Creating Google Cloud to Google Cloud HA VPN gateways

This page describes how to connect two Virtual Private Cloud networks together using a HA VPN gateway configuration. You can connect two existing VPC networks together as long as the primary and secondary subnet IP address ranges in each network don't overlap.

For a diagram of this topology, see the Topologies page.

For more information on how to choose a VPN type, see the Choosing a VPN Option.

Requirements

Make sure that you meet the following requirements when creating this configuration to ensure that you receive a 99.99% SLA:

  • Place one HA VPN gateway in each VPC network.
  • Place both HA VPN gateways in the same Google Cloud region.
  • Configure a tunnel on each interface of each gateway.
  • Match gateway interfaces as described in the statement below.

Although it is also possible to connect two VPC networks together using a single tunnel between HA VPN gateways or by using Classic VPN gateways, this type of configuration is not considered highly available and does not meet the HA SLA of 99.99% availability.

Permissions requirements

Since HA VPN gateways don't always belong to you or your Google Cloud organization, consider the following permissions requirements when you create an HA VPN gateway, or connect to one owned by someone else:

  • If you own the project where you create a HA VPN gateway, configure the recommended permissions on it.
  • If you want to connect to an HA VPN gateway that resides in a Google Cloud organization or project that you don't own, you need to request the compute.vpnGateways.use permission from the owner.

Before you begin

  • Review information about how dynamic routing works in Google Cloud.
  • Make sure your peer VPN gateway supports BGP.

Setting up the following items in Google Cloud makes it easier to configure Cloud VPN:

  1. Sign in to your Google Account.

    If you don't already have one, sign up for a new account.

  2. In the Cloud Console, on the project selector page, select or create a Cloud project.

    Go to the project selector page

  3. Make sure that billing is enabled for your Google Cloud project. Learn how to confirm billing is enabled for your project.

  4. Install and initialize the Cloud SDK.
  1. If you are using gcloud commands, set your project ID with the following command. The gcloud instructions on this page assume that you have set your project ID before issuing commands.
  gcloud config set project project-id

You can also view a project ID that has already been set:

  gcloud config list --format='text(core.project)'

Creating a custom Virtual Private Cloud network and subnet

Before creating an HA VPN gateway and tunnel pair, you must create a Virtual Private Cloud network and at least one subnet in the region where the HA VPN gateway will reside.

The examples in this document also use VPC global dynamic routing mode, which behaves in the following way:

  • All instances of Cloud Router apply the "to on-premises" routes they learn to all subnets of the VPC network.
  • Routes to all subnets in the VPC network are shared with on-premises routers.

For reference, this document creates a HA VPN gateway in each of two different VPC networks:

network-1 contains the following subnets:

  • A subnet named subnet-name-1 in region-1 that uses the IP range range-1
  • A subnet named subnet-name-2 in region-2 that uses the IP range range-2

network-2 contains the following subnets:

  • A subnet named subnet-name-3 in region-1 that uses the IP range range-3
  • A subnet named subnet-name-4 in region-3 that uses the IP range range-4.

Creating only an HA VPN gateway

You can create a HA VPN gateway without gateway, tunnels, a peer VPN gateway resource, or BGP sessions and configure these additional resources later.

You must create these resources before your gateway can become operational.

Console

  1. Go to the VPN page in the Google Cloud Console.
    Go to the VPN page
    1. If you are creating a gateway for the first time, select the Create VPN connection button.
    2. If you already have VPN gateways, select the gray Create VPN gateways button.
  2. Specify a VPN gateway name
  3. Select a VPC network for your gateway.
  4. Select a region for your gateway.
  5. Click Create.
  6. On the VPN status screen, you can view the details for your new gateway.

gcloud

  1. Create an HA VPN gateway. This action automatically creates and allocates two external IP addresses, one for each gateway interface.

