Edit on GitHub
Report issue
Page history

Google Cloud VPN Interop Guide for Alibaba Cloud VPN Gateway

Author(s): @epluscloudservices ,   Published: 2018-12-05

Google Cloud Community tutorials submitted from the community do not represent official Google Cloud product documentation.

Learn how to build site-to-site IPsec VPNs between Cloud VPN on Google Cloud Platform (GCP) and Alibaba Cloud VPN Gateway.


Disclaimer: This interoperability guide is intended to be informational in nature and shows examples only. Customers should verify this information by testing it.


This guide walks you through the process of configuring Alibaba Cloud VPN Gateway for integration with the Cloud VPN service on GCP.

If you are using this guide to configure your Alibaba Cloud VPN Gateway implementation, be sure to substitute the correct IP information for your environment.

For more information about Cloud VPN, see the Cloud VPN Overview.


Below are definitions of terms used throughout this guide.

GCP terminology

  • GCP VPC network—A single virtual network within a single GCP project.
  • On-premises gateway—The VPN device on the non-GCP side of the connection, which is usually a device in a physical data center or in another cloud provider's network. GCP instructions are written from the point of view of the GCP VPC network, so "on-premises gateway" refers to the gateway that's connecting to GCP.
  • External IP address or GCP peer address—A single static IP address within a GCP project that exists at the edge of the GCP network.
  • Static routing—Manually specifying the route to subnets on the GCP side and to the on-premises side of the VPN gateway.

Alibaba terminology

  • Alibaba Cloud VPC-A private network established in Alibaba Cloud that is logically isolated from other virtual networks in Alibaba Cloud. VPCs allow you to launch and use Alibaba Cloud resources in your VPC.
  • Alibaba Cloud VSwitch-A VSwitch is a basic network device of a VPC and is used to connect different cloud product instances. When creating a cloud product instance in a VPC, you must specify the VSwitch where the instance is located.
  • Alibaba Cloud Zone-Zones are physical areas with independent power grids and networks in one region. Alibaba recommends creating different VSwitches in different zones disaster recovery purposes.
  • Alibaba Cloud VPN Gateway-The VPN gateway is the IPsec VPN gateway created on the Alibaba Cloud side. One VPN gateway can have multiple VPN connections.
  • Alibaba Cloud Customer Gateway-The customer gateway is the VPN service deployed in the on-premises data center or, in this case, the GCP Cloud VPN gateway. By creating a customer gateway, you can register the VPN information to the cloud, and then create a VPN connection between the VPN gateway and the customer gateway.
  • Alibaba Cloud VRouter-A VRouter is a hub in the VPC that connects all VSwitches in the VPC and serves as a gateway device that connects the VPC to other networks. VRouter routes the network traffic according to the configurations of route entries.
  • Alibaba Cloud Route Entry-A route entry specifies the next hop address for the network traffic destined to a CIDR block. It has two types of entries: system route entry and custom route entry.
  • Alibaba Cloud Route Table-A route table is a list of route entries in a VRouter.


Cloud VPN supports the following topology with Alibaba Cloud VPN Gateway:

  • A site-to-site IPsec VPN tunnel configuration using static routing.

site-to-site IPsec VPN tunnel config with static routing

For detailed topology information, see the following resources:

Disclaimer: At this time, site-to-site IPsec VPN tunnel configuration using dynamic routing between Cloud VPN and Alibaba Cloud VPN Gateway is not supported.

Product environment

The on-premises VPN gateway used in this guide is as follows:

  • Vendor—Alibaba Cloud
  • Service—VPN Gateway

Before you begin

Follow the steps in this section to prepare for VPN configuration.

Note: This guide assumes that you have basic knowledge of the IPsec protocol.

GCP account and project

Make sure you have a GCP account. When you begin, you must select or create a GCP project where you will build the VPN. For details, see Creating and Managing Projects.


To create a GCP network, a subnetwork, and other entities described in this guide, you must be able to sign in to GCP as a user who has Network Admin permissions. For details, see Required Permissions.

IP ranges

The IP address ranges of the GCP VPC and the Alibaba VPC must not overlap.

GCP-compatible settings for IPsec and IKE

Configuring the vendor side of the VPN network requires you to use IPsec and IKE settings that are compatible with the GCP side of the network. The following table lists settings and information about values compatible with GCP VPN. Use these settings for the procedures in the subsections that follow.


