[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["# Configure the peer VPN gateway\n\nThis page describes the steps to complete your VPN configuration.\n\nTo complete your configuration, configure the following resources on your\npeer VPN gateway:\n\n- Corresponding VPN tunnels to Cloud VPN\n- Border Gateway Protocol (BGP) sessions if you are using dynamic routing with Cloud Router\n- Firewall rules\n- IKE settings\n\nFor best practices when setting up your peer gateway, see your peer gateway\ndocumentation or manufacturer. For guides that describe some supported\nthird-party VPN devices and services, see\n[Use third-party VPNs](/network-connectivity/docs/vpn/how-to/interop-guides). In addition,\nsome third-party device configuration templates are available for download from\nthe Google Cloud console. For more information,\nsee [Download a peer VPN configuration template](/network-connectivity/docs/vpn/how-to/download-config).\n\nFor more information about Cloud VPN, see the following resources:\n\n- For best practices to consider before setting up Cloud VPN, see\n [Best practices](/network-connectivity/docs/vpn/concepts/best-practices).\n\n- For more information about Cloud VPN, see the\n [Cloud VPN overview](/network-connectivity/docs/vpn/concepts/overview).\n\n- For definitions of terms used on this page, see\n [Key terms](/network-connectivity/docs/vpn/concepts/key-terms).\n\nConfigure external peer VPN gateway resources for HA VPN\n--------------------------------------------------------\n\nFor HA VPN, you configure an external peer VPN\ngateway resource that represents your physical peer gateway in Google Cloud. You\ncan also create this resource as a standalone resource and use it later.\n\nTo create an external peer VPN gateway resource, you need the following values\nfrom your physical peer gateway, which can also be a third-party software-based\ngateway. For the VPN to be established, the values for the external peer\nVPN gateway resource must match the configuration on your physical peer gateway:\n\n- The number of interfaces on your physical VPN gateway\n- External IP address or addresses for one or more peer gateways or interfaces\n- BGP endpoint IP address or addresses\n- The IKE pre-shared key (shared secret)\n- The ASN number\n\nWhen you configure the BGP sessions for HA VPN and enable\nIPv6, you have the option of configuring IPv6 next hop addresses.\nIf you do not configure them manually, Google Cloud assigns these IPv6\nnext hop addresses automatically for you.\n\nTo allow IPv4 and IPv6 (dual-stack) traffic in HA VPN\ntunnels, you must obtain the IPv6 next hop address\nassigned to the BGP peer. Then, you must configure the IPv6 next hop address\nwhen you configure the VPN tunnels on your peer VPN device.\nAlthough you configure IPv6 addresses on the tunnel interfaces of each device,\nthe IPv6 addresses are solely used for IPv6 next hop configuration.\nIPv6 routes are advertised through IPv6 NLRI over IPv4 BGP peering.\nFor examples of IPv6 next hop address configurations, see\n[Set up third-party VPNs for IPv4 and IPv6 traffic](/network-connectivity/docs/vpn/how-to/interop-guides-ipv6).\n\nTo create a stand-alone external peer VPN gateway resource, complete the\nfollowing steps. \n\n### Console\n\n1. In the Google Cloud console, go to the **VPN** page.\n\n [Go to VPN](https://console.cloud.google.com/hybrid/vpn/list?tab=peerGateways)\n2. Click **Create peer VPN gateway**.\n\n3. Give the peer gateway a **Name**.\n\n4. Select the number of interfaces that your physical peer gateway has:\n `one`, `two`, or `four`.\n\n5. Add the **Interface IP address** for each interface on your physical\n VPN gateway.\n\n6. Click **Create**.\n\n### gcloud\n\nWhen running the following command, enter the interface ID and IP address\nfor your physical VPN gateway. You can enter 1, 2, or 4 interfaces. \n\n```\ngcloud compute external-vpn-gateways create mygateway \\\n --interfaces 0=35.254.128.120,1=35.254.128.121\n```\n\nThe command output should look like the following example: \n\n```\nCreating external VPN gateway...done.\nNAME REDUNDANCY_TYPE\nmygateway TWO_IPS_REDUNDANCY\n```\n\n### API\n\nFor this command, you can use this list of gateway\n[redundancy types](/network-connectivity/docs/vpn/how-to/creating-ha-vpn#redundancy_types).