    In the following commands, replace the options as noted below:

    • Replace network with the name of your Google Cloud network.
    • Replace region with the Google Cloud region where you need to create the gateway and tunnel.
    • Replace gw-name with the name of the gateway.
     gcloud compute vpn-gateways create gw-name \
       --network network \
       --region region
    

    The gateway you create should look similar to the following example output. A public IP address has been automatically assigned to each gateway interface:

     Created [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnGateways/ha-vpn-gw-a].
     NAME        INTERFACE0    INTERFACE1   NETWORK   REGION
     ha-vpn-gw-a 203.0.113.16  203.0.113.23 network-a us-central1
    

API

To create an HA VPN gateway, make a POST request to the vpnGateways.insert method, as in the following example. The type of VPC network can be global or regional, depending on how the network is configured.

 POST https://www.googleapis.com/compute/v1/projects/project-id/regions/region/vpnGateways
 {
   "name": "ha-vpn-gw-a",
   "network": "https://www.googleapis.com/compute/v1/projects/project-id/global/networks/network-a"
 }

Creating two fully configured HA VPN gateways that connect to each other

Follow the instructions in this section to create a HA VPN gateway, tunnels, a peer VPN gateway resource, and BGP sessions.

Console

The VPN setup wizard includes all required configuration steps for creating an HA VPN gateway, tunnels, a peer VPN gateway resource, and BGP sessions.

Create a Cloud VPN gateway

  1. Go to the VPN page in the Google Cloud Console.
    Go to the VPN page
    1. If you are creating a gateway for the first time, select the Create VPN connection button.
    2. Select the VPN setup wizard.
  2. Select the radio button for an HA VPN gateway.
  3. Click Continue.
  4. Specify a VPN gateway name.
  5. Under VPC network, select an existing network or the default network.
  6. Select a Region.
  7. Click Create and Continue.
  8. The console screen refreshes and displays your gateway information. Two public IP addresses are automatically allocated for each of your gateway interfaces. For future configuration steps, make note of the details of your gateway configuration.

Create a Peer VPN gateway resource

The peer VPN gateway resource represents your non-Google Cloud gateway in Google Cloud.

  1. On the Create a VPN screen, under Peer VPN gateway, select Google Cloud.
  2. Under Project, select a Google Cloud project that will contain the new gateway.
  3. Under VPN gateway name, choose the other HA VPN that you are configuring at the same time.
  4. Continue on to Create VPN tunnels

Create VPN tunnels

  • If you select Create a single VPN tunnel, you configure your single tunnel on the rest of the Create VPN screen. However, you must create a second tunnel later to get a 99.99% SLA to the other HA VPN gateway.
  • If you select, Create a pair of VPN tunnels (recommended) you must configure the two tunnel dialog boxes that appear at the bottom of the Create VPN screen.
  1. Under High Availability, you can select either a pair of tunnels to the other HA VPN gateway, or one tunnel. You can add a second tunnel later as described at the end of this entire procedure.
  2. Under Cloud Router, If you haven't already, create a Cloud Router specifying the options as noted below. You can use an existing Cloud Router as long as the router does not already manage a BGP session for an interconnect attachment associated with a Partner Interconnect.
    1. To create a Cloud Router, specify a Name, an optional Description, and Google ASN for the new router. You can use any private ASN (64512 through 65534, 4200000000 through 4294967294) that you are not using elsewhere in your network. The Google ASN is used for all BGP sessions on the same Cloud Router and it cannot be changed later.
    2. Click Create to create the router.
  3. Complete the following steps either in the same screen, or in each tunnel's dialog box at the bottom of the screen.
  4. If you are configuring one tunnel, under Associated Cloud VPN gateway interface, select the HA VPN interface/IP address combination for this gateway to associate it with the gateway interface on the other HA VPN gateway. For two-tunnel configurations, this option and the Associated peer VPN gateway interface option are both unavailable because the correct interface combinations are configured for you.
    1. Specify a Name for the tunnel.
    2. Specify an optional Description.
    3. Specify the IKE version. IKE v2, the default setting, is recommended if your peer router supports it.
    4. Specify an IKE pre-shared key using your shared secret, which must correspond with the shared secret for the partner tunnel you create on your peer gateway. If you haven't configured a shared secret on your peer VPN gateway and want to generate one, click the Generate and copy button. Make sure that you record the pre-shared key in a secure location, as it cannot be retrieved once you create your VPN tunnels.
    5. Click Done.
    6. Repeat the tunnel creation steps for any remaining tunnel dialog boxes on the Create VPN screen.
  5. When you have configured all tunnels, click Create and continue.

