Create VMs with multiple network interfaces
This page describes how to create VM instances with multiple network interfaces.
Before you begin
Before you begin, do the following:
- Ensure that you're familiar with the characteristics of instances with multiple network interfaces as described in the Multiple network interfaces overview.
- If you plan to create an instance with Dynamic NICs, review the known issue described in Guest agent version 20250901.00 or later doesn't install Dynamic NICs.
IAM roles
To create an instance with multiple network interfaces, you must have one of the following roles:
- Project Owner or Editor role
- Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1)
Creating and deleting instances and instance templates with multiple interfaces in a project not using a Shared VPC environment: A user with the Owner, Editor, or Compute Instance Admin (v1) role can create an instance with multiple interfaces associated with VPC networks and subnets that are part of that same project.
Creating and deleting instances and instance templates with multiple interfaces in Shared VPC environments: A user with the Owner, Editor, or Compute Instance Admin (v1) role can create an instance with multiple interfaces. If any of the interfaces are attached to a subnet in a Shared VPC host project, you must also have the Compute Network User role (roles/compute.networkUser) for the whole host project or for the subnets you need to use.
To learn more about permissions, read the Compute Engine IAM documentation.
Create VM instances with multiple network interfaces
This section describes how to create an instance with multiple network interfaces, including vNICs and Dynamic NICs. For general instructions about creating instances, see Create and start a VM instance.
The first interface is always created as nic0, and it is always the default interface.
Console
- In the Google Cloud console, go to the Create an instance page. 
- In the Machine configuration pane, do the following: - In the Name field, enter a name for the instance.
- In the Region field, select a region.
- In the Zone field, select a zone.
 
- In the navigation menu, click Networking to view the Networking pane. 
- In the Network interfaces section, expand the network interface to edit it. - For Network and Subnetwork, select the network and subnetwork that you want to use. - If you want to configure IPv6 addresses on the interface, select a subnet that has an - /64IPv6 address range configured. The IPv6 access type of the subnet determines whether the instance receives an internal- /96IPv6 address range or an external- /96IPv6 address range.
- Select one of the following options for the IP stack type for the interface: - IPv4 (single-stack)
- IPv4 and IPv6 (dual-stack)
- IPv6 (single-stack)
 
- For interfaces with IPv4 addresses, do the following: - For Primary internal IPv4 address, select one of the following: - Ephemeral (Automatic) to automatically assign a new ephemeral IPv4 address
- Ephemeral (Custom) to manually specify a new ephemeral IPv4 address
- A reserved static internal IPv4 address from the list
- Reserve static internal IPv4 address to reserve and assign a new static internal IPv4 address
 
- For External IPv4 address, select one of the following: - Ephemeral to assign a new ephemeral IPv4 address
- None to not assign an external IPv4 address
- A reserved static IPv4 address from the list
- Reserve static external IP address to reserve and assign a new static external IPv4 address
 
- You can optionally assign one or more alias IP ranges to the network interface. To assign an alias IP range, do the following: - In Alias IP ranges, click Add IP range.
- In Subnet range, select a subnet primary IPv4 address range or a subnet secondary IPv4 address range to use.
- For Alias IP range, enter an IP range in CIDR notation. This range must be an unused range of the subnet IP range that you selected.
 - For more information about assigning alias IP ranges to VM network interfaces, see Configure alias IP ranges. 
 
- For interfaces with IPv6 addresses, do the following, depending on the access type of the connected subnet: - For Primary internal IPv6 address, select one of the following: - Ephemeral (Automatic) to automatically assign a new ephemeral internal IPv6 address range
- Ephemeral (Custom) to manually specify a new ephemeral internal IPv6 address range
- A reserved static internal IPv6 address range from the list
- Reserve static internal IPv6 address to reserve and assign a new static internal IPv6 address range
 
- For External IPv6 address, select one of the following: - Ephemeral (Automatic) to automatically assign a new ephemeral external IPv6 address range
- Ephemeral (Custom) to manually specify a new ephemeral external IPv6 address range
- A reserved static external IPv6 address range from the list
- Reserve static external IPv6 address to reserve and assign a new static external IPv6 address range
 
 
- For Primary internal IPv6 address, select one of the following: 
- To finish modifying the network interface, click Done. 
 