\n\nMake a POST request by using the\n[`externalVpnGateways.insert`](/compute/docs/reference/rest/v1/externalVpnGateways/insert) method. \n\n```\n POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/externalVpnGateways\n {\n \"name\": \"mygateway\",\n \"interfaces\": [\n {\n \"id\": 0,\n \"ipAddress\": \"35.254.128.120\"\n },\n {\n \"id\": 1,\n \"ipAddress\": \"35.254.128.121\"\n },\n ],\n \"redundancyType\": \"TWO_IPS_REDUNDANCY\"\n }\n```\n\nConfigure VPN tunnels\n---------------------\n\nTo create corresponding tunnels for each Cloud VPN tunnel that you\ncreated, consult the documentation for your peer VPN gateway.\n\nFor HA VPN, configure two tunnels on your peer gateway.\nOne tunnel on the peer gateway should correspond to the Cloud VPN\ntunnel on `interface 0`. Another tunnel on the peer gateway should correspond\nto the Cloud VPN tunnel on `interface 1`.\n\nEach tunnel on your peer gateway should also use a unique external IP\naddress for your HA VPN gateway to use.\n\nConfigure BGP sessions for dynamic routing\n------------------------------------------\n\n| **Note:** Always configure BGP sessions for HA VPN gateways and for Classic VPN gateways with tunnels that use dynamic routing.\n\nFor dynamic routing only, configure your peer VPN gateway to support\nBGP sessions for the peer subnets that you want to advertise to\nCloud Router.\n\nTo configure your peer gateway, use the ASNs and IP addresses of your\nCloud Router and the information from your Cloud VPN gateway.\nTo obtain the Google ASN, configured peer network ASNs, and BGP IP addresses,\nuse the\n[Cloud Router summary information](/network-connectivity/docs/router/how-to/viewing-router-details).\n\nIf you are configuring HA VPN to allow\nIPv4 and IPv6 (dual-stack) traffic, you must configure the peer gateway\nwith the IPv6 next hop address assigned to the BGP peer.\n\nFor HA VPN, the Google ASN---which is the peer\nASN from the perspective of your peer VPN gateway---is the same for both\ntunnels.\n\nYou can optionally configure your BGP sessions to use\n[MD5 authentication](/network-connectivity/docs/router/how-to/use-md5-authentication).\n\nConfigure firewall rules\n------------------------\n\nFor HA VPN connections that use IPv6,\nyou must configure your firewalls to allow IPv6 traffic.\n\nFor instructions about configuring firewall rules for your peer network, see\n[Configure firewall rules](/network-connectivity/docs/vpn/how-to/configuring-firewall-rules).\n\nConfigure IKE\n-------------\n\nYou can configure IKE on your peer VPN gateway for dynamic, route-based, and\npolicy-based routing.\n\nHA VPN tunnels must use IKE v2 to support IPv6 traffic.\n\nTo configure the peer VPN gateway and tunnel for IKE, use the parameters in the\nfollowing table.\n\nFor information about connecting Cloud VPN to some third-party VPN solutions, see\n[Using third-party VPNs\nwith Cloud VPN](/network-connectivity/docs/vpn/how-to/interop-guides). For information about IPsec encryption and authentication settings,\nsee\n[Supported IKE ciphers](/network-connectivity/docs/vpn/concepts/supported-ike-ciphers).\n\n**For IKEv1 and IKEv2**\n\n**Additional parameters for IKEv1 only**\n\nConfiguring traffic selectors\n-----------------------------\n\nTo support both IPv4 and IPv6 traffic, set the traffic selectors on your\npeer VPN gateway to `0.0.0.0/0,::/0`.\n\nTo support only IPv4 traffic, set the traffic selectors on your\npeer VPN gateway to `0.0.0.0/0`.\n\nWhat's next\n-----------\n\n- To download a configuration template for your peer VPN device, see [Download a peer VPN configuration template](/network-connectivity/docs/vpn/how-to/download-config).\n- To configure firewall rules for your peer network, see [Configure firewall rules](/network-connectivity/docs/vpn/how-to/configuring-firewall-rules).\n- To use high-availability and high-throughput scenarios or multiple subnet scenarios, see [Advanced configurations](/network-connectivity/docs/vpn/concepts/advanced).\n- To help you solve common issues that you might encounter when using Cloud VPN, see [Troubleshooting](/network-connectivity/docs/vpn/support/troubleshooting)."]]
