Deliver IoT SIM traffic privately into Google Cloud

Updated 26 October 2026

To deliver IoT SIM traffic privately into Google Cloud, your SIMs use a private APN and their traffic enters your VPC through Cloud Interconnect: a VLAN attachment connected to a Cloud Router, with routes exchanged over BGP. Devices have private addresses, cannot be reached from the internet, and talk to your workloads on their private IPs. HA VPN is the quicker, internet-routed alternative.

Status: Coming soon (checked 26 October 2026) · Notify me when available

Key points

• Partner Interconnect. You create a VLAN attachment, Google gives you a pairing key, and the provider uses it to connect (Partner Interconnect overview).
• Cloud Router. Each attachment connects to a Cloud Router in your VPC, which learns the SIM range over BGP.
• VPN option. Cloud VPN for a fast start, encrypted, over the internet.

Reference architecture

IoT device ── mobile network ── private APN ── Partner Interconnect
                                                     │  VLAN attachment (pairing key)
                                                     ▼
                                               Cloud Router (BGP)
                                                     │
                                                     ▼
                                   VPC network ── GKE / Compute Engine / Pub/Sub consumers

Steps

1. Create a Cloud Router in the region of your VPC.
2. Create a Partner Interconnect VLAN attachment for the location we indicate, and send us the pairing key.
3. We connect our side; you activate the attachment.
4. Check routes: the Cloud Router learns the SIM range, and advertises the VPC ranges the devices may reach.
5. Restrict access with VPC firewall rules allowing only the SIM range to your backend.
6. Test from a device: a private IP in your VPC must answer.

Learn more

• How private delivery works
• AWS and Azure delivery
• IoT SIM API