- To add another network interface: - To add a vNIC, click Add a network interface and complete the form by entering the details of the vNIC. 
- To add a Dynamic NIC, click Add a Dynamic Network Interface and do the following: - In the Parent network interface field, select the parent vNIC for which to create the Dynamic NIC.
- In the VLAN ID field, enter the VLAN ID of the Dynamic NIC.
- Complete the form by entering the remaining details of the Dynamic NIC.
 
 
- Continue with the instance creation process. 
- Click Create. 
gcloud
To create network interfaces on a new instance, use the gcloud compute instances create command.
Include the --network-interface flag for each interface, followed by any appropriate networking keys, such as network, subnet, private-network-ip, address, external-ipv6-address and vlan.
Including the vlan key creates a Dynamic NIC. If you create a Dynamic NIC, you must also follow the steps for configuring the guest OS for Dynamic NICs after you create the instance.
To view examples of how to create instances with multiple interfaces, see example configurations.
This snippet only illustrates the --network-interface flag, one of many possible parameters that you can specify when creating an instance.
gcloud compute instances create INSTANCE_NAME \ --zone ZONE \ --network-interface \ network=NETWORK_A,subnet=SUBNET_A, \ stack-type=STACK_TYPE, \ private-network-ip=INTERNAL_IPV4_ADDRESS, \ address=EXTERNAL_IPV4_ADDRESS | no-address, \ internal-ipv6-address=INTERNAL_IPV6_ADDRESS \ ... --network-interface \ network=NETWORK_B,subnet=SUBNET_B, \ stack-type=STACK_TYPE, \ external-ipv6-address=EXTERNAL_IPV6_ADDRESS, \ external-ipv6-prefix-length=96, \ ipv6-network-tier=PREMIUM, \ vlan=VLAN_ID \ ...
Replace the following:
- INSTANCE_NAME: the name of the instance to create.
- ZONE: the zone where the instance is created.
- NETWORK_A,- NETWORK_B: the network where the interface attaches.
- SUBNET_A,- SUBNET_B: the subnet where the interface attaches.
- STACK_TYPE: the stack type for the interface.- The default value is - IPV4_ONLY. Specify- IPV4_IPV6to configure a dual-stack interface, or- IPV6_ONLYto configure an IPv6-only interface.
- Values for interfaces with IPv4 addresses: - INTERNAL_IPV4_ADDRESS: the internal IPv4 address that you want the interface to have in the target subnet. Omit if you just want any valid address assigned.
- EXTERNAL_IPV4_ADDRESS: the external IPv4 address of the interface.- You must have previously reserved an external IPv4 address. If you don't want the interface to have an external IP address, specify "no-address" instead of - address=EXTERNAL_IPV4_ADDRESS. If you want the interface to receive an ephemeral external IP address, specify- address=''.
 
- Values for interfaces with IPv6 addresses: - INTERNAL_IPV6_ADDRESS: the internal IPv6 address range that you want the interface to have in the target subnet. If not specified, Google Cloud automatically assigns an internal IPv6 address range from the subnet.
- EXTERNAL_IPV6_ADDRESS: the external IPv6 address range that you want the interface to have in the target subnet. If not specified, Google Cloud automatically assigns an external IPv6 address range from the subnet.
 
- VLAN_ID: a VLAN ID. Specifying a VLAN ID configures the network interface as a Dynamic NIC. You must place a Dynamic NIC after its parent vNIC in the command.
API
Use the instances.insert method to create an instance with multiple network interfaces.
Including the vlan field creates a Dynamic NIC. If you create a Dynamic NIC, you must also follow the steps for configuring the guest OS for Dynamic NICs after you create the instance.
See the following examples:
- To create an instance with only internal IPv4 addresses, do the following: - POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances { .... "networkInterfaces": [ { "networkIP": "IPV4_ADDRESS_A", "subnetwork": "regions/REGION/subnetworks/SUBNET_A" }, { "networkIP": "IPV4_ADDRESS_B", "subnetwork": "regions/REGION/subnetworks/SUBNET_B", "vlan": "VLAN_ID" }, for each interface, specify a network... ], other instance settings... }- Replace the following: - PROJECT_ID: the ID of the project that contains the instance.
- ZONE: the zone that contains the instance.
- IPV4_ADDRESS_A,- IPV4_ADDRESS_B: the internal IPv4 addresses that you want to assign to each network interface.
- REGION: the region that contains the instance.
- SUBNET_A, SUBNET_B: the subnets where each network interface is located.
- VLAN_ID: a VLAN ID. Specifying a VLAN ID configures the network interface as a Dynamic NIC. You must place a Dynamic NIC after its parent vNIC the request.
 
