Mit Sammlungen den Überblick behalten
Sie können Inhalte basierend auf Ihren Einstellungen speichern und kategorisieren.
Auf dieser Seite wird beschrieben, wie Sie ein VPN-Gateway oder eine Peer-Gateway-Ressource erstellen.
VPN-Gateways bieten eine sichere Verbindung zwischen mehreren Standorten, z. B. zwischen lokalen Rechenzentren und Cloud-Umgebungen.
Für GDC-VPNs (Google Distributed Cloud) ohne Internetverbindung sind zwei Gateway-Komponenten zu konfigurieren:
Ein VPN-Gateway in GDC
Ihr Peer-VPN-Gateway Dies ist ein physisches VPN-Gateway-Gerät oder eine Softwareanwendung im Peer-Netzwerk, mit dem sich das VPN-Gateway verbindet. Das Peer-Gateway kann entweder ein lokales VPN-Gateway sein oder ein Gateway, das von einem anderen Cloud-Anbieter gehostet wird.
Hinweise
Wenn Sie VPN-Ressourcen über die GDC-Konsole verwalten oder aufrufen möchten, benötigen Sie die erforderlichen Identitäts- und Zugriffsrollen:
VPN-Administrator: Hat Lese- und Schreibberechtigungen für alle VPN-bezogenen Ressourcen. Bitten Sie Ihren IAM-Administrator der Organisation, Ihnen die Rolle „VPN-Administrator“ (vpn-admin) zuzuweisen.
VPN-Betrachter: Hat Leseberechtigungen für alle VPN-bezogenen Ressourcen. Bitten Sie Ihren IAM-Administrator der Organisation, Ihnen die Rolle „VPN Viewer“ (vpn-viewer) zuzuweisen.
Geben Sie einen Schnittstellennamen auf dem Gateway an, um die IP-Adresse darzustellen. Beim Erstellen des Gateways wird automatisch eine externe IPv4-Adresse zugewiesen. Erstellen Sie das VPN-Gateway-Objekt im Plattform-Namespace:
MANAGEMENT_API_SERVER: Der kubeconfig-Pfad des zonalen API-Servers. Wenn Sie noch keine kubeconfig-Datei für den API-Server in Ihrer Zielzone generiert haben, lesen Sie die Informationen unter Anmelden.
VPN_GW_NAME: der Name des VPN-Gateway-Objekts. Beispiel: vpngateway.
VPN_INTERFACE_NAME: der Name der VPN-Schnittstelle. Beispiel: interface0.
Prüfen Sie, ob das VPN_GW_NAME-Objekt korrekt abgeglichen wurde, indem Sie das Feld Status untersuchen. Rufen Sie die Details für das VPN-Gateway-Objekt ab:
status:
conditions:
- lastTransitionTime: "2024-05-10T00:12:58Z"
message: All interfaces are assigned an IP.
observedGeneration: 1
reason: Ready
status: "True"
type: IPsAssigned
- lastTransitionTime: "2024-05-10T00:12:36Z"
message: Condition "TunnelsAttached" is not ready.
observedGeneration: 1
reason: NotReady
status: "False"
type: Ready
- lastTransitionTime: "2024-05-10T00:12:36Z"
message: 'At least one interface is not attached to any VPNTunnel: ["interface0"]'
observedGeneration: 1
reason: NoTunnelAttached
status: "False"
type: TunnelsAttached
interfaces:
- ip: 10.252.218.240
name: interface0
Das VPNGateway-Objekt muss an ein VPNTunnel angehängt sein. Dieser Schritt wird unter VPN-Tunnel erstellen behandelt.
Peer-VPN-Gateway erstellen
Erstellen Sie ein Peer-VPN-Gateway, indem Sie ein PeerGateway-Objekt auf dem Management API-Server erstellen. Das PeerGateway-Objekt stellt einen Remote-VPN-Endpunkt dar. Eine Schnittstelle für ein PeerGateway-Objekt wird von einem VPN-Tunnel verwendet, um einen verschlüsselten Tunnel zum Remote-Standort herzustellen. So erstellen Sie ein Peer-VPN-Gateway:
Geben Sie einen Schnittstellennamen und die statische externe IPv4-Adresse Ihres Peer-VPN-Gateways an. Das PeerGateway-Objekt muss im Plattform-Namespace erstellt werden:
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Schwer verständlich","hardToUnderstand","thumb-down"],["Informationen oder Beispielcode falsch","incorrectInformationOrSampleCode","thumb-down"],["Benötigte Informationen/Beispiele nicht gefunden","missingTheInformationSamplesINeed","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-09-04 (UTC)."],[[["\u003cp\u003eThis guide details the process of creating both a VPN gateway and a peer VPN gateway resource for secure connectivity.\u003c/p\u003e\n"],["\u003cp\u003eA VPN gateway is created in Google Distributed Cloud (GDC) by specifying an interface name, and an external IPv4 address is automatically allocated to it.\u003c/p\u003e\n"],["\u003cp\u003eA peer VPN gateway, representing a remote endpoint, requires specifying an interface name and the static external IPv4 address, which can be an on-premises or cloud-hosted resource.\u003c/p\u003e\n"],["\u003cp\u003eTo manage or view VPN resources, users need the VPN Admin role for read and write permissions, or the VPN Viewer role for read-only access.\u003c/p\u003e\n"],["\u003cp\u003eBoth VPN gateways and peer VPN gateways require the creation of a VPN Tunnel to establish the actual connection, and information to complete this step is provided in the relevant documentation linked.\u003c/p\u003e\n"]]],[],null,["# Create a VPN gateway and peer gateway\n\nThis page describes how to create a VPN gateway or a peer\ngateway resource.\n\nVPN gateways provide secure connectivity between multiple sites, such as between on-premises data centers and cloud environments.\nThere are two gateway components to configure for Google Distributed Cloud (GDC) air-gapped VPN:\n\n- A VPN gateway in GDC.\n- Your peer VPN gateway. This is a physical VPN gateway device or software application in the peer network to which the VPN gateway connects. The peer gateway can either be an on-premises VPN gateway or one hosted by another cloud provider.\n\nBefore you begin\n----------------\n\nTo manage or view VPN resources from the GDC console, you must have the necessary identity and access roles:\n\n- VPN Admin: has read and write permissions on all VPN-related resources. Ask your Organization IAM Admin to grant you the VPN Admin (`vpn-admin`) role.