Create BGP sessions

Setting the advertised route priority (optional)

The following example creates BGP sessions on instances of Cloud Router advertising the routes to the router's respective peer networks using unmodified base priorities.

Use this configuration for active/active configurations where the priorities of the two tunnels on both sides should match. Omitting the advertised base priority results in the same advertised priorities to both BGP peers.
For active/passive configurations, you can control the advertised base priority of the "to Google Cloud" routes that Cloud Router shares with your peer VPN gateway by setting the advertised route priority.
To create an active/passive configuration, set a higher advertised route priority for one BGP session and its corresponding VPN tunnel, than for the other BGP session and VPN tunnel.

For more information about advertised base priority, see Route metrics.

You can also refine the routes that are advertised using custom advertisements, by adding the --advertisement-mode=CUSTOM flag and specifying IP address ranges with --set-advertisement-ranges.

To create BGP sessions:

  1. If you don't want to configure BGP sessions now, click the Configure BGP sessions later button, which takes you to the Summary and Reminder screen.
  2. If you want to configure BGP sessions now, click the Configure button for the first VPN tunnel.
  3. On the Create BGP session screen, perform the following steps:
    1. Specify a Name for the BGP session.
    2. Specify the Peer ASN configured for the peer VPN gateway.
    3. (Optional) Specify the Advertised Route Priority.
    4. Specify the Cloud Router BGP IP address and the BGP Peer IP address. These addresses must each use a link-local address from the 169.254.0.0/16 CIDR block in the same /30 subnet. Make sure that these addresses aren't the network or broadcast address of the subnet.
    5. (Optional) Click the Advertised routes drop-down menu and create custom routes.
    6. Click Save and continue.
  4. Repeat the preceding steps for the rest of the tunnels configured on the gateway, using a different Cloud Router BGP IP address and BGP Peer IP address for each tunnel.
  5. When you have configured all BGP sessions, click Save BGP configuration.

Summary and reminder

  1. The Summary section of this screen lists information for the HA VPN gateway and the peer VPN gateway profile.
  2. For each VPN tunnel, you can view the VPN tunnel status, the BGP session name, the BGP session status, and the MED value (advertised route priority).
  3. The Reminder section of this screen lists the steps that you must complete to have a fully operational VPN connection between Cloud VPN and your peer VPN.
  4. Click Ok after reviewing the information on this screen.

Create an additional tunnel on a single-tunnel gateway.

Follow the steps in this section to configure a second tunnel on the second interface of a HA VPN gateway. If you've configured one tunnel on a HA VPN gateway to another HA VPN gateway but want to receive a 99.99% uptime SLA, you must configure a second tunnel.

  1. Go to the VPN page in the Google Cloud Console.
    Go to the VPN page
    1. Find the HA VPN you want to add the tunnel to.
    2. Click the Add VPN tunnel button.
    3. Under Peer VPN gateway, select Google Cloud.
    4. Under Project, select a Google Cloud project that will contain the new gateway.
    5. For VPN gateway name, choose the other HA VPN gateway that the new tunnel connects to.
    6. Select Add the second VPN tunnel to an existing VPN tunnel for high availability.
    7. Under Select existing VPN tunnel, make sure the existing tunnel is selected. You can click a link to view all existing tunnels near the top of the same screen.
    8. Specify a tunnel Name.
    9. Specify the same IKE version in use by the tunnel on the other gateway.
    10. Specify an IKE pre-shared key using your shared secret, which must correspond with the shared secret for the partner tunnel you create on your peer gateway. If you haven't configured a shared secret on your peer VPN gateway and want to generate one, click the Generate and copy button. Make sure that you record the pre-shared key in a secure location, as it cannot be retrieved once you create your VPN tunnels.
    11. Click Create and continue.
    12. Configure and save a BGP session as in the preceding steps. Otherwise, you can configure BGP later.
    13. Check the Summary reminder screen for configuration information and click OK.

gcloud

Create the HA VPN gateways

Complete the following command sequence to create two HA VPN gateways:

  1. Create an HA VPN gateway in each network in region-1. When each gateway is created, two external IP addresses are automatically allocated, one for each gateway interface. Take note of these IP addresses to use later on in the configuration steps.

