=int-subnet,stack-type=IPV4_IPV6 \    --network-interface network=dual-ext,subnet=ext-subnet,stack-type=IPV4_IPV6,ipv6-network-tier=PREMIUM \    --machine-type=n1-standard-4 --zone=ZONE_A

The interfaces are created as follows:

  • nic0 is attached to subnetint-subnet in networkdual-int, with anephemeral internal IPv4 address and an ephemeral internal IPv6 addressrange.

  • nic1 is attached to subnetext-subnet in networkdual-ext, with anephemeral internal IPv4 address and an ephemeral external IPv6 addressrange.

Configure multiple network interfaces with only IPv6 addresses

The following sample command creates an IPv6-onlyinstance with three network interfaces.

gcloud compute instances create vm1 \    --network-interface network=ipv6-only-int-a,subnet=int-subnet-a,stack-type=IPV6_ONLY \    --network-interface network=ipv6-only-int-b,subnet=int-subnet-b,stack-type=IPV6_ONLY,internal-ipv6-address=fd20:db8:0:0:1:0:: \    --network-interface network=ipv6-only-ext,subnet=ext-subnet,stack-type=IPV6_ONLY,ipv6-network-tier=PREMIUM,external-ipv6-address=EXTERNAL_IPV6_ADDRESS \    --machine-type=n1-standard-4 --zone=us-west2-a

The interfaces are created as follows:

  • nic0 is attached to subnetint-subnet-a in networkipv6-only-int-a,with an automatically allocated ephemeral internal IPv6 address.

  • nic1 is attached to subnetint-subnet-b in networkipv6-only-int-b,with a custom ephemeral internal IPv6 address rangefd20:db8:0:0:1:0::/96.

  • nic2 is attached to subnetext-subnet in networkipv6-only-ext, witha static external IPv6 address range,EXTERNAL_IPV6_ADDRESS.

Configure multiple network interfaces for instance groups

You can use instances with multiple network interfaces in unmanaged instancegroups and managed instance groups.

Forunmanaged instance groups,create each instance individually,ensuring that thenic0 network interface for each instance is attached to the samesubnet. Then, add the instances to the unmanaged instance group.

To configure multiple network interfaces formanaged instance groups,you must specify the network configuration for each interface in the instancetemplate, by setting the--network-interface flag once for each interface.The following sample creates an instance template with three network interfaces:

gcloud compute instance-templates create template-1 \    --network-interface subnet=net0-subnet-a \    --network-interface subnet=net1-subnet-b,no-address \    --network-interface subnet=net2-subnet-c,no-address \    --regionREGION_A

Because subnet names in each region of a project must be unique, specifyingsubnets by name implicitly associates each interface with a VPCnetwork. Each interface must use a subnet that is in a unique VPC network:

  • nic0 uses thenet0-subnet-a subnet
  • nic1 uses thenet1-subnet-b subnet
  • nic2 uses thenet2-subnet-c subnet

Theno-address option in the--network-interface flag indicates that theinterface is configured without an external IPv4 address. The internal IP addresscomes from the subnet used by the interface. For complete information about theflags and syntax, see the--network-interface flag for theinstance-templates createcommand.

Note: Connecting to a Shared VPC network by using interfaces other thannic0 is supported only in the gcloud CLI and the API forCompute Engine instance templates.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.