Setting Description or value
IPsec Mode ESP+Auth Tunnel mode (Site-to-Site)
Auth Protocol Pre-shared Key (psk)
Shared Secret Also known as an IKE pre-shared key. Choose a strong password by following these guidelines. The shared secret is very sensitive because it allows access into your network.
Start Auto (an on-premises device should automatically restart the connection if it drops.)
PFS (Perfect Forward Secrecy) group1, group2, group5, group14, group24
IKE ciphers aes, aes192, aes256, des, 3des (For details about IKE ciphers for IKEv1 or IKEv2 supported by GCP, including the additional ciphers for PFS, see Supported IKE Ciphers).

Below are fields you might be asked to complete for the Alibaba Cloud side configurations. The defaults indicated below will work with the defaults used on the GCP side.

  • Encryption algorithmaes
  • Integrity algorithmsha1
  • Diffie-Hellman groupgroup2
  • Lifetime/SA life cycles86400 seconds

Configuration overview

The Google Cloud VPN with Alibaba Cloud VPN Gateway configuration consists of the following steps.

  1. Configure the GCP side.
  2. Configure the Alibaba Cloud side.

Configuring the GCP side

This section covers the steps for creating a GCP IPsec VPN using static routing. Both route-based Cloud VPN and policy-based Cloud VPN use static routing. For information on how this works, see the Cloud VPN Overview.

You can create VPN gateways on GCP by using either the GCP Console or the gcloud command-line tool. This section describes how to perform the tasks using the GCP Console. To see the gcloud commands for performing these tasks, see the appendix.

Initial tasks

Complete the following procedures before configuring a static GCP VPN gateway and tunnel.

Important: Throughout these procedures, you assign names to entities like the VPC network and subnet, IP address, and so on. Each time you assign a name, make a note of it, because you often need to use those names in later procedures.

Select a GCP project name

  • Open the GCP Console and at the top of the page, select the GCP project you want to use.

    Note: Make sure that you use the same GCP project for all of the GCP procedures in this guide.

Create a custom VPC network and subnet

  1. In the GCP Console, go to the VPC Networks page.
  2. Click Create VPC network.
  3. For Name, enter a name such as vpn-vendor-test-network. Remember this name for later.
  4. Under Subnets, Subnet creation mode, select the Custom tab and then populate the following fields:

    • Name—The name for the subnet, such as vpn-subnet-1.
    • Region—The region that is geographically closest to the on-premises gateway, such as us-east1.
    • IP address range—A range such as
  5. In the New subnet window, click Done.

  6. Click Create. You're returned to the VPC networks page, where it takes about a minute for this network and its subnet to appear.

Create the GCP external IP address

  1. In the GCP Console, go to the External IP addresses page.
  2. Click Reserve Static Address.
  3. Populate the following fields for the Cloud VPN address:

    • Name—The name of the address, such as vpn-test-static-ip. Remember the name for later.
    • Region—The region where you want to locate the VPN gateway. Normally, this is the region that contains the instances you want to reach.
  4. Click Reserve. You are returned to the External IP addresses page. After a moment, the page displays the static external IP address that you have created.

  5. Make a note of the IP address that is created so that you can use it to configure the VPN gateway later.

Configure a route-based IPsec VPN using static routing

Configure the VPN gateway

  1. In the GCP Console, go to the VPN page.
  2. Click Create VPN connection.
  3. Populate the following fields for the gateway:

    • Name—The name of the VPN gateway. This name is displayed in the console and used in by gcloud to reference the gateway. Use a name like vpn-test-alibaba-gw-1, where alibaba is a string that identifies the vendor.
    • Network—The VPC network that you created previously (for example, vpn-vendor-test-network) that contains the instances that the VPN gateway will serve.
    • Region—The region where you want to locate the VPN gateway. Normally, this is the region that contains the instances you want to reach.
    • IP address—Select the static external IP address (for example, vpn-test-static-ip) that you created for this gateway in the previous section.
  4. Populate the fields for at least one tunnel:

    • Name—The name of the VPN tunnel, such as vpn-test-tunnel1.
    • Remote peer IP address—The public external IP address of the on-premises VPN gateway.
    • IKE versionIKEv2.
    • Shared secret—A character string used in establishing encryption for the tunnel. You must enter the same shared secret into both VPN gateways. For more information, see Generating a Strong Pre-shared Key.
  5. Under Routing options, select the Route based or Policy based tab.