- To create an instance with both internal IPv4 and internal IPv6 addresses, do the following: - POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances { .... "networkInterfaces": [ { "subnetwork": "regions/REGION/subnetworks/SUBNET_A", "ipv6Address": "IPV6_ADDRESS_A", "internalIpv6PrefixLength": 96, "stackType": IPV4_IPV6, "ipv6AccessType": INTERNAL }, { "subnetwork": "regions/REGION/subnetworks/SUBNET_B", "ipv6Address": "IPV6_ADDRESS_B", "internalIpv6PrefixLength": 96, "stackType": IPV4_IPV6, "ipv6AccessType": INTERNAL, "vlan": "VLAN_ID" }, for each interface, specify a network... ], other instance settings... }- Replace the following: - PROJECT_ID: the ID of the project that contains the instance.
- ZONE: the zone that contains the instance.
- REGION: the region that contains the instance.
- SUBNET_A, SUBNET_B: the subnets where each network interface is located.
- IPV6_ADDRESS_A, IPV6_ADDRESS_B: the internal IPv6 address range that you want the interface to have in the target subnet. If not specified, Google Cloud automatically assigns an internal IPv6 address range from the subnet.
- VLAN_ID: a VLAN ID. Specifying a VLAN ID configures the network interface as a Dynamic NIC. You must place a Dynamic NIC after its parent vNIC.
 
- To create an instance with only internal IPv6 addresses, do the following: - POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances { .... "networkInterfaces": [ { "subnetwork": "regions/REGION/subnetworks/SUBNET_A", "ipv6Address": "IPV6_ADDRESS_A", "internalIpv6PrefixLength": 96, "stackType": IPV6_ONLY, "ipv6AccessType": INTERNAL }, { "subnetwork": "regions/REGION/subnetworks/SUBNET_B", "ipv6Address": "IPV6_ADDRESS_B", "internalIpv6PrefixLength": 96, "stackType": IPV6_ONLY, "ipv6AccessType": INTERNAL, "vlan": "VLAN_ID" }, for each interface, specify a network... ], other instance settings... }- Replace the following: - PROJECT_ID: the ID of the project that contains the instance.
- ZONE: the zone that contains the instance.
- REGION: the region that contains the instance.
- SUBNET_A, SUBNET_B: the subnets where each network interface is located.
- IPV6_ADDRESS_A, IPV6_ADDRESS_B: the internal IPv6 address range that you want the interface to have in the target subnet. If not specified, Google Cloud automatically assigns an internal IPv6 address range from the subnet.
- VLAN_ID: a VLAN ID. Specifying a VLAN ID configures the network interface as a Dynamic NIC. You must place a Dynamic NIC after its parent vNIC.
 
Terraform
You can use a Terraform resource to create an instance with multiple network interfaces.
The Terraform arguments have example values that you can change.
To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.
Example configurations
The following sections show how to create instances with multiple interfaces.
Configure multiple vNICs and Dynamic NICs
The following sample command creates an instance with the following network interfaces:
- A vNIC named nic0that is the parent of the following:- A Dynamic NIC named nic0.2
 
- A Dynamic NIC named 
- A vNIC named nic1that is the parent of the following:- A Dynamic NIC named nic1.4
- A Dynamic NIC named nic1.5
 
