기본 VPN의 경우 온프레미스 측이 하드웨어 기반인 경우 두 번째 피어 측 VPN 게이트웨이를 사용하면 해당 연결 측에서 중복성과 장애 조치가 제공됩니다. 두 번째 물리적 게이트웨이를 사용하면 소프트웨어 업그레이드 또는 기타 예약된 유지보수를 위해 게이트웨이 중 하나를 오프라인으로 전환할 수 있습니다. 또한 기기 중 하나에서 완전한 장애가 발생하더라도 사용자를 보호합니다.
Cloud VPN 게이트웨이의 터널을 두 번째 온프레미스 측 VPN 게이트웨이로 구성하려면 다음을 수행하세요.
두 번째 온프레미스 VPN 게이트웨이 및 터널을 구성합니다.
Cloud VPN 게이트웨이에서 두 번째 온프레미스 게이트웨이를 가리키는 두 번째 터널을 설정합니다.
처음에 수행한 것과 같이 두 번째 터널에 대해 동일한 경로를 전달합니다.
두 터널이 모두 트래픽을 분산하도록 하려면 경로 속성을 동일하게 설정합니다.
한 터널을 기본 터널로 하려면 두 번째 터널의 우선순위를 낮게 설정합니다.
경로에 따른 네트워크 문제 또는 온프레미스 게이트웨이 관련 문제로 인해 VPN 터널이 실패할 경우 Cloud VPN 게이트웨이는 정상 상태의 터널을 통해 계속해서 트래픽을 전송하고 실패한 터널이 복구되는 대로, 두 터널 사용을 자동으로 재개합니다.
옵션 2: Cloud VPN 게이트웨이 확장 온프레미스 VPN 게이트웨이 처리 용량이 더 높고, Cloud VPN 게이트웨이의 처리량을 더 높게 확장하려는 경우, 두 번째 Cloud VPN 게이트웨이를 설정할 수 있습니다.
옵션 3: 온프레미스 게이트웨이와 Cloud VPN 게이트웨이 모두 확장
옵션 1: 온프레미스 VPN 게이트웨이 확장
두 번째 온프레미스 VPN 게이트웨이 기기를 다른 외부 IP 주소로 설정합니다. 기존 Cloud VPN 게이트웨이에서 동일 IP 범위를 전달하지만, 두 번째 온프레미스 게이트웨이 IP를 가리키는 두 번째 터널을 만듭니다. Cloud VPN 게이트웨이는 구성된 터널 간에 부하 분산을 자동으로 수행합니다. 이 방식으로 여러 터널이 부하 분산되도록 VPN 게이트웨이를 설정하여 집계 VPN 연결 처리량을 늘릴 수 있습니다.
중복된 온프레미스 VPN 게이트웨이 다이어그램(확대하려면 클릭)
옵션 2: Cloud VPN 게이트웨이 확장
기존 VPN 게이트웨이와 동일한 리전에 두 번째 Cloud VPN 게이트웨이를 추가합니다. 두 번째 Cloud VPN 게이트웨이는 첫 번째 게이트웨이의 터널과 동일한 온프레미스 VPN 게이트웨이의 IP 주소를 가리키는 터널을 가질 수 있습니다. 구성된 다음에는 온프레미스 VPN 게이트웨이에 대한 트래픽이 2개의 Cloud VPN 게이트웨이와 터널 사이에 자동으로 부하 분산됩니다.
중복된 Cloud VPN 게이트웨이 다이어그램(확대하려면 클릭)
옵션 3: 온프레미스 게이트웨이와 Cloud VPN 게이트웨이 모두 확장
위에 설명된 옵션 1과 옵션 2를 조합하여 처리량을 확장합니다. 2개의 온프레미스 VPN 게이트웨이와 2개의 Cloud VPN 게이트웨이가 있는 경우 각 Cloud VPN 게이트웨이는 서로 온프레미스 VPN 게이트웨이 외부 IP를 가리키는 터널을 가질 수 있으며 VPN 게이트웨이 사이에 4개의 부하 분산 터널이 제공되어 대역폭이 4배 증가할 수 있습니다.
중복된 Cloud VPN 및 온프레미스 VPN 게이트웨이 다이어그램(확대하려면 클릭)
자세한 내용은 처리량이 높은 VPN 빌드 튜토리얼을 참조하세요.