  6. Populate the following fields:

    • Remote network IP range—The range or ranges of the on-premises network, which is the network on the other side of the tunnel from the Cloud VPN gateway you are currently configuring.
    • Local subnetworks—The local subnet or subnets of the Cloud VPN's VPC.
  7. Click Create. The GCP VPN gateway is initiated, and the tunnel is initiated.

    This procedure automatically creates a static route to the on-premises subnet as well as forwarding rules for UDP ports 500 and 4500 and for ESP traffic. The VPN gateways will not connect until you've configured the on-premises gateway and created firewall rules in GCP to allow traffic through the tunnel between the Cloud VPN gateway and the on-premises gateway.

Configure firewall rules

Next, you configure GCP firewall rules to allow inbound traffic from the on-premises network subnets. You must also configure the on-premises network firewall to allow inbound traffic from your VPC subnet prefixes.

  1. In the GCP Console, go to the GCP Firewall rules page.
  2. Click Create firewall rule.
  3. Populate the following fields:

    • Name—A name such as vpnrule1.
    • Network—The name of the VPC network that you created previously (for example, vpn-vendor-test-network).
    • Target tags:—All instances in the network.
    • Source filter—A filter to apply your rule to specific sources of traffic. In this case, choose source IP ranges.
    • Source IP ranges—The on-premises IP ranges to accept from the on-premises VPN gateway.
    • Allowed protocols and ports—The string tcp;udp;icmp.
  4. Click Create.

Configuring the Alibaba Cloud side

This section includes sample tasks that describe how to configure the on-premises side of the VPN gateway configuration using Alibaba Cloud VPN Gateway.

Create an Alibaba Cloud VPC

This section covers the steps of creating an Alibaba Cloud VPC.

  1. Log in to the Alibaba Management Console:
    • Go to Products > Virtual Private Cloud.
  2. Create a new VPC:
    • Select a Region (for example, US (Silicon Valley)).
    • Click the Create VPC button.
  3. Configure the following VPC settings:
    • VPC Name—Enter the name of the VPC (for example, alibaba-vpc).
    • Destination CIDR Block—Specify the IP address range for the VPC in the form of a Classless Inter-Domain Routing (CIDR) block (for example,

Create an Alibaba Cloud VSwitch

This section covers the steps of configuring the Alibaba Cloud VSwitch.

  1. Within the same VPC configuration window pane, configure the following VSwitch settings:
    • VSwitch Name—Enter the name of the VSwitch (for example, alibaba-vswitch).
    • Zone—Select a zone for the VSwitch (for example, USA West 1 Zone A).
    • Destination CIDR Block—Specify a subnet from the VPC’s CIDR IP address range (for example,
  2. Click OK followed by the Complete button.
  3. Verify the VPC and VSwitch status indicate "Available".

Create an Alibaba Cloud VPN Gateway

This section covers the steps of configuring the Alibaba Cloud VPN Gateway.

  1. Go to Products > Virtual Private Cloud > VPN Gateways.
  2. Click Create VPN Gateway.
  3. Configure the following settings:
    • Region—Select a region (for example, US (Silicon Valley)).
    • Name—Give the VPN Gateway a name (for example, alibaba-vpn-gateway).
    • VPC—Select the VPC (for example, alibaba-vpc).
    • Keep all other values as default.
  4. Click Buy Now.
    • Select the VPN Gateway Agreement of Service checkbox, and click Activate.
    • Click Console and navigate back to Products > Virtual Private Cloud > VPN Gateways to verify the status and take note of the IP address as it will be used for GCP-side configuration.

Configure an Alibaba Cloud Customer Gateway

  1. Log in to the Alibaba Cloud console.
  2. Go to Products > Virtual Private Cloud > Customer Gateways.
  3. Select Region (for example, US (Silicon Valley)), and then click Create Customer Gateway.
  4. Complete the following settings:
    • Name—Provide a name to the customer gateway (for example, gcp-customer-gateway).
    • IP Address—Provide the public IP address of GCP (for example,
    • Click OK.

