This page provides Google-tested interoperability guides and vendor-specific notes for peer third-party VPN devices or services that you can use to connect to Cloud VPN.
Any third-party device or service that supports IPsec and IKE versions 1 or 2 should be compatible with Cloud VPN. For more information, see Supported IKE ciphers.
Each Interop guide offers specific instructions for connecting the third-party VPN solution to Cloud VPN.
If the third-party solution supports dynamic (BGP) routing, the guide includes configuration instructions for Cloud Router.
- Most peer VPN devices should be compatible with Cloud VPN. For general information about configuring peer VPN devices, see Configuring the Peer VPN Gateway.
- For a list of IKE ciphers and other configuration parameters used by Cloud VPN, see Supported IKE Ciphers.
Interop guides by vendor
This section lists interoperability guides by vendor in alphabetical order. Each guide covers how to use that vendor's VPN gateway solution with Cloud VPN.
See the vendor-specific notes section for detailed notes covering the vendors listed in this section.
A-L
- Alibaba Cloud VPN Gateway without redundancy — supports static routes only
- Alibaba Cloud VPN Gateway with redundancy — supports static routes only
- Amazon Web Services with HA VPN — supports dynamic routing with Cloud Router only
- Amazon Web Services with Classic VPN — supports static routes or dynamic routing with Cloud Router
- Cisco ASA 5506H with HA VPN — supports dynamic routing with Cloud Router only
- Cisco ASA 5505 with Classic VPN — supports static routes only
- Cisco ASR — supports static routes or dynamic routing with Cloud Router
- Check Point security gateway — supports static routes or dynamic routing with Cloud Router
- Fortinet FortiGate with HA VPN — supports dynamic routing with Cloud Router only
- Fortinet FortiGate 300C with Classic VPN — supports static routes or dynamic routing with Cloud Router
- Juniper SRX — supports static routes or dynamic routing with Cloud Router
M-Z
- Microsoft Azure — supports static routes only
- Palo Alto Networks PA-3020 — supports static routes or dynamic routing with Cloud Router
- strongSwan — supports dynamic routing with Cloud Router and BIRD
- VyOS — supports static routes or dynamic routing with Cloud Router
Vendor-specific notes
Check Point
Check Point VPN implements IKEv2 by creating multiple Child Security Associations (SAs) when you specify more than one CIDR per traffic selector. This implementation is incompatible with Cloud VPN, which requires all CIDRs for the local traffic selector and all CIDRs for the remote traffic selector to be located in a single Child SA. Refer to Traffic selector strategies for suggestions on how to create a compatible configuration.
Cisco
- If your VPN gateway runs Cisco IOS XE, make sure you're running version 16.6.3 (Everest) or later. Earlier versions have known problems with Phase 2 rekey events, which result in tunnels going down for a few minutes every few hours.
- Cisco ASA supports route-based VPN with Virtual Tunnel Interface (VTI) in IOS version 9.7(x) and later. See the Cisco ASA Series 9.7(x) Release Notes and the VTI chapter in the Cisco ASA Series VPN CLI Configuration Guide, 9.7.
- When using Cisco ASA devices with a Cloud VPN tunnel, you cannot configure more than one IP address range (CIDR block) for each of the local and remote traffic selectors. The reason is that Cisco ASA devices use a unique SA for each IP address range in a traffic selector, while Cloud VPN uses a single SA for all IP ranges in a traffic selector. See traffic selectors for more information.
What's next
- Learn about the basic concepts of Cloud VPN
- See Advanced Configurations for information on high-availability, high-throughput scenarios, or multiple subnet scenarios.
- Create a custom Virtual Private Cloud network
- Maintain VPN tunnels and gateways
- View logs and monitoring metrics
- Get troubleshooting help