Cloud Interconnect를 통한 HA VPN을 사용하면 Dedicated Interconnect 또는 Partner Interconnect 연결을 통과하는 트래픽을 암호화할 수 있습니다. Cloud Interconnect를 통한 HA VPN을 배포하는 방법을 알아보세요.
VLAN 연결의 용량을 늘린 후 Cloud Interconnect를 통한 HA VPN 배포에 HA VPN 터널을 추가해야 할 수 있습니다. 터널을 추가하는 또 다른 시나리오는 Cloud VPN 모니터링 알림에서 기존 VPN 터널이 권장 사용률 기준점인 50%를 초과하는 것으로 감지한 경우입니다. 이 기준점은 VLAN 연결이 실패할 경우에 터널 장애 조치를 위한 용량이 충분하도록 보장해 줍니다.
Cloud Interconnect를 통한 HA VPN 배포의 용량을 늘리려면 HA VPN 터널을 추가해야 합니다. 기존 HA VPN 게이트웨이와 외부 피어 VPN 게이트웨이 사이에 HA VPN 터널을 추가할 때 일반적으로 사용하는 절차를 동일하게 사용합니다.
자세한 내용은 HA VPN 게이트웨이에서 피어 VPN 게이트웨이로의 터널 추가를 참조하세요.
기존의 모든 HA VPN 게이트웨이 인터페이스가 사용 가능한 모든 피어 VPN 게이트웨이 인터페이스에 이미 연결된 경우에만 HA VPN 게이트웨이를 하나 이상 추가해야 합니다. 또는 온프레미스 네트워크에 하나 이상의 피어 VPN 게이트웨이를 추가할 수도 있습니다.
Google Cloud CLI 또는 HA VPN API를 사용해야만 HA VPN 게이트웨이를 암호화된 VLAN 연결에 연결할 수 있습니다.
Cloud Interconnect를 통한 HA VPN을 처음 배포한 후에는 Google Cloud 콘솔에서 이 작업을 수행할 수 없습니다.
HA VPN 게이트웨이를 만들려면 다음 단계를 수행합니다.
이 태스크에 필요한 권한
이 태스크를 수행하려면 다음과 같은 권한 또는 다음과 같은 IAM 역할을 부여받아야 합니다.
권한
compute.vpnGateways.create
compute.vpnGateways.delete
compute.vpnGateways.get
compute.vpnGateways.list
compute.vpnGateways.use
compute.vpnGateways.setLabels
역할
roles/compute.networkAdmin
gcloud
HA VPN 게이트웨이를 만듭니다.
예를 들어 다음 명령어는 HA VPN 게이트웨이를 만들고 게이트웨이 인터페이스를 암호화된 VLAN 연결에 할당합니다.
--interconnect-attachments 파라미터의 경우 VLAN 연결을 최대 2개까지 나열할 수 있습니다. 첫 번째 VLAN 연결은 HA VPN 게이트웨이의 인터페이스 0(if0)에 할당됩니다. 선택적 두 번째 VLAN 연결을 지정하면 인터페이스 1(if1)에 할당됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-08(UTC)"],[],[],null,["# Add an HA VPN gateway to HA VPN over Cloud Interconnect\n\nThis page provides instructions for adding HA VPN\ngateways to your existing\n[HA VPN over Cloud Interconnect](/network-connectivity/docs/interconnect/concepts/ha-vpn-interconnect) deployment.\n\nHA VPN over Cloud Interconnect lets you encrypt\nthe traffic that traverses your Dedicated Interconnect or\nPartner Interconnect connections. Learn how to\n[deploy HA VPN over Cloud Interconnect](/network-connectivity/docs/interconnect/how-to/ha-vpn-interconnect-deploy-process).\n\nYou might need to add HA VPN tunnels to your\nHA VPN over Cloud Interconnect deployment after you have increased the capacity\nof your VLAN attachments. Another scenario for adding tunnels is when\nyour Cloud VPN monitoring alerts have detected that your existing VPN tunnels\nhave exceeded the recommended 50% utilization threshold. This threshold ensures\nthat you have sufficient capacity for tunnel failover in the event of VLAN attachment\nfailure.\n\nTo increase the capacity in your HA VPN over Cloud Interconnect deployment,\nyou must add HA VPN tunnels. Use the\nsame procedures that you would normally use to add an\nHA VPN tunnel between an existing\nHA VPN gateway and an external peer VPN gateway.\nFor more information, see\n[Add a tunnel from an HA VPN gateway to a peer VPN gateway](/network-connectivity/docs/vpn/how-to/adding-a-tunnel#add-tunnel-from-ha-vpn-to-peer).\n\nYou only need to add one or more HA VPN gateways if all\nexisting HA VPN gateway interfaces are already connected\nto all available peer VPN gateway interfaces. As an alternative,\nyou can also add one or more peer VPN gateways to your\non-premises network.\n\nYou can only associate HA VPN gateways with encrypted\nVLAN attachments by using the Google Cloud CLI or the HA VPN API.\nYou can't perform this action with the Google Cloud console after you complete the initial\ndeployment of HA VPN over Cloud Interconnect.\n\nTo create an HA VPN gateway, perform the following steps.\n\n#### Permissions required for this task\n\nTo perform this task, you must have been granted the following permissions\n*or* the following IAM roles.\n\n**Permissions**\n\n- `compute.vpnGateways.create`\n- `compute.vpnGateways.delete`\n- `compute.vpnGateways.get`\n- `compute.vpnGateways.list`\n- `compute.vpnGateways.use`\n- `compute.vpnGateways.setLabels`\n\n**Roles**\n\n- `roles/compute.networkAdmin` \n\n### gcloud\n\n1. Create an HA VPN gateway.\n\n For example, the following command creates an HA VPN\n gateway and assigns the gateway interfaces to your encrypted VLAN attachments: \n\n ```\n gcloud compute vpn-gateways create vpn-gateway-c \\\n --network NETWORK_NAME \\\n --region REGION \\\n --interconnect-attachments \\\n ATTACHMENT_1[,ATTACHMENT_2]\n ```\n\n For the `--interconnect-attachments` parameter, you can list up to two\n VLAN attachments. The first VLAN attachment is assigned\n to interface 0 (`if0`) of the HA VPN gateway. If you\n specify the optional second VLAN attachment, it is assigned to\n interface 1 (`if1`).