Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
En esta página, se describe cómo agregar un túnel VPN de una puerta de enlace de VPN a otra.
Un túnel VPN es un túnel IPsec encriptado entre la red de una organización y una red remota. Conecta una interfaz VPNGateway a una interfaz PeerGateway y usa el recurso VPNBGPPeer para intercambiar información de enrutamiento a través del túnel.
Antes de comenzar
Para crear un túnel VPN, debes tener lo siguiente:
Los roles de identidad y acceso necesarios son los siguientes:
Administrador de VPN: Tiene permisos de lectura y escritura en todos los recursos relacionados con la VPN. Pídele al administrador de IAM de tu organización que te otorgue el rol de administrador de VPN (vpn-admin).
Visualizador de VPN: Tiene permisos de lectura para todos los recursos relacionados con la VPN. Pídele al administrador de IAM de la organización que te otorgue el rol de visualizador de VPN (vpn-viewer).
MANAGEMENT_API_SERVER: Es la ruta de acceso de kubeconfig del servidor de la API zonal. Si aún no generaste un archivo kubeconfig para el servidor de la API en la zona de destino, consulta Accede para obtener más detalles.
VPN_TUNNEL_NAME: Es el nombre del túnel VPN que se usa.
VPN_GW_NAME: Es el nombre de la puerta de enlace de VPN.
VPN_INTERFACE_NAME: Es el nombre de la interfaz de VPN.
PEER_GW_NAME: Es el nombre de la puerta de enlace de VPN de intercambio de tráfico.
PEER_INTERFACE_NAME: Es el nombre de la interfaz de la puerta de enlace de VPN de intercambio de tráfico.
VPN_BGP_PEER_NAME: Es el nombre del par de BGP de la VPN. Para obtener más información, consulta Crea una sesión de BGP de VPN.
Los objetos VPNGateway, PeerGateway y VPNBGPPeer deben tener estados actualizados después de que un VPNTunnel haga referencia a ellos. Por ejemplo, si verificas que el VPNBGPPeer se concilió correctamente, verás valores de estado actualizados. Obtén los detalles del objeto VPNBGPPeer:
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[[["\u003cp\u003eThis guide details the process of establishing an encrypted IPsec VPN tunnel between two VPN gateways, connecting a \u003ccode\u003eVPNGateway\u003c/code\u003e to a \u003ccode\u003ePeerGateway\u003c/code\u003e and using \u003ccode\u003eVPNBGPPeer\u003c/code\u003e for routing.\u003c/p\u003e\n"],["\u003cp\u003eBefore creating a VPN tunnel, you must have an existing VPN gateway, VPN peer gateway, VPN BGP peer, and a secret, along with the required VPN Admin or VPN Viewer IAM roles.\u003c/p\u003e\n"],["\u003cp\u003eCreating the VPN tunnel involves creating a \u003ccode\u003eVPNTunnel\u003c/code\u003e object in the platform namespace, referencing the previously created \u003ccode\u003eVPNGateway\u003c/code\u003e, \u003ccode\u003ePeerGateway\u003c/code\u003e, \u003ccode\u003eVPNBGPPeer\u003c/code\u003e, and \u003ccode\u003eSecret\u003c/code\u003e resources.\u003c/p\u003e\n"],["\u003cp\u003eAfter creating the \u003ccode\u003eVPNTunnel\u003c/code\u003e object, verify its status and ensure that the \u003ccode\u003eVPNGateway\u003c/code\u003e, \u003ccode\u003ePeerGateway\u003c/code\u003e, and \u003ccode\u003eVPNBGPPeer\u003c/code\u003e objects have updated statuses, indicating successful tunnel establishment and reconciliation.\u003c/p\u003e\n"]]],[],null,["# Create a VPN tunnel\n\nThis page describes how to add a VPN tunnel from one VPN gateway to another.\n\nA VPN tunnel is an encrypted IPsec tunnel between an organization network and a remote network. It connects a `VPNGateway` interface to a `PeerGateway` interface, and uses `VPNBGPPeer` resource to exchange routing information over the tunnel.\n\nBefore you begin\n----------------\n\nTo create a VPN tunnel, you must have the following:\n\n- An existing VPN gateway and VPN peer gateway resource. For more information, see [Create a VPN gateway and peer gateway](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-the-gateways).\n- An existing VPN BGP peer object. For more information, see [Create a VPN BGP session](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-routing).\n- An existing secret. For more information, see [Create the secret with a PSK](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/create-secret).\n- The necessary identity and access roles:\n\n - VPN Admin: has read and write permissions on all VPN-related resources. Ask your Organization IAM Admin to grant you the VPN Admin (`vpn-admin`) role.\n - VPN Viewer: has read permissions on all VPN-related resources. Ask your Organization IAM Admin to grant you the VPN Viewer (`vpn-viewer`) role.\n - For more information, see [Role definitions](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/role-definitions).\n\nCreate a VPN tunnel\n-------------------\n\nReference the `VPNGateway`, `PeerGateway`, `VPNBGPPeer`, and `Secret` resources\ncreated in the previous steps to create the tunnel.