status:
conditions:
- lastTransitionTime: "2024-05-10T00:12:58Z"
message: All interfaces are assigned an IP.
observedGeneration: 1
reason: Ready
status: "True"
type: IPsAssigned
- lastTransitionTime: "2024-05-10T00:12:36Z"
message: Condition "TunnelsAttached" is not ready.
observedGeneration: 1
reason: NotReady
status: "False"
type: Ready
- lastTransitionTime: "2024-05-10T00:12:36Z"
message: 'At least one interface is not attached to any VPNTunnel: ["interface0"]'
observedGeneration: 1
reason: NoTunnelAttached
status: "False"
type: TunnelsAttached
interfaces:
- ip: 10.252.218.240
name: interface0
VPNGateway 객체는 VPNTunnel에 연결되어야 합니다. 이 단계는 VPN 터널 만들기에서 처리합니다.
피어 VPN 게이트웨이 만들기
관리 API 서버에서 PeerGateway 객체를 만들어 피어 VPN 게이트웨이를 만듭니다. PeerGateway 객체는 원격 VPN 엔드포인트를 나타냅니다. PeerGateway 객체의 인터페이스는 VPN 터널에서 원격 사이트에 암호화된 터널을 설정하는 데 사용됩니다. 피어 VPN 게이트웨이를 만들려면 다음 단계를 따르세요.
인터페이스 이름과 피어 VPN 게이트웨이의 정적 외부 IPv4 주소를 지정합니다. PeerGateway 객체는 플랫폼 네임스페이스에 만들어야 합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis guide details the process of creating both a VPN gateway and a peer VPN gateway resource for secure connectivity.\u003c/p\u003e\n"],["\u003cp\u003eA VPN gateway is created in Google Distributed Cloud (GDC) by specifying an interface name, and an external IPv4 address is automatically allocated to it.\u003c/p\u003e\n"],["\u003cp\u003eA peer VPN gateway, representing a remote endpoint, requires specifying an interface name and the static external IPv4 address, which can be an on-premises or cloud-hosted resource.\u003c/p\u003e\n"],["\u003cp\u003eTo manage or view VPN resources, users need the VPN Admin role for read and write permissions, or the VPN Viewer role for read-only access.\u003c/p\u003e\n"],["\u003cp\u003eBoth VPN gateways and peer VPN gateways require the creation of a VPN Tunnel to establish the actual connection, and information to complete this step is provided in the relevant documentation linked.\u003c/p\u003e\n"]]],[],null,["# Create a VPN gateway and peer gateway\n\nThis page describes how to create a VPN gateway or a peer\ngateway resource.\n\nVPN gateways provide secure connectivity between multiple sites, such as between on-premises data centers and cloud environments.\nThere are two gateway components to configure for Google Distributed Cloud (GDC) air-gapped VPN:\n\n- A VPN gateway in GDC.\n- Your peer VPN gateway. This is a physical VPN gateway device or software application in the peer network to which the VPN gateway connects. The peer gateway can either be an on-premises VPN gateway or one hosted by another cloud provider.\n\nBefore you begin\n----------------\n\nTo manage or view VPN resources from the GDC console, you must have the necessary identity and access roles:\n\n- VPN Admin: has read and write permissions on all VPN-related resources. Ask your Organization IAM Admin to grant you the VPN Admin (`vpn-admin`) role.\n- VPN Viewer: has read permissions on all VPN-related resources. Ask your Organization IAM Admin to grant you the VPN Viewer (`vpn-viewer`) role.\n- For more information, see [Role definitions](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/role-definitions).\n\nCreate a VPN gateway\n--------------------\n\nTo create a VPN gateway, follow these steps:\n\n1. Specify an interface name on the gateway to\n represent the IP address. When the gateway is created an external IPv4 address\n is automatically allocated. Create the VPN gateway object in the platform namespace:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e create -n platform -f - \u003c\u003cEOF\n apiVersion: networking.gdc.goog/v1\n kind: VPNGateway\n metadata:\n name: \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e\n spec:\n interfaces:\n - name: \u003cvar translate=\"no\"\u003eVPN_INTERFACE_NAME\u003c/var\u003e\n EOF\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e: the zonal API server's kubeconfig path. If you have not yet generated a kubeconfig file for the API server in your targeted zone, see [Sign in](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in#cli) for details.\n - \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e: the name of the VPN gateway object. For example, `vpngateway`.