    In the following commands, replace the options as noted below:

    • Replace gw-name-1 and gw-name-2 with the name of each gateway.
    • Replace all other options with the values you used previously.

    Create the first gateway

      gcloud compute vpn-gateways create gw-name-1 \
        --network network-1 \
        --region region-1
    

    The gateway you create should look similar to the following example output. A public IP address has been automatically assigned to each gateway interface:

      Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnGateways/ha-vpn-gw-a].
      NAME        INTERFACE0    INTERFACE1     NETWORK    REGION
      ha-vpn-gw-a 203.0.113.16  203.0.113.23   network-a  us-central1
    

    Create the second gateway

      gcloud compute vpn-gateways create gw-name-2 \
        --network network-2 \
        --region region-1
    
      Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnGateways/ha-vpn-gw-b].
      NAME        INTERFACE0   INTERFACE1    NETWORK    REGION
      ha-vpn-gw-b 203.0.114.18 203.0.114.25  network-b  us-central1
    

Create each Cloud Router

The following instructions assume that you haven't already created Cloud Routers to use for managing BGP sessions for your HA VPN tunnels.

You can use an existing Cloud Router in each VPC network, unless those routers already manage a BGP session for an interconnect attachment associated with a Partner Interconnect.

  1. Complete the following command sequence to create a Cloud Router in each network. In the following commands, replace the options as noted below:

    • Replace asn-1 and asn-2 with any private ASN (64512 - 65534, 4200000000 - 4294967294) that you are not already using. This example uses ASN 65001 for both interfaces of router-name-1 and ASN 65002 for both interfaces of router-name-2.
    • Replace all other options with the values you used previously.

    Create the first router

      gcloud compute routers create router-name-1 \
        --region region-1 \
        --network network-1 \
        --asn asn-1
    

    The router you create should look similar to the following example output:

      Created [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-a].
      NAME     REGION      NETWORK
      router-a us-central1 network-a
    

    Create the second router

      gcloud compute routers create router-name-2 \
        --region region-1 \
        --network network-2 \
        --asn asn-2
    

    The router you create should look similar to the following example output:

      Created [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-b].
      NAME     REGION      NETWORK
      router-b us-central1 network-b
    

Create VPN tunnels

  1. Complete the following command sequence to create two VPN tunnels on each HA VPN gateway.

    • The tunnel you create from interface 0 of gw-name-1 must connect to the public IP address associated with interface 0 of gw-name-2 in network-2, and
    • The tunnel from interface 1 of gw-name-1 must connect to the public IP address associated with interface 1 of gw-name-2.
    • When you create VPN tunnels on gw-name-1 in network-1, you must specify the information for gw-name-2 in network-2. Google automatically connects the tunnel from interface 0 of gw-name-1 to interface 0 of gw-name-2, and interface 1 of gw-name-1 to interface 1 of gw-name-2.

    Create two tunnels on gw-name-1

    1. Create two VPN tunnels, one on each interface, of gw-name-1 in network-1. In the following commands, replace the options as noted below:

      • Replace tunnel-name-gw1-if0 and tunnel-name-gw1-if1 with a name for each tunnel originating from gw-name-1. Naming the tunnels by including the gateway interface name can help identify the tunnels later.
      • Use gw-name-2 for the value of --peer-gcp-gateway.
      • Replace region with the region where gw-name-1 is located.
      • (Optional) The --vpn-gateway-region is the region of the HA VPN gateway to operate on. Its value should be the same as --region. If not specified, this option is automatically set. This option overrides the default compute/region property value for this command invocation.
      • Replace ike-vers with 2 for IKEv2. Since both tunnels connect to another HA VPN gateway, using IKEv2 is recommended.
      • Replace shared-secret with your shared secret, which must be the same shared secret that you use for the corresponding tunnel created from gw-name-2 on interface 0 and on interface 1. See Generating a strong pre-shared key for recommendations.
      • Replace int-num-0 with the number 0 for the first interface on gw-name-1.
      • Replace int-num-1 with the number 1 for the second interface on gw-name-1.
      • If the peer-gcp-gateway is in a different project than the VPN tunnel and local VPN gateway, to specify the project, use the --peer-gcp-gateway option as a full URI or as a relative name. The following sample option is a relative name: --peer-gcp-gateway projects/other-project/regions/us-central1/vpnGateways/ha-vpn-gw-b.
      • The --peer-gcp-gateway-region, which is the region of the peer-side HA VPN gateway to which the VPN tunnel is connected, must be in the same region as the VPN tunnel. If not specified, the region is automatically set.