최대 프로젝트 할당량까지 터널 수를 늘릴 수 있습니다. ECMP는 터널 간 트래픽 균형 조정을 위해 사용됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-31(UTC)"],[],[],null,["# Classic VPN topologies\n\nWith Classic VPN, your on-premises hosts communicate through\none or more IPsec VPN tunnels to Compute Engine virtual machine (VM) instances\nin your project's Virtual Private Cloud (VPC) networks.\n\nClassic VPN supports site-to-site VPN as the sample topology\nshown on this page or with [redundancy options](#redundancy-options).\n| **Note:** For information about HA VPN topologies, including Google Cloud-to-Google Cloud VPNs, see the [HA VPN topologies page](/network-connectivity/docs/vpn/concepts/topologies). For information about configuring third-party devices or services with Cloud VPN, see [Use third-party VPNs](/network-connectivity/docs/vpn/how-to/interop-guides).\n\nSample Classic VPN topology\n---------------------------\n\nThe following diagram shows a sample VPN\n[connection](/network-connectivity/docs/vpn/concepts/key-terms#connection)\nbetween a Classic VPN gateway and your\n[peer](/network-connectivity/docs/vpn/concepts/key-terms#peer-definition) VPN gateway.\n[](/static/network-connectivity/docs/vpn/images/cloud-vpn-overview-01.svg) Sample VPN topology with a connection between a Classic VPN gateway and your peer VPN gateway (click to enlarge).\n\nRedundancy and failover options\n-------------------------------\n\n| **Note:** With Classic VPN, it is not possible to create two VPN tunnels within the same Cloud VPN gateway to the same destination VPN gateway.\n\nYou can provide redundancy and failover for Classic VPN gateways\nby using a second Classic VPN gateway.\n\n### Use a second peer VPN gateway\n\nFor Classic VPN, if your on-premises side is hardware based, having\na second peer VPN gateway provides redundancy and failover on that side\nof the connection. A second physical gateway lets you take one of the gateways\noffline for software upgrades or other scheduled maintenance. It also protects\nyou in case of an outright failure in one of the devices.\n\nTo configure a tunnel from your Cloud VPN gateway to a\nsecond on-premises-side VPN gateway, do the following:\n\n1. Configure a second on-premises VPN gateway and a tunnel.\n2. Set up a second tunnel on your Cloud VPN gateway pointing to the second on-premises gateway.\n3. Forward the same routes for the second tunnel as you did for the first. If you want both tunnels to balance traffic, set their [route priorities](/vpc/docs/routes) to be the same. If you want one tunnel to be primary, set a lower priority on the second tunnel.\n4. If either VPN tunnel fails due to network issues along the path, or a problem with an on-premises gateway, the Cloud VPN gateway will continue sending traffic over the healthy tunnel and will automatically resume using both tunnels once the failed tunnel recovers.\n\nFor details about configuring redundancy with dynamic routing, see the\n[Cloud Router redundancy page](/network-connectivity/docs/router/concepts/how-cloud-router-works).\n[](/static/network-connectivity/docs/vpn/images/vpn-basic-2-on-prem.svg) Redundant on-premises VPN gateways diagram (click to enlarge)\n\nIncreased throughput and load balancing options\n-----------------------------------------------\n\n| **Note:** the solutions in this section for increasing throughput can be also used to load balance between two gateways as described for each option.\n\nFor information about VPN bandwidth, see the\n[VPN Overview](/network-connectivity/docs/vpn/concepts/overview#network-bandwidth) and [Calculating\nnetwork throughput](/community/tutorials/network-throughput).\n\nThere are three options for scaling a Cloud VPN configuration:\n\n- Option 1: Scale the on-premises VPN gateway.\n- Option 2: Scale the Cloud VPN gateway. If your on-premises VPN gateway's throughput capabilities are higher, and you want to scale higher throughput from the Cloud VPN gateway, you can set up a second Cloud VPN gateway.\n- Option 3: Scale both the on-premises VPN gateway and the Cloud VPN gateway.\n\n### Option 1: Scale the on-premises VPN gateway\n\nSet up a second on-premises VPN gateway device with a different external IP\naddress. Create a second tunnel on your existing Cloud VPN gateway\nthat forwards the same IP range, but pointing at the second on-premises gateway\nIP. Your Cloud VPN gateway automatically load balances between the\nconfigured tunnels. You can set up the VPN gateways to have multiple tunnels\nload balanced this way to increase the aggregate VPN connectivity throughput.\n[](/static/network-connectivity/docs/vpn/images/vpn-basic-2-on-prem.svg) Redundant on-premises VPN gateways diagram (click to enlarge)\n\n### Option 2: Scale the Cloud VPN gateway\n\n| **Note:** This configuration requires an on-premises VPN gateway that supports using equal-cost multi-path routing ([ECMP](https://wikipedia.org/wiki/Equal-cost_multi-path_routing)) between two tunnels having the same on-premises IP ranges. Many software VPNs are not capable of this.\n\nAdd a second\nCloud VPN gateway in the same region as the existing VPN gateway. The second Cloud VPN gateway can have a tunnel that points to\nthe same IP address of the on-premises VPN gateway as the tunnel on the first\ngateway. Once configured, traffic to the on-premises VPN gateway is\nautomatically load balanced between the two Cloud VPN gateways and\ntunnels.\n[](/static/network-connectivity/docs/vpn/images/vpn-basic-2-cloud-vpn.svg) Redundant Cloud VPN gateways diagram (click to enlarge)\n\n### Option 3: Scale both the on-premises VPN gateway and the Cloud VPN gateway\n\n| **Note:** This configuration requires an on-premises VPN gateway that supports using equal-cost multi-path routing ([ECMP](https://wikipedia.org/wiki/Equal-cost_multi-path_routing)) between two tunnels having the same on-premises IP ranges. Many software VPNs are not capable of this.\n\nCombine options 1 and 2 mentioned above to scale throughput. If you have\ntwo on-premises VPN gateways and two Cloud VPN gateways, each\nCloud VPN gateway can have a tunnel pointing at each on-premises\nVPN gateway external IP, giving you four load balanced tunnels between the VPN\ngateway, thereby potentially providing four times the bandwidth.\n[](/static/network-connectivity/docs/vpn/images/vpn-basic-2-cloud-on-prem.svg) Redundant Cloud VPN and on-premises VPN gateways diagram (click to enlarge)\n\nFor more information, see the tutorial\n[Building high-throughput VPNs](/solutions/building-high-throughput-vpns).\nYou can increase the number of tunnels up to your project's quota. ECMP is used\nto balance traffic between tunnels.\n\nWhat's next\n-----------\n\n- To move to HA VPN, see [Move to HA VPN](/network-connectivity/docs/vpn/how-to/moving-to-ha-vpn).\n- To use high-availability and high-throughput scenarios or multiple subnet scenarios, see [Advanced configurations](/network-connectivity/docs/vpn/concepts/advanced).\n- To help you solve common issues that you might encounter when using Cloud VPN, see [Troubleshooting](/network-connectivity/docs/vpn/support/troubleshooting)."]]