\n - \u003cvar translate=\"no\"\u003eVPN_INTERFACE_NAME\u003c/var\u003e: the name of the VPN interface. For example, `interface0`.\n2. Verify that the \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e object was correctly reconciled by examining the `Status` field. Get the details for the VPN gateway object:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e describe -n platform vpngateway \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e\n\n Examine the output, it must look similar to the following example: \n\n\n status:\n conditions:\n - lastTransitionTime: \"2024-05-10T00:12:58Z\"\n message: All interfaces are assigned an IP.\n observedGeneration: 1\n reason: Ready\n status: \"True\"\n type: IPsAssigned\n - lastTransitionTime: \"2024-05-10T00:12:36Z\"\n message: Condition \"TunnelsAttached\" is not ready.\n observedGeneration: 1\n reason: NotReady\n status: \"False\"\n type: Ready\n - lastTransitionTime: \"2024-05-10T00:12:36Z\"\n message: 'At least one interface is not attached to any VPNTunnel: [\"interface0\"]'\n observedGeneration: 1\n reason: NoTunnelAttached\n status: \"False\"\n type: TunnelsAttached\n interfaces:\n - ip: 10.252.218.240\n name: interface0\n\nThe `VPNGateway` object must be attached to a `VPNTunnel`. We handle this step in [Create a VPN Tunnel](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-the-tunnel#create-a-vpn-tunnel).\n\nCreate a peer VPN gateway\n-------------------------\n\nCreate a peer VPN gateway by creating a `PeerGateway` object in the Management API server. The `PeerGateway` object represents a remote VPN endpoint. An interface\non a `PeerGateway` object is used by a VPN tunnel to establish an\nencrypted tunnel to the remote site. To create a peer VPN gateway, follow these steps:\n\n1. Specify an interface name and the static\n external IPv4 address of your peer VPN gateway. Create the `PeerGateway` object must be created in the platform namespace:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e create -n platform -f - \u003c\u003cEOF\n apiVersion: networking.gdc.goog/v1\n kind: PeerGateway\n metadata:\n name: \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e\n spec:\n interfaces:\n - name: \u003cvar translate=\"no\"\u003ePEER_INTERFACE_NAME\u003c/var\u003e\n ip: \u003cvar translate=\"no\"\u003ePEER_INTERFACE_IP\u003c/var\u003e\n EOF\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e: the name of the peer VPN gateway. For example, `peergateway`.\n - \u003cvar translate=\"no\"\u003ePEER_INTERFACE_NAME\u003c/var\u003e: the name of the peer interface. For example, `interface0`.\n - \u003cvar translate=\"no\"\u003ePEER_INTERFACE_IP\u003c/var\u003e: the static external IPv4 address of your peer VPN gateway.\n2. Verify that the \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e object was correctly reconciled by examining the `Status` field.\n\n Get the details for the peer VPN gateway object: \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e describe -n platform peergateway \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e\n\n Examine the output, it must look similar to the following example: \n\n Status:\n Conditions:\n Last Transition Time: 2024-05-10T00:15:25Z\n Message: Condition \"TunnelsAttached\" is not ready.\n Observed Generation: 1\n Reason: NotReady\n Status: False\n Type: Ready\n Last Transition Time: 2024-05-10T00:20:45Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: ValidGatewayIPs\n Last Transition Time: 2024-05-10T00:15:25Z\n Message: At least one interface is not attached to any VPNTunnel: [\"interface0\"]\n Observed Generation: 1\n Reason: NoTunnelAttached\n Status: False\n Type: TunnelsAttached\n\n The `PeerGateway` object must be referenced by a `VPNTunnel`. We handle this step in [Create a VPN Tunnel](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-the-tunnel#create-a-vpn-tunnel).\n\nWhat's next\n-----------\n\n- [Create a VPN BGP session](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-routing)\n- [Supported IKE ciphers](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/supported-ike-ciphers)"]]