      Create the first tunnel on gw-name-1 int-num-0

        gcloud compute vpn-tunnels create tunnel-name-gw1-if0\
          --peer-gcp-gateway gw-name-2 \
          --region region-1 \
          --ike-version ike-vers \
          --shared-secret shared-secret \
          --router router-name-1 \
          --vpn-gateway gw-name-1 \
          --interface int-num-0
      

      Create the second tunnel on gw-name-1 int-num-1

        gcloud compute vpn-tunnels create tunnel-name-gw1-if1 \
          --peer-gcp-gateway gw-name-2 \
          --region region-1 \
          --ike-version ike-vers \
          --shared-secret shared-secret \
          --router router-name-1 \
          --vpn-gateway gw-name-1 \
          --interface int-num-1
      

      The command output should look similar to the following example:
        Created [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnTunnels/tunnel-a-to-b-if-0].
        NAME               REGION       VPN_GATEWAY     INTERFACE  PEER_GCP_GATEWAY
        tunnel-a-to-b-if-0 us-central1  ha-vpn-gw-a     0          ha-vpn-gw-b
        Created [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnTunnels/tunnel-a-to-b-if-1].
        NAME               REGION       VPN_GATEWAY     INTERFACE  PEER_GCP_GATEWAY
        tunnel-a-to-b-if-1 us-central1  ha-vpn-gw-a     1          ha-vpn-gw-b
      

    Create two tunnels on gw-name-2

    1. Create two VPN tunnels, one on each interface, of gw-name-2 in network-2.
      • The tunnel you create from interface 0 of gw-name-2 must connect to the public IP address associated with interface 0 of gw-name-1 in network-1, and
      • The tunnel from interface 1 of gw-name-2 must connect to the public IP address associated with interface 1 of gw-name-1.
      • Replace region with the region where gw-name-2 is located.
      • (Optional) The --vpn-gateway-region is the region of the VPN gateway to operate on. Its value should be the same as --region. If not specified, this option is automatically set. This option overrides the default compute/region property value for this command invocation.

        In the following commands, replace the options as noted below:
      • Replace tunnel-name-gw2-if0 and tunnel-name-gw2-if1 with a name for each tunnel originating from gw-name-2. Naming the tunnels by including the gateway interface name can help identify the tunnels later.
      • Use gw-name-1 for the value of --peer-gcp-gateway.
      • The value for the --peer-gcp-gateway-region must be in the same region as the VPN tunnel. If not specified, the value is set automatically. For this example, the region is region-1.
      • Replace ike-vers with 2 for IKEv2. Because these tunnels connect to the two tunnels created in the previous step, they must use the same IKE version (IKEv2 is recommended).
      • Replace shared-secret with your shared secret, which must correspond with the shared secret for the partner tunnel you created on each interface of gw-name-1. See Generating a strong pre-shared key for recommendations.
      • Replace gw-name-2 with the name of the second gateway you configured in the Gateway configuration step.
      • Replace int-num-0 with the number 0 for the first interface on gw-name-2.
      • Replace int-num-1 with the number 1 for the second interface on gw-name-2.
      • If the peer-gcp-gateway is in a different project than the VPN tunnel and local VPN gateway, to specify the project, use the --peer-gcp-gateway option as a full URI or as a relative name. The following sample option is a relative name: --peer-gcp-gateway projects/other-project/regions/us-central1/vpnGateways/ha-vpn-gw-b.
      • The --peer-gcp-gateway-region, which is the region of the peer-side HA VPN gateway to which the VPN tunnel is connected, must be in the same region as the VPN tunnel. If not specified, the region is automatically set.