- A Dynamic NIC named 
gcloud compute instances create vm1 \ --zone zone-a \ --network-interface=network=network-a,subnet=subnet-a \ --network-interface=network=network-b,subnet=subnet-b,vlan=2 \ --network-interface=network=network-c,subnet=subnet-c \ --network-interface=network=network-d,subnet=subnet-d,vlan=4 \ --network-interface=network=network-e,subnet=subnet-e,vlan=5
After you create an instance with Dynamic NICs, you must also configure the guest OS for Dynamic NICs.
Configure multiple network interfaces with only IPv4 addresses
The following sample command creates an instance with three network interfaces.
gcloud compute instances create vm1 --machine-type=n1-standard-4 \ --network-interface '' \ --network-interface network=net1,subnet=subnet-a,private-network-ip=10.10.10.2,address=EXTERNAL_IPV4_ADDRESS \ --network-interface network=net2,subnet=subnet-b,private-network-ip=10.10.20.2,no-address
The interfaces are created as follows:
- nic0is created with default settings. The interface is attached to a subnet in the default VPC network, with an automatically allocated internal IP address and an ephemeral external IP address.
- nic1is attached to subnet- subnet-ain network- net1, with an internal IPv4 address of- 10.10.10.2and a static external IPv4 address,- EXTERNAL_IPV4_ADDRESS.
- nic2is attached to subnet- subnet-bin network- net2, with an internal IPv4 address of- 10.10.20.2and no external IP address.
For a complete description of the gcloud compute instances create command and the --network-interface flag, read the documentation for the command.
You can use the IP address from the network interface that you have added to set up DNS forwarding. To learn more about configuring Cloud DNS forwarding zones, see Forwarding zones.
Configure multiple network interfaces with both IPv4 and IPv6 addresses
The following sample command creates a dual-stack instance with two network interfaces.
gcloud compute instances create vm1 \ --network-interface network=dual-int,subnet=int-subnet,stack-type=IPV4_IPV6 \ --network-interface network=dual-ext,subnet=ext-subnet,stack-type=IPV4_IPV6,ipv6-network-tier=PREMIUM \ --machine-type=n1-standard-4 --zone=ZONE_A
The interfaces are created as follows:
- nic0is attached to subnet- int-subnetin network- dual-int, with an ephemeral internal IPv4 address and an ephemeral internal IPv6 address range.
- nic1is attached to subnet- ext-subnetin network- dual-ext, with an ephemeral internal IPv4 address and an ephemeral external IPv6 address range.
Configure multiple network interfaces with only IPv6 addresses
The following sample command creates an IPv6-only instance with three network interfaces.
gcloud compute instances create vm1 \ --network-interface network=ipv6-only-int-a,subnet=int-subnet-a,stack-type=IPV6_ONLY \ --network-interface network=ipv6-only-int-b,subnet=int-subnet-b,stack-type=IPV6_ONLY,internal-ipv6-address=fd20:db8:0:0:1:0:: \ --network-interface network=ipv6-only-ext,subnet=ext-subnet,stack-type=IPV6_ONLY,ipv6-network-tier=PREMIUM,external-ipv6-address=EXTERNAL_IPV6_ADDRESS \ --machine-type=n1-standard-4 --zone=us-west2-a
The interfaces are created as follows:
- nic0is attached to subnet- int-subnet-ain network- ipv6-only-int-a, with an automatically allocated ephemeral internal IPv6 address.
- nic1is attached to subnet- int-subnet-bin network- ipv6-only-int-b, with a custom ephemeral internal IPv6 address range- fd20:db8:0:0:1:0::/96.
- nic2is attached to subnet- ext-subnetin network- ipv6-only-ext, with a static external IPv6 address range,- EXTERNAL_IPV6_ADDRESS.
Configure multiple network interfaces for instance groups
You can use instances with multiple network interfaces in unmanaged instance groups and managed instance groups.
For unmanaged instance groups, create each instance individually, ensuring that the nic0 network interface for each instance is attached to the same subnet. Then, add the instances to the unmanaged instance group.
To configure multiple network interfaces for managed instance groups, you must specify the network configuration for each interface in the instance template, by setting the --network-interface flag once for each interface. The following sample creates an instance template with three network interfaces:
gcloud compute instance-templates create template-1 \ --network-interface subnet=net0-subnet-a \ --network-interface subnet=net1-subnet-b,no-address \ --network-interface subnet=net2-subnet-c,no-address \ --region REGION_A
Because subnet names in each region of a project must be unique, specifying subnets by name implicitly associates each interface with a VPC network. Each interface must use a subnet that is in a unique VPC network:
- nic0uses the- net0-subnet-asubnet
- nic1uses the- net1-subnet-bsubnet
- nic2uses the- net2-subnet-csubnet
The no-address option in the --network-interface flag indicates that the interface is configured without an external IPv4 address. The internal IP address comes from the subnet used by the interface. For complete information about the flags and syntax, see the --network-interface flag for the instance-templates create command.
What's next
- Configure routing for an additional interface
- Add Dynamic NICs to an instance
- View network interfaces for an instance
- Update the network interfaces for an instance
- Delete Dynamic NICs from an instance