\n\n An example command might look like the following: \n\n ```\n gcloud compute vpn-gateways create vpn-gateway-c \\\n --network network-a \\\n --region us-central1 \\\n --interconnect-attachments \\\n attachment-a-zone1,attachment-a-zone2\n ```\n2. If you configured the encrypted VLAN attachments to use regional internal IP\n addresses for your HA VPN gateways, view the gateway's\n details. Two internal IP addresses from your reserved ranges are\n automatically assigned to the gateway.\n\n To view the regional internal IP addresses assigned to your\n HA VPN gateway's interfaces, use the following command: \n\n ```\n gcloud compute vpn-gateways describe VPN_GATEWAY_NAME\n ```\n\n The output might look similar to the following: \n\n ```\n creationTimestamp: '2022-10-14T16:22:31.748-07:00'\n id: '678310480370225624'\n kind: compute#vpnGateway\n labelFingerprint: 2345567=\n name: vpn-gateway-c\n network: https://www.googleapis.com/compute/v1/projects/project-id/global/networks/network-a\n region: https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1\n selfLink: https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnGateways/vpn-gateway-c\n stackType: IPV4_ONLY\n vpnInterfaces:\n – id: 0\n interconnectAttachment: https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/interconnectAttachments/attachment-a-zone1\n ipAddress: 192.168.20.3\n – id: 1\n interconnectAttachment: https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/interconnectAttachments/attachment-a-zone2\n ipAddress: 192.168.21.3\n ```\n\n### API\n\nTo create the full configuration for an HA VPN gateway,\nuse the API commands in the following sections. All field values used in\nthese sections are example values.\n\nTo create an HA VPN gateway, make a `POST` request\nby using the\n[`vpnGateways.insert` method](/compute/docs/reference/rest/v1/vpnGateways/insert): \n\n```\nPOST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnGateways\n {\n \"name\": \"vpn-gateway-c\",\n \"network\": \"https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME\",\n \"vpnInterfaces\": [\n {\n interconnectAttachment: \"https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/attachment-a-zone1\"\n },\n {\n interconnectAttachment: \"https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/attachment-a-zone2\"\n }\n ]\n }\n```\n\nIf you configured the encrypted VLAN attachments to use regional internal IP\naddresses for your HA VPN gateways, then internal IP\naddresses from your reserved ranges are automatically assigned to the gateway.\n\nTo view the regional internal IP addresses assigned to your\nHA VPN gateway, use the\n[`vpnGateways.get` method](/compute/docs/reference/rest/v1/vpnGateways/get): \n\n```\nGET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnGateways/VPN_GATEWAY_NAME\n```\n\nThe output might look similar to the following: \n\n```\n{\n\"kind\": \"compute#vpnGateway\",\n\"id\": \"678310480370225624\",\n\"creationTimestamp\": \"2022-10-14T16:22:31.748-07:00\",\n\"name\": \"vpn-gateway-c\",\n\"region\": \"https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1\",\n\"network\": \"https://www.googleapis.com/compute/v1/projects/project-id/global/networks/network-a\",\n\"selfLink\": \"https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnGateways/vpngw-test\",\n\"labelFingerprint\": \"2345567=\",\n\"vpnInterfaces\": [\n {\n \"id\": 0,\n \"ipAddress\": \"192.168.20.3\",\n \"interconnectAttachment\": \"https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/interconnectAttachments/attachment-a-zone1\"\n },\n {\n \"id\": 1,\n \"ipAddress\": \"192.168.21.3\",\n \"interconnectAttachment\": \"https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/interconnectAttachments/attachment-a-zone2\"\n }\n ],\n\"stackType\": \"IPV4_ONLY\"\n}\n```\n\n\u003cbr /\u003e\n\nWhat's next?\n------------\n\n- If you need to add more HA VPN tunnels,\n see [Add a VPN tunnel](/network-connectivity/docs/vpn/how-to/adding-a-tunnel).\n\n- To learn about HA VPN monitoring,\n see [View logs and metrics](/network-connectivity/docs/vpn/how-to/viewing-logs-metrics)."]]