    Create the first tunnel on gw-name-2 int-num-0

      gcloud compute vpn-tunnels create tunnel-name-gw2-if0 \
       --peer-gcp-gateway gw-name-1 \
       --region region-1 \
       --ike-version ike-vers \
       --shared-secret shared-secret \
       --router router-name-2 \
       --vpn-gateway gw-name-2 \
       --interface int-num-0
    

    Create the second tunnel on gw-name-2 int-num-1

      gcloud compute vpn-tunnels create tunnel-name-gw2-if1 \
        --peer-gcp-gateway gw-name-1 \
        --region region-1 \
        --ike-version ike-vers \
        --shared-secret shared-secret \
        --router router-name-2 \
        --vpn-gateway gw-name-2 \
        --interface int-num-1
    

    The command output should look similar to the following example:
      Created [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnTunnels/tunnel-b-to-a-if-0].
      NAME                REGION       VPN_GATEWAY     INTERFACE  PEER_GCP_GATEWAY
      tunnel-b-to-a-if-0  us-central1  ha-vpn-gw-b     0          ha-vpn-gw-a
      Created [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnTunnels/tunnel-b-to-a-if-1].
      NAME                REGION       VPN_GATEWAY     INTERFACE  PEER_GCP_GATEWAY
      tunnel-b-to-a-if-1  us-central1  ha-vpn-gw-b     1          ha-vpn-gw-a
    

    After this step, wait a few minutes, then check the status of each VPN tunnel.

    A VPN tunnel's state changes to Established only when the corresponding partner tunnel is also available and properly configured. A valid IKE and Child Security Association (SA) must also be negotiated between them.

    For example, tunnel-a-to-b-if-0 on ha-vpn-gw-a can only be established if tunnel-b-to-a-if-0 on ha-vpn-gw-b is configured and available.

Create Cloud Router interfaces and BGP peers

Setting the advertised route priority (optional)

The following examples create BGP sessions on instances of Cloud Router advertising the routes to their respective peer networks using unmodified base priorities. Use this configuration for active/active configurations where the priorities of the two tunnels on both sides should match. Omitting --advertised-base-priority, as in this example, results in the same advertised priorities to both BGP peers.

For active/passive configurations, you can control the advertised base priority of the "to Google Cloud" routes that Cloud Router shares with your peer VPN gateway by using the --advertised-route-priority flag when adding or updating a BGP peer.

To create an active/passive configuration, you set a higher advertised route priority for one BGP session, corresponding to one VPN tunnel, than the priority of the BGP session for the other VPN tunnel.

For more information about advertised base priority, see Route metrics.

You can also refine the routes that are advertised using custom advertisements, by adding the --advertisement-mode=CUSTOM flag and specifying IP address ranges with --set-advertisement-ranges.

To create Cloud Router interfaces and BGP peers:

  1. Create a BGP interface and BGP peer on router-name-1 for the tunnel tunnel-name-gw1-if0. This BGP interface connects tunnel-name-gw1-if0 on interface 0 of gw-1 to interface 0 of gw-2 using two BGP IP addresses. In the following commands, replace the options as noted below:

    • Replace router-1-interface-name-0 with a name for the Cloud Router BGP interface. Using a name related to tunnel-name-gw1-if0 can be helpful.
    • Replace ip-address with a BGP IP address from the 169.254.0.0/16 block that's not already in use. This example uses 169.254.0.1.
    • Use a mask-length of 30.
    • Replace peer-name with a name describing the BGP peer. Using a name related to tunnel-name-gw1-if0 can be helpful.
    • Replace peer-ip-address with a BGP IP address from the 169.254.0.0/16 block that's not already in use. This example uses 169.254.0.2.
    • Replace the peer-asn with the ASN number used for all interfaces on the other Cloud Router, router-name-2. This example uses ASN number 65002.

      1. To create a BGP interface for tunnel-name-gw1-if0, enter the following command:

        gcloud compute routers add-interface router-name-1 \
           --interface-name router-1-interface-name-0 \
           --ip-address ip-address \
           --mask-length mask-length \
           --vpn-tunnel tunnel-name-gw1-if0 \
           --region region-1
        
      2. To create a BGP peer for tunnel-name-gw1-if0, enter the following command:

        gcloud compute routers add-bgp-peer router-name-1 \
           --peer-name peer-name \
           --interface router-1-interface-name-0 \
           --peer-ip-address peer-ip-address \
           --peer-asn peer-asn \
           --region region-1
        

        The command output should look similar to the following example:

         Updated [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-a].
        
