Cloud VPN Overview

This page describes concepts related to Google Cloud VPN. Creating a VPN describes the steps to create a virtual private network (VPN).


Google Cloud VPN securely connects your on-premises network to your Google Cloud Platform (GCP) Virtual Private Cloud (VPC) network through an IPsec VPN connection. Traffic traveling between the two networks is encrypted by one VPN gateway, then decrypted by the other VPN gateway. This protects your data as it travels over the Internet.

  • Cloud VPN provides an SLA of 99.9% service availability.
  • Cloud VPN supports site-to-site VPN. You can have multiple tunnels to a single VPN gateway. In other words, you can connect multiple on-premises networks using multiple on-premises gateways to the same VPC network.
  • Cloud VPN supports both static routes and dynamic routes (via Cloud Router) for managing traffic between your instances and your existing infrastructure.
  • Cloud VPN supports both IKEv1 and IKEv2 using a shared secret (IKE pre-shared key).
  • Cloud VPN uses ESP in Tunnel mode with authentication. Cloud VPN does not support AH or ESP in Transport mode.

When to use Cloud VPN

Cloud VPN only supports IPsec gateway-to-gateway scenarios. You must have a dedicated physical or virtual IPsec VPN gateway on the client side.

Cloud VPN doesn't support client-to-gateway (road warrior) scenarios. In other words, it doesn't work with SSL VPN client software, such as in a browser, only with full IPsec VPN gateway software. Cloud VPN doesn't support VPN technologies other than IPsec.

You can connect multiple on-premises networks to the same VPC network by connecting multiple tunnels to the same Cloud VPN gateway.

You can also use Cloud VPN to connect two different VPC networks.


The following terms are used in this document:

Cloud VPN gateway
The virtual VPN gateway running in GCP. This virtual device is managed by Google, but used only by you.
On-premises VPN gateway
The VPN device on the non-GCP side of the connection, which is usually a device in a physical data center or other cloud provider's network. Instructions are written from the point of view of your VPC network, so the "on-premises gateway" is the gateway connecting to Cloud VPN.
Project ID
The ID of your project, not the project name, which is the user-created friendly name of your project. To find the ID, see the Project ID column in the GCP Console. For more information, see Identifying Projects.

VPN traffic selector

When creating a VPN tunnel, you must tell the tunnel which destination IP address ranges it can allow, and you must create routes to forward packets destined for that IP range to the tunnel.

Traffic selector is an agreement between IKE peers to permit traffic through a tunnel if the traffic matches the specified addresses. With subnets, you must specify which Google Cloud Platform CIDR ranges are valid for a VPN tunnel. These ranges are specified in the Local IP ranges field in the GCP Console and the --local-traffic-selector field in the gcloud command-line tool. These ranges are configured when the tunnel is created and may not be changed afterwards because they are used during the IKE handshake on connect.

The maximum number of CIDR ranges specified in the traffic selector is 128.

In some VPN configurations, gateways allow traffic to pass through that was not specified in the traffic selector during the IKE handshake. For consistent and predictable VPN behavior, make sure the routes destined for the tunnel match the prefixes specified during tunnel creation.

Traffic selector and auto mode VPC networks

If the network of the VPN gateway is an auto mode VPC network, the CIDR range of the subnet in the same region as the VPN gateway is automatically announced to the on-premises VPN. If you only want that subnet to use the tunnel, you do not have to manually specify the traffic selector. You do have to specify a route as shown in the steps below.

If you have an auto mode VPC network and wish subnets other than the subnet containing the gateway to use the tunnel, you must specify these ranges and create routes for them. If you use this field, you must even specify the subnet local to the gateway.

If you are using an auto mode VPC network and you don't specify the traffic selector, you get the default behavior, which is that the subnet local to the Cloud VPN gateway is used to create the tunnel.

Traffic selector and custom mode VPC networks

If the network of the VPN gateway is a custom mode VPC network, no IP prefix is announced to the on-premises VPN by default. You must use the traffic selector to specify the IP prefixes for the subnets that will be routed through the tunnel. You must also specify routes for traffic to reach the tunnel.

VPN diagram

This diagram shows a simple VPN connection between your Cloud VPN gateway and your on-premises VPN gateway.

VPN diagram (click to enlarge)
VPN diagram (click to enlarge)


The following are required to use VPN.

  • You must have a on-premises VPN gateway for the other side of the tunnel.
  • The on-premises VPN gateway must have a static external IP address. You'll need to know the IP address when you configure Cloud VPN. If the on-premises VPN gateway is behind a firewall, you must configure the firewall to pass ESP and IKE traffic.
  • The CIDR range of the VPC network must not conflict with the CIDR ranges of the networks on the on-premises side of the VPN.
  • You must supply a shared secret for the VPN. This can either be provided by your existing on-premises VPN gateway or you can make one up.
  • Cloud VPN supports both IKEv2 (recommended) and IKEv1. Determine what your on-premises VPN gateway supports.

What's next

Send feedback about...