\n- VPN Viewer: has read permissions on all VPN-related resources. Ask your Organization IAM Admin to grant you the VPN Viewer (`vpn-viewer`) role.\n- For more information, see [Role definitions](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/role-definitions).\n\nCreate a VPN gateway\n--------------------\n\nTo create a VPN gateway, follow these steps:\n\n1. Specify an interface name on the gateway to\n represent the IP address. When the gateway is created an external IPv4 address\n is automatically allocated. Create the VPN gateway object in the platform namespace:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e create -n platform -f - \u003c\u003cEOF\n apiVersion: networking.gdc.goog/v1\n kind: VPNGateway\n metadata:\n name: \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e\n spec:\n interfaces:\n - name: \u003cvar translate=\"no\"\u003eVPN_INTERFACE_NAME\u003c/var\u003e\n EOF\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e: the zonal API server's kubeconfig path. If you have not yet generated a kubeconfig file for the API server in your targeted zone, see [Sign in](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in#cli) for details.\n - \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e: the name of the VPN gateway object. For example, `vpngateway`.\n - \u003cvar translate=\"no\"\u003eVPN_INTERFACE_NAME\u003c/var\u003e: the name of the VPN interface. For example, `interface0`.\n2. Verify that the \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e object was correctly reconciled by examining the `Status` field. Get the details for the VPN gateway object:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e describe -n platform vpngateway \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e\n\n Examine the output, it must look similar to the following example: \n\n\n status:\n conditions:\n - lastTransitionTime: \"2024-05-10T00:12:58Z\"\n message: All interfaces are assigned an IP.\n observedGeneration: 1\n reason: Ready\n status: \"True\"\n type: IPsAssigned\n - lastTransitionTime: \"2024-05-10T00:12:36Z\"\n message: Condition \"TunnelsAttached\" is not ready.\n observedGeneration: 1\n reason: NotReady\n status: \"False\"\n type: Ready\n - lastTransitionTime: \"2024-05-10T00:12:36Z\"\n message: 'At least one interface is not attached to any VPNTunnel: [\"interface0\"]'\n observedGeneration: 1\n reason: NoTunnelAttached\n status: \"False\"\n type: TunnelsAttached\n interfaces:\n - ip: 10.252.218.240\n name: interface0\n\nThe `VPNGateway` object must be attached to a `VPNTunnel`. We handle this step in [Create a VPN Tunnel](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-the-tunnel#create-a-vpn-tunnel).\n\nCreate a peer VPN gateway\n-------------------------\n\nCreate a peer VPN gateway by creating a `PeerGateway` object in the Management API server. The `PeerGateway` object represents a remote VPN endpoint. An interface\non a `PeerGateway` object is used by a VPN tunnel to establish an\nencrypted tunnel to the remote site. To create a peer VPN gateway, follow these steps:\n\n1. Specify an interface name and the static\n external IPv4 address of your peer VPN gateway. Create the `PeerGateway` object must be created in the platform namespace:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e create -n platform -f - \u003c\u003cEOF\n apiVersion: networking.gdc.goog/v1\n kind: PeerGateway\n metadata:\n name: \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e\n spec:\n interfaces:\n - name: \u003cvar translate=\"no\"\u003ePEER_INTERFACE_NAME\u003c/var\u003e\n ip: \u003cvar translate=\"no\"\u003ePEER_INTERFACE_IP\u003c/var\u003e\n EOF\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e: the name of the peer VPN gateway. For example, `peergateway`.\n - \u003cvar translate=\"no\"\u003ePEER_INTERFACE_NAME\u003c/var\u003e: the name of the peer interface. For example, `interface0`.\n - \u003cvar translate=\"no\"\u003ePEER_INTERFACE_IP\u003c/var\u003e: the static external IPv4 address of your peer VPN gateway.\n2. Verify that the \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e object was correctly reconciled by examining the `Status` field.\n\n Get the details for the peer VPN gateway object: \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e describe -n platform peergateway \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e\n\n Examine the output, it must look similar to the following example: \n\n Status:\n Conditions:\n Last Transition Time: 2024-05-10T00:15:25Z\n Message: Condition \"TunnelsAttached\" is not ready.\n Observed Generation: 1\n Reason: NotReady\n Status: False\n Type: Ready\n Last Transition Time: 2024-05-10T00:20:45Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: ValidGatewayIPs\n Last Transition Time: 2024-05-10T00:15:25Z\n Message: At least one interface is not attached to any VPNTunnel: [\"interface0\"]\n Observed Generation: 1\n Reason: NoTunnelAttached\n Status: False\n Type: TunnelsAttached\n\n The `PeerGateway` object must be referenced by a `VPNTunnel`. We handle this step in [Create a VPN Tunnel](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-the-tunnel#create-a-vpn-tunnel).\n\nWhat's next\n-----------\n\n- [Create a VPN BGP session](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-routing)\n- [Supported IKE ciphers](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/supported-ike-ciphers)"]]