\n\nTo create a VPN tunnel, follow these steps:\n\n1. Create the `VPNTunnel` object:\n\n **Note:** The `VPNTunnel` object must be created in the platform namespace. \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e create -n platform -f - \u003c\u003cEOF\n apiVersion: networking.gdc.goog/v1\n kind: VPNTunnel\n metadata:\n name: \u003cvar translate=\"no\"\u003eVPN_TUNNEL_NAME\u003c/var\u003e\n spec:\n vpnInterface:\n name: \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e\n namespace: platform\n interface: \u003cvar translate=\"no\"\u003eVPN_INTERFACE_NAME\u003c/var\u003e\n peerInterface:\n name: \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e\n namespace: platform\n interface: \u003cvar translate=\"no\"\u003ePEER_INTERFACE_NAME\u003c/var\u003e\n vpnBGPPeer:\n name: \u003cvar translate=\"no\"\u003eVPN_BGP_PEER_NAME\u003c/var\u003e\n namespace: platform\n ikeKey:\n name: \u003cvar translate=\"no\"\u003ePSK_NAME\u003c/var\u003e\n namespace: platform\n EOF\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e: the zonal API server's kubeconfig path. If you have not yet generated a kubeconfig file for the API server in your targeted zone, see [Sign in](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in#cli) for details.\n - \u003cvar translate=\"no\"\u003eVPN_TUNNEL_NAME\u003c/var\u003e: the name of the VPN tunnel being used.\n - \u003cvar translate=\"no\"\u003eVPN_GW_NAME\u003c/var\u003e: the name of the VPN gateway.\n - \u003cvar translate=\"no\"\u003eVPN_INTERFACE_NAME\u003c/var\u003e: the name of the VPN interface.\n - \u003cvar translate=\"no\"\u003ePEER_GW_NAME\u003c/var\u003e: the name of the peer VPN gateway.\n - \u003cvar translate=\"no\"\u003ePEER_INTERFACE_NAME\u003c/var\u003e: the name of the peer VPN gateway interface.\n - \u003cvar translate=\"no\"\u003eVPN_BGP_PEER_NAME\u003c/var\u003e: the name of the VPN BGP peer. For more information, see [Create a VPN BGP session](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-routing#create-vpn-bgp-session).\n - \u003cvar translate=\"no\"\u003ePSK_NAME\u003c/var\u003e: the name of the PSK you created in [Create the secret with a PSK](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/create-secret).\n2. Verify that the \u003cvar translate=\"no\"\u003eVPN_TUNNEL_NAME\u003c/var\u003e object was correctly reconciled by examining the `Status` field. Get the details of the VPN tunnel:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e describe -n platform vpntunnel \u003cvar translate=\"no\"\u003eVPN_TUNNEL_NAME\u003c/var\u003e\n\n Examine the output, it must look similar to the following example: \n\n Status:\n Conditions:\n Last Transition Time: 2024-05-10T00:33:31Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: Reconciled\n Last Transition Time: 2024-05-10T00:33:31Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: Ready\n Last Transition Time: 2024-05-10T00:33:31Z\n Message: Tunnel is established.\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: TunnelEstablished\n State: Established\n\n3. The `VPNGateway`, `PeerGateway`, and `VPNBGPPeer` objects must have updated statuses after being referenced by a `VPNTunnel`. For example, if you verify that the `VPNBGPPeer` was correctly reconciled, you see updated status values. Get the details of the `VPNBGPPeer` object:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e describe -n platform vpnbgppeer \u003cvar translate=\"no\"\u003eVPN_BGP_PEER_NAME\u003c/var\u003e\n\n Examine the output, the status values are now updated: \n\n Status:\n Advertised:\n Prefix: 10.0.0.16/28\n Prefix: 10.0.1.32/27\n Prefix: 172.16.0.0/14\n Prefix: 172.20.0.0/17\n Prefix: 172.20.128.0/17\n Prefix: 2002:4860:100e:fa00::/58\n Conditions:\n Last Transition Time: 2024-05-10T00:36:38Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: ValidIPs\n Last Transition Time: 2024-05-10T00:36:38Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: TunnelsAttached\n Last Transition Time: 2024-05-10T00:36:38Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: Reconciled\n Last Transition Time: 2024-05-10T00:36:38Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: AdvertisedRoutesReady\n Last Transition Time: 2024-05-10T00:36:38Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: ReceivedRoutesValid\n Last Transition Time: 2024-05-10T00:36:38Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: ReceivedRoutesReady\n Last Transition Time: 2024-05-10T00:36:38Z\n Message: Ready\n Observed Generation: 1\n Reason: Ready\n Status: True\n Type: Ready\n Received:\n Prefix: 192.168.100.0/24\n Prefix: 193.188.200.0/24\n State: Established\n\nWhat's next\n-----------\n\n- [Control egress and ingress traffic](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/egress-and-ingress)"]]
