Should the nonce passed to GCM be authenticated? This answer recommends authenticating the IV with HMAC when using AES and then HMAC.

Since AES-GCM provides authentication too, should the external nonce passed to GCM be authenticated separately when passing over network? If not, why not? If it should be what is the recommended way to do it?
Should the external nonce passed to GCM be authenticated separately when passing over network?


No, that is not necessary; it is implicitly authenticated by GCM itself, pretty much as the AAD is also authenticated.  That is, if someone in the middle modifies the nonce, then that will alter the authentication tag that the decryptor computes as a part of the GCM decryption process (and alters it in a way that cannot be predicted by someone without the key).  Because the tag will not match the authentication tag that comes with the encrypted packet, the altered packet will be rejected.