Compute instances in Subnet‑2 (asia‑southeast1) cannot reach on‑prem resources. What should you do?

Changing the VPC dynamic routing mode to Global is the correct solution. By default, VPC networks use Regional dynamic routing, meaning Cloud Routers only advertise routes for subnets within their own region. To allow instances in Subnet-2 (asia-southeast1) to reach on-prem resources, the Cloud Router in that region needs to learn routes advertised by Cloud Routers in other regions (e.g., where the VPN/Interconnect to on-prem is established). Global dynamic routing enables this cross-regional route exchange. Configuring a custom route advertisement on the Cloud Router is incorrect because the issue is not about advertising specific routes from the Cloud Router, but rather about the Cloud Router learning routes from other regions. Enabling IP forwarding is a host-level setting and does not address network-wide routing issues. Adding a second BGP session is unnecessary and doesn't resolve the fundamental issue of regional route scope.