Configure an Alibaba Cloud IPSec Connection

This section covers the steps of creating an Alibaba IPSec connection with the GCP Cloud gateway.

  1. Go to Products > Virtual Private Cloud > IPSec Connections.
  2. Click Create IPsec Connection.
  3. Complete the following settings:
    • Name—Provide a name to the VPN connection (for example, tunnel-vpn-1).
    • VPN Gateway—In the dropdown, choose the VPN gateway that you created earlier (for example, alibaba-vpn-gateway).
    • Customer Gateway—In the dropdown, choose the customer gateway that you created earlier (for example, gcp-customer-gateway).
    • Local network—Provide the local subnet for Alibaba (for example,
    • Remote Network—Provide the remote subnet for GCP (for example,
    • Effective Immediately—Yes.
  4. Click Advanced Configuration.
  5. Complete the following settings:
    • Pre-shared Key—Enter the pre-shared key used on GCP-side. IPsec tunneling requires that both agents use the same key.
    • Versionikev2.
    • Leave all other options default.
  6. Click OK.
  7. Verify that the IPsec Tunnel is established. It might take a few minutes.

    Note: The tunnel status should eventually indicate Phase 2 of IKE Tunnel Negotiation Succeeded. And from the GCP-side, the VPN tunnel status should transition from Negotiation failure to Established. You might need to refresh the GCP Console page until the Established state appears. If the tunnel status in the Alibaba Cloud management console does not reach Succeeded or the tunnel status on the GCP Console does not reach Established, refer to the Troubleshooting section of this document.

Configure an Alibaba Cloud static route entry

Finally, in order to route traffic from the Alibaba Cloud VPC to Google Cloud VPC through the IPsec tunnel, you need to add a custom route entry for the VSwitch subnet.

  1. Add a static route entry:
    • Go to Products > Virtual Private Cloud > VPCs > Route Tables > Instance ID/Name of route table.
  2. Click Add Route Entry.
  3. Configure the following route settings:
    • Destination CIDR Block – The destination Subnet (e.g.
    • Next Hop Type Type – VPN Gateway.
    • VPN Gateway – The VPN Gateway created earlier (e.g. alibaba-vpn-gateway).
  4. Click OK

Testing the configuration

It's important to test the VPN connection from both sides of a VPN tunnel. For either side, make sure that the subnet that a machine or virtual machine is located in is being forwarded through the VPN tunnel.

First, create virtual machines (VMs) on both sides of the tunnel. Make sure that you configure the VMs on a subnet that will pass traffic through the VPN tunnel.

  • Instructions for creating virtual machines in Compute Engine are located in the Getting Started Guide.
  • Instructions for creating virtual machines in Alibaba Cloud Elastic Compute Service (ECS) are located at ECS operation instructions.

    Note: When creating an ECS instance, select Pay-as-You-Go for the billing method unless you intend to place the instance under the Subscription billing method.

After VMs have been deployed on both the GCP and Alibaba Cloud platforms, you can use an ICMP echo (ping) test to test network connectivity through the VPN tunnel.

On the GCP side, use the following instructions to test the connection to a machine that's behind the on-premises gateway:

  1. In the GCP Console, go to the VM Instances page.
  2. Find the GCP virtual machine you created.
  3. In the Connect column, click SSH. A browser window opens at the VM command line.
  4. Ping a machine that's behind the on-premises gateway.

Troubleshooting IPsec on Alibaba Cloud VPN Gateway

For troubleshooting information, see the Alibaba IPSec Connections Troubleshooting Guide and View IPSec Connections Logs.

Reference documentation

You can refer to the following Alibaba Cloud VPN Gateway documentation and Cloud VPN documentation for additional information about both products.

GCP documentation

To learn more about GCP networking, see the following documents:

Alibaba Cloud VPN Gateway documentation

For more product information on Alibaba Cloud VPN Gateway, see the following Alibaba Cloud VPN Gateway feature configuration guides and datasheets:

Appendix: Using gcloud commands

The instructions in this guide focus on using the GCP Console. However, you can perform many of the tasks for the GPC side of the VPN configuration by using the gcloud command-line tool. Using gcloud commands can be faster and more convenient if you're comfortable with using a command-line interface.

