視哪一方是發起者或回應者而定，選取的密碼可能會有所不同。舉例來說，在金鑰輪替期間建立新的安全關聯 (SA) 時，所選的密碼可能會隨之變更。因為變更加密選項可能會影響重要的通道特性，例如效能或 MTU，請使用穩定的加密選項。如要進一步瞭解 MTU，請參閱 MTU 注意事項。
為避免頻繁變更加密方式選取項目，請將對等互連 VPN 閘道和 Cloud VPN 通道設定為只為每個加密方式角色提議及接受一種加密方式。Cloud VPN 和對等互連 VPN 閘道都必須支援此密碼。請勿為每個密碼角色提供密碼清單。這項最佳做法可確保 Cloud VPN 通道兩端在 IKE 協商期間，一律選取相同的 IKE 密碼。
Cloud Location Finder 可協助您找出全球實體位置最近的 Google Cloud 區域和可用區。使用 Cloud Location Finder，您可以根據資訊決定要在哪個 Google Cloud 區域部署 Cloud VPN 閘道，進而可能改善延遲時間、地理位置和碳能源用量。詳情請參閱 Cloud Location Finder 說明文件。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-12 (世界標準時間)。"],[],[],null,["# Best practices for Cloud VPN\n\nThe following best practices can be helpful when planning for and configuring\nCloud VPN.\n\nUse separate Google Cloud projects for networking resources\n-----------------------------------------------------------\n\nTo make configuration of Identity and Access Management (IAM) roles and permissions\neasier, wherever possible, keep your Cloud VPN and Cloud Router\nresources in a project separate from your other Google Cloud resources.\n\nRouting and failover\n--------------------\n\n### Choose dynamic routing\n\nChoose a Cloud VPN gateway that uses\n[dynamic routing](/network-connectivity/docs/vpn/concepts/choosing-networks-routing#dynamic-routing)\nand the Border Gateway Protocol (BGP). Google recommends using\nHA VPN and deploying on-premises devices that support BGP.\n\n### Maximize Cloud VPN availability\n\nFor high availability and better SLA, use HA VPN\nwith BGP. If your setup requires static routes, then use Classic VPN.\n\nFor more information, see [types of VPN](/network-connectivity/docs/vpn/concepts/overview#vpn-types)\nin the Cloud VPN overview.\n\n### Choose the appropriate tunnel configuration\n\nChoose the appropriate tunnel configuration based on the number of\nHA VPN tunnels:\n\n- If you have two HA VPN tunnels, use an active/passive\n tunnel configuration.\n\n- If you have more than two HA VPN tunnels, use an active/active\n tunnel configuration.\n\nFor more information, see the following sections in the Cloud VPN overview:\n\n- [Active/active and active/passive routing options for HA VPN](/network-connectivity/docs/vpn/concepts/overview#active)\n- [Recommended routing option](/network-connectivity/docs/vpn/concepts/overview#recommended-routing-option)\n\nReliability\n-----------\n\n### Configure your peer VPN gateway with only one cipher for each cipher role\n\nCloud VPN can act as an initiator or a responder to IKE requests\ndepending on the origin of traffic when a new security association is\nneeded.\n\nWhen Cloud VPN initiates a VPN connection, Cloud VPN\nproposes the [cipher algorithms](/network-connectivity/docs/vpn/concepts/overview#configure-ciphers)\nconfigured in the Cloud VPN tunnel. If you have not\nconfigured the cipher algorithms (\\[Preview\\](/products#product-launch-stages)),\nthen the Cloud VPN tunnel proposes the cipher algorithms in the\norder shown in the [supported cipher\ntables](/network-connectivity/docs/vpn/concepts/supported-ike-ciphers#tables) for each cipher role. The peer side receiving the proposal selects an\nalgorithm.\n\nIf the peer side initiates the connection, then Cloud VPN selects a\ncipher from the proposal by using the same order as configured or shown in the table for each\ncipher role.\n\nDepending on which side is the initiator or the responder, the selected\ncipher can be different. For example, the selected cipher might even change over\ntime as new security associations (SAs) are created during key rotation. Because\na change in cipher selection can impact important tunnel characteristics such as\nperformance or MTU, use a stable cipher selection. For more\ninformation about MTU, see\n[MTU considerations](/network-connectivity/docs/vpn/concepts/mtu-considerations).\n\nTo prevent frequent changes in cipher selection, configure your peer VPN\ngateway and the Cloud VPN tunnel to propose and accept\nonly one cipher for each cipher role. This cipher\nmust be supported by both Cloud VPN and your peer VPN gateway. Do not\nprovide a list of ciphers for each cipher role. This best practice ensures that\nboth sides of your Cloud VPN tunnel always select the same IKE cipher\nduring IKE negotiation.\n\nCloud Location Finder helps you identify the closest Google Cloud regions and zones to your\nphysical locations worldwide. By using Cloud Location Finder, you can make informed decisions\nabout which Google Cloud region to deploy your Cloud VPN gateways in, potentially\noptimizing for latency, geographic location, and carbon energy usage. For more information,\nsee the [Cloud Location Finder](/location-finder/docs/overview) documentation.\n\nFor HA VPN tunnel pairs, configure both\nHA VPN tunnels on your peer VPN gateway to use the same\ncipher and IKE Phase 2 lifetime values.\n| **Note:** You can configure cipher algorithms for HA VPN topologies that connect VPC networks. If you don't configure cipher algorithms, then the HA VPN gateways auto-negotiate the cipher consistently no matter which side initiates the connection.\n\nSecurity\n--------\n\n### Set up firewall rules for your VPN gateways\n\nCreate secure firewall rules for traffic that travels over Cloud VPN.\nFor more information, see the\n[VPC firewall rules overview](/vpc/docs/firewalls).\n\n### Use strong pre-shared keys\n\nGoogle recommends\n[generating a strong pre-shared key](/network-connectivity/docs/vpn/how-to/generating-pre-shared-key)\nfor your Cloud VPN tunnels.\n\n### Restrict IP addresses for your peer VPN gateways\n\nBy restricting which IP addresses can be specified for a peer VPN gateway,\nyou can prevent unauthorized VPN tunnels from being created.\n\nFor more information, see\n[Restrict IP addresses for peer VPN gateways](/network-connectivity/docs/vpn/how-to/restrict-peer-ip-addresses).\n\n### Configure the strongest cipher on your peer VPN gateway\n\nWhen configuring your peer VPN gateway, choose\nthe strongest cipher for each cipher role that is supported\nby both your peer VPN gateway and Cloud VPN.\n\nThe listed proposal order for Cloud VPN is not ordered by strength.\n\nFor a list of supported IKE ciphers, see\n[Supported IKE ciphers](/network-connectivity/docs/vpn/concepts/supported-ike-ciphers).\n\nWhat's next\n-----------\n\n- To use high-availability and high-throughput scenarios or multiple subnet scenarios, see [Advanced configurations](/network-connectivity/docs/vpn/concepts/advanced).\n- To help you solve common issues that you might encounter when using Cloud VPN, see [Troubleshooting](/network-connectivity/docs/vpn/support/troubleshooting)."]]
