Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Questa pagina fornisce una panoramica della funzionalità VPN air-gap di Google Distributed Cloud (GDC) e descrive le specifiche e i protocolli di tunneling supportati.
La VPN GDC estende in modo sicuro una rete peer alla macchina virtuale (VM) di un utente in un'organizzazione di una zona GDC tramite una connessione VPN IPsec (Internet Protocol Security).
Configura la VPN GDC utilizzando le risorse VPNGateway,
PeerGateway, VPNBGPPeer e VPNTunnel dell'API
Networking.
Specifiche
La VPN GDC ha le seguenti specifiche:
La VPN GDC supporta solo la connettività VPN IPsec site-to-site. IPsec è una suite di protocolli progettati per proteggere la comunicazione
sulle reti IP. Altre tecnologie VPN, come SSL e VPN, non sono
supportate.
Il gateway VPN peer deve avere un indirizzo IPv4 esterno statico. Questo indirizzo IP è necessario per configurare la VPN.
Se il gateway VPN peer si trova dietro una regola firewall, devi configurare la regola firewall in modo che trasmetta sia il protocollo IPsec Encapsulating Security Payload (ESP) sia il traffico UDP 500 e UDP 4500 di Internet Key Exchange (IKE).
GDC VPN supporta solo NAT one-to-one utilizzando l'incapsulamento UDP per NAT-Traversal (NAT-T). Il gateway VPN peer deve essere
configurato per identificarsi utilizzando il proprio indirizzo IPv4 esterno statico, non
il proprio IP privato interno.
Il traffico IPv6 non è supportato.
Supporto di IPsec e IKE
GDC VPN supporta IKEv2 utilizzando una chiave precondivisa IKE
(segreto condiviso) e crittografie IKE. La VPN GDC supporta solo una
chiave precondivisa per l'autenticazione. Quando crei il
tunnel VPN GDC, specifica una chiave precondivisa. Quando
crei il tunnel nel gateway VPN peer, specifica la stessa chiave precondivisa. Per saperne di più, vedi Creare il secret con una PSK.
GDC VPN supporta ESP in modalità tunnel con autenticazione, ma non supporta AH o ESP in modalità di trasporto.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eGDC VPN utilizes IPsec to establish secure, site-to-site VPN connections between a peer network and a user's VM in a GDC zone.\u003c/p\u003e\n"],["\u003cp\u003eConfiguration of GDC VPN is managed using \u003ccode\u003eVPNGateway\u003c/code\u003e, \u003ccode\u003ePeerGateway\u003c/code\u003e, \u003ccode\u003eVPNBGPPeer\u003c/code\u003e, and \u003ccode\u003eVPNTunnel\u003c/code\u003e resources within the Networking API.\u003c/p\u003e\n"],["\u003cp\u003eThe supported specifications for GDC VPN include requiring a static external IPv4 address for the peer VPN gateway, as well as configuring firewalls to allow ESP, UDP 500, and UDP 4500 traffic.\u003c/p\u003e\n"],["\u003cp\u003eGDC VPN supports IKEv2 with a pre-shared key for authentication and ESP in tunnel mode with authentication.\u003c/p\u003e\n"],["\u003cp\u003eGDC VPN only supports one-to-one NAT using UDP encapsulation for NAT-T, and does not support IPv6, SSL, or other VPN technologies.\u003c/p\u003e\n"]]],[],null,["# Overview\n\nThis page provides an overview of the Google Distributed Cloud (GDC) air-gapped VPN feature and describes the supported specifications and tunneling protocols.\n\nGDC VPN securely extends a peer network to a user's\nvirtual machine (VM) in an organization of a GDC zone\nthrough an Internet Protocol Security (IPsec) VPN connection.\n\nConfigure the GDC VPN using the `VPNGateway`,\n`PeerGateway`, `VPNBGPPeer`, and `VPNTunnel` resources from the [Networking\nAPI](/distributed-cloud/hosted/docs/latest/gdch/apis/service/networking/v1/networking-v1).\n\nSpecifications\n--------------\n\nThe GDC VPN has the following specifications:\n\n- GDC VPN only supports site-to-site IPsec VPN connectivity. IPsec is a suite of protocols designed to secure communication over IP networks. Other VPN technologies, such as SSL and VPN are not supported.\n- The peer VPN gateway must have a static external IPv4 address. You need this IP address to configure VPN.\n- If your peer VPN gateway is behind a firewall rule, you must configure the firewall rule to pass both Encapsulating Security Payload (ESP) IPsec protocol and Internet Key Exchange (IKE) UDP 500 and UDP 4500 traffic to it.\n- GDC VPN only supports one-to-one NAT by using UDP encapsulation for NAT-Traversal (NAT-T). The peer VPN gateway must be configured to identify itself using its static external IPv4 address, not its internal private IP.\n- IPv6 traffic is not supported.\n\n### IPsec and IKE support\n\nGDC VPN supports IKEv2 by using an IKE pre-shared key\n(shared secret) and IKE ciphers. GDC VPN only supports a\npre-shared key for authentication. When you create the\nGDC VPN tunnel, specify a pre-shared key. When you\ncreate the tunnel at the peer VPN gateway, specify this same pre-shared key. For more information, see [Create the secret with a PSK](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/create-secret).\n\nGDC VPN supports ESP in tunnel mode with authentication, but does not support AH or ESP in transport mode.\n\nWhat's next\n-----------\n\n- [Create a VPN gateway and peer gateway](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vpn/configure-the-gateways)"]]