Running gcloud commands

You can run gcloud commands on your local computer by installing the Cloud SDK. Alternatively, you can run gcloud commands in Cloud Shell, a browser-based command line. If you use Cloud Shell, you don't need to install the SDK on your own computer, and you don't need to set up authentication.

Note: The gcloud commands presented in this guide assume you are working in a Linux environment. (Cloud Shell is a Linux environment.)

Configuration parameters and values

The gcloud commands in this guide include parameters whose value you must provide. For example, a command might include a GCP project name or a region or other parameters whose values are unique to your context. The following table lists the parameters and gives examples of the values. The section that follows the table describes how to set Linux environment variables to hold the values you need for these parameters.

Parameter description Placeholder Example value
Vendor name [VENDOR_NAME] Your product's vendor name. This value should have no spaces or punctuation in it other than underscores or hyphens, because it will be used as part of the names for GCP entities.
GCP project name [PROJECT_NAME] vpn-guide
Shared secret [SHARED_SECRET] See Generating a Strong Pre-shared Key.
VPC network name [VPC_NETWORK_NAME] vpn-vendor-test-network
Subnet on the GCP VPC network (for example, vpn-vendor-test-network) [VPC_SUBNET_NAME] vpn-subnet-1
GCP region. Can be any region, but it should be geographically close to the on-premises gateway. [REGION] us-east1
Pre-existing external static IP address that you configure for the internet side of the Cloud VPN gateway. [STATIC_EXTERNAL_IP] vpn-test-static-ip
IP address range for the GCP VPC subnet (vpn-subnet-1) [SUBNET_IP]
IP address range for the on-premises subnet. You will use this range when creating rules for inbound traffic to GCP. [IP_ON_PREM_SUBNET]
External static IP address for the internet interface of [vendor name][product-name] [CUST_GW_EXT_IP]
The name for the first GCP VPN gateway. [VPN_GATEWAY_1] vpn-test-alibaba-gw-1, where alibaba is the alibaba string
The name for the first VPN tunnel for vpn-test-[VENDOR_NAME]-gw-1 [VPN_TUNNEL_1] vpn-test-tunnel1
The name of a firewall rule that allows traffic between the on-premises network and GCP VPC networks [VPN_RULE] vpnrule1
The name for the static route used to forward traffic to the on-premises network. Note: You need this value only if you are creating a VPN using a static route. [ROUTE_NAME] vpn-static-route
The name for the forwarding rule for the ESP protocol [FWD_RULE_ESP] fr-esp
The name for the forwarding rule for the UDP protocol, port 500 [FWD_RULE_UDP_500] fr-udp500
The name for the forwarding rule for the UDP protocol, port 4500 [FWD_RULE_UDP_4500] fr-udp4500

Setting environment variables for gcloud command parameters

To make it easier to run gcloud commands that contain parameters, you can create environment variables to hold the values you need, such as your project name, the names of subnets and forwarding rules, and so on. The gcloud commands presented in this section reference variables that contain your values.

To set the environment variables, run the following commands at the command line before you run gcloud commands, substituting your own values for all the placeholders in square brackets, such as [PROJECT_NAME], [VPC_NETWORK_NAME], and [SUBNET_IP]. If you don't know what values to use for the placeholders, use the example values from the parameters table in the preceding section.

export FWD_RULE_UDP_500=[FWD_RULE_UDP_500]
export FWD_RULE_UDP_4500=[FWD_RULE_UDP_4500]
export BGP_IF=[BGP_IF]

Configuring route-based IPsec VPN using static routing

This section describes how to use the gcloud command-line tool to configure IPsec VPN with static routing. To perform the same task using the GPC Console, see Configuring IPsec VPN using static routing earlier in this guide.

The procedure suggests creating a custom VPC network. This is preferred over using an auto-created network. For more information, see Networks and Tunnel Routing in the Cloud VPN documentation.

Note: Before you run the gcloud commands in this section, make sure that you've set the variables as described earlier under Setting environment variables for gcloud command parameters.

