You must advertise specific secondary IP ranges of instances to an on‑prem BGP peer over Cloud VPN. What should you configure on the Cloud Router?

To advertise specific secondary IP ranges from instances to an on-premises BGP peer via Cloud VPN, you must configure the Cloud Router's advertise mode to CUSTOM. This allows you to explicitly define which IP prefixes, including secondary ranges, the Cloud Router will announce to your BGP peer. Simply add the desired secondary IP ranges as custom advertised routes. Creating static routes in the VPC is incorrect because Cloud Router only advertises routes learned via BGP or automatically generated routes for directly connected subnets, not arbitrary static routes unless they are next-hopped to a VPN tunnel. Enabling VPC peering advertisement is irrelevant as this scenario involves a Cloud VPN connection to an on-premises network, not VPC peering. Using a different Cloud Router per subnet is unnecessary and incorrect; a single Cloud Router can advertise multiple custom prefixes from various subnets.