diff --git a/.changelog/5369.txt b/.changelog/5369.txt
new file mode 100644
index 00000000000..da439baf3f7
--- /dev/null
+++ b/.changelog/5369.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+compute: fixed a permadiff on `subnetwork` when it is optional on `google_compute_network_endpoint_group`
+```
diff --git a/google/common_diff_suppress.go b/google/common_diff_suppress.go
index 03b497a632b..1f1ab921c4e 100644
--- a/google/common_diff_suppress.go
+++ b/google/common_diff_suppress.go
@@ -195,3 +195,13 @@ func compareIpAddressOrSelfLinkOrResourceName(_, old, new string, _ *schema.Reso
 	// otherwise compare as self links
 	return compareSelfLinkOrResourceName("", old, new, nil)
 }
+
+// Use this method when subnet is optioanl and auto_create_subnetworks = true
+// API sometimes choose a subnet so the diff needs to be ignored
+func compareOptionalSubnet(_, old, new string, _ *schema.ResourceData) bool {
+	if isEmptyValue(reflect.ValueOf(new)) {
+		return true
+	}
+	// otherwise compare as self links
+	return compareSelfLinkOrResourceName("", old, new, nil)
+}
diff --git a/google/resource_compute_network_endpoint_group.go b/google/resource_compute_network_endpoint_group.go
index 4e77b89693c..57648e85055 100644
--- a/google/resource_compute_network_endpoint_group.go
+++ b/google/resource_compute_network_endpoint_group.go
@@ -88,7 +88,7 @@ you create the resource.`,
 				Type:             schema.TypeString,
 				Optional:         true,
 				ForceNew:         true,
-				DiffSuppressFunc: compareSelfLinkOrResourceName,
+				DiffSuppressFunc: compareOptionalSubnet,
 				Description:      `Optional subnetwork to which all network endpoints in the NEG belong.`,
 			},
 			"zone": {
diff --git a/google/resource_compute_network_endpoint_group_test.go b/google/resource_compute_network_endpoint_group_test.go
new file mode 100644
index 00000000000..6e1510bcdf6
--- /dev/null
+++ b/google/resource_compute_network_endpoint_group_test.go
@@ -0,0 +1,48 @@
+package google
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccComputeNetworkEndpointGroup_networkEndpointGroup(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": randString(t, 10),
+	}
+
+	vcrTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckComputeNetworkEndpointGroupDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeNetworkEndpointGroup_networkEndpointGroup(context),
+			},
+			{
+				ResourceName:            "google_compute_network_endpoint_group.neg",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"network", "subnetwork", "zone"},
+			},
+		},
+	})
+}
+
+func testAccComputeNetworkEndpointGroup_networkEndpointGroup(context map[string]interface{}) string {
+	return Nprintf(`
+resource "google_compute_network_endpoint_group" "neg" {
+  name         = "tf-test-my-lb-neg%{random_suffix}"
+  network      = google_compute_network.default.id
+  default_port = "90"
+  zone         = "us-central1-a"
+}
+
+resource "google_compute_network" "default" {
+  name                    = "tf-test-neg-network%{random_suffix}"
+  auto_create_subnetworks = true
+}
+`, context)
+}
diff --git a/google/resource_container_node_pool.go b/google/resource_container_node_pool.go
index 6811a4099f3..6cf6977b68e 100644
--- a/google/resource_container_node_pool.go
+++ b/google/resource_container_node_pool.go
@@ -1,13 +1,13 @@
 package google
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"regexp"
 	"strings"
 	"time"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"