  1. Create a custom VPC network. Make sure there is no conflict with your local network IP address range. Note the following:

    • For [RANGE], substitute an appropriate CIDR range, such as

      gcloud compute networks create $VPC_NETWORK_NAME \
          --project $PROJECT_NAME \
          --subnet-mode custom
      gcloud compute networks subnets create $VPC_SUBNET_NAME \
          --project $PROJECT_NAME \
          --network $VPC_NETWORK_NAME \
          --region $REGION \
          --range [RANGE]
  2. Create a VPN gateway in the region you are using. Normally, this is the region that contains the instances you want to reach.

    gcloud compute target-vpn-gateways create $VPN_GATEWAY_1 \
        --project $PROJECT_NAME \
        --network $VPC_NETWORK_NAME \
        --region $REGION

    This step creates an unconfigured VPN gateway in your GCP VPC network.

  3. Reserve a static IP address in the VPC network and region where you created the VPN gateway. Make a note of the address that is created for use in future steps.

    gcloud compute addresses create $STATIC_EXTERNAL_IP \
        --project $PROJECT_NAME \
        --region $REGION
  4. Create three forwarding rules, one each to forward ESP, IKE, and NAT-T traffic to the Cloud VPN gateway. Note the following:

    • For [STATIC_IP_ADDRESS], use the static IP address that you reserved in the previous step.

      gcloud compute forwarding-rules create $FWD_RULE_ESP \
          --project $PROJECT_NAME \
          --region $REGION \
          --ip-protocol ESP \
          --target-vpn-gateway $VPN_GATEWAY_1 \
          --address [STATIC_IP_ADDRESS]
      gcloud compute forwarding-rules create $FWD_RULE_UDP_500 \
          --project $PROJECT_NAME \
          --region $REGION \
          --ip-protocol UDP \
          --target-vpn-gateway $VPN_GATEWAY_1 \
          --ports 500 \
          --address [STATIC_IP_ADDRESS]
      gcloud compute forwarding-rules create $FWD_RULE_UDP_4500 \
          --project $PROJECT_NAME \
          --region $REGION \
          --ip-protocol UDP \
          --target-vpn-gateway $VPN_GATEWAY_1 \
          --ports 4500 \
          --address [STATIC_IP_ADDRESS]
  5. Create a VPN tunnel on the Cloud VPN Gateway that points to the external IP address of your on-premises VPN gateway. Note the following:

    • Set the IKE version. The following command sets the IKE version to 2, which is the default, preferred IKE version. If you need to set it to 1, use --ike-version 1.
    • For [SHARED_SECRET], supply the shared secret. For details, see Generating a Strong Pre-shared Key.
    • For [LOCAL_TRAFFIC_SELECTOR_IP], supply an IP address range, like, that will be accessed on the GCP side of the tunnel, as described in Traffic selectors in the GCP VPN networking documentation.

      gcloud compute vpn-tunnels create $VPN_TUNNEL_1 \
          --project $PROJECT_NAME \
          --peer-address $CUST_GW_EXT_IP \
          --region $REGION \
          --ike-version 2 \
          --shared-secret [SHARED_SECRET] \
          --target-vpn-gateway $VPN_GATEWAY_1 \
          --local-traffic-selector [LOCAL_TRAFFIC_SELECTOR_IP]

    After you run this command, resources are allocated for this VPN tunnel, but it is not yet passing traffic.

  6. Use a static route to forward traffic to the destination range of IP addresses in your on-premises network. The region must be the same region as for the VPN tunnel.

    gcloud compute routes create $ROUTE_NAME \
        --project $PROJECT_NAME \
        --network $VPC_NETWORK_NAME \
        --next-hop-vpn-tunnel $VPN_TUNNEL_1 \
        --next-hop-vpn-tunnel-region $REGION \
        --destination-range $IP_ON_PREM_SUBNET
  7. If you want to pass traffic from multiple subnets through the VPN tunnel, repeat the previous step to forward the IP address of each of the subnets.

  8. Create firewall rules to allow traffic between the on-premises network and GCP VPC networks.

    gcloud compute firewall-rules create $VPN_RULE \
        --project $PROJECT_NAME \
        --network $VPC_NETWORK_NAME \
        --allow tcp,udp,icmp \
        --source-ranges $IP_ON_PREM_SUBNET

Submit a tutorial

Share step-by-step guides

Submit a tutorial

Request a tutorial

Ask for community help

Submit a request

View tutorials

Search Google Cloud tutorials

View tutorials

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see our Site Policies. Java is a registered trademark of Oracle and/or its affiliates.