  2. Create a BGP interface and BGP peer on router-name-1 for the tunnel tunnel-name-gw1-if1. This BGP interface connects tunnel-name-gw1-if1 on interface 1 of gw-1 to interface 1 of gw-2 using two BGP IP addresses. In the following commands, replace the options as noted below:

    • Replace router-1-interface-name-1 with a Cloud Router BGP interface name. Using a name related to tunnel-name-gw1-if1 can be helpful.
    • Replace ip-address with a BGP IP address from the 169.254.0.0/16 block that's not already in use. This example uses 169.254.1.1.
    • Use a mask-length of 30.
    • Replace peer-name with a name describing the BGP peer. Using a name related to tunnel-name-gw1-if1 can be helpful.
    • Replace peer-ip-address with a BGP IP address from the 169.254.0.0/16 block that's not already in use. This example uses 169.254.1.2.
    • Replace the peer-asn with the ASN number used for all interfaces on the other Cloud Router, router-name-2. This example uses ASN number 65002.

      1. To create a BGP interface for tunnel-name-gw1-if1, enter the following command:

        gcloud compute routers add-interface router-name-1 \
           --interface-name router-1-interface-name-1 \
           --ip-address ip-address \
           --mask-length mask-length \
           --vpn-tunnel tunnel-name-gw1-if1 \
           --region region-1
        
      2. To create a BGP peer for tunnel-name-gw1-if1, enter the following command:

        gcloud compute routers add-bgp-peer router-name-1  \
           --peer-name peer-name \
           --interface router1-interface-name-1 \
           --peer-ip-address peer-ip-address \
           --peer-asn peer-asn \
           --region region-1
        

        The command output should look similar to the following example:

         Updated [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-a ].
        
  3. Verify the settings for router-1 by entering the following command:

    gcloud compute routers describe router-1  \
        --region region-1
    

    The command output should look similar to the following example:

     bgp:
       advertisemode: DEFAULT
       asn: 65001
     bgpPeers:
     — interfaceName: if-tunnel-a-to-b-if-0
       ipAddress: 169.254.0.1
       name: bgp-peer-tunnel-a-to-b-if-0
       peerAsn: 65002
       peerIpAddress: 169.254.0.2
     bgpPeers:
     — interfaceName: if-tunnel-a-to-b-if-1
       ipAddress: 169.254.1.1
       name: bgp-peer-tunnel-a-to-b-if-1
       peerAsn: 65002
       peerIpAddress: 169.254.1.2
     creationTimestamp: '2015-10-19T14:31:52.639-07:00'
     id: '4047683710114914215'
     interfaces:
     — ipRange: 169.254.0.1/30
       linkedVpnTunnel:
     https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnTunnels/tunnel-a-to-b-if-0
       name: if-tunnel-a-to-b-if-0
     — ipRange: 169.254.1.1/30
       linkedVpnTunnel:
     https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnTunnels/tunnel-a-to-b-if-1
       name: if-tunnel-a-to-b-if-1
     kind: compute#router
     name: router-a
     network: https://www.googleapis.com/compute/v1/projects/project-id/global/networks/network-a
     region: https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1
     selfLink: https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-a
    
  4. Create a BGP interface and BGP peer on router-name-2 for the tunnel tunnel-name-gw2-if0. This BGP interface connects tunnel-name-gw2-if0 on interface 0 of gw-2 to interface 0 of gw-1 using two BGP IP addresses. In the following commands, replace the options as noted below:

    • Replace router-2-interface-name-0 with a Cloud Router BGP interface name. Using a name related to tunnel-name-gw2-if0 can be helpful.
    • Replace ip-address with the BGP IP address used previously for this gateway and interface. This example uses 169.254.0.2.
    • Use a mask-length of 30.
    • Replace peer-name with a name describing the BGP peer. Using a name related to tunnel-name-gw2-if0 can be helpful.
    • Replace peer-ip-address with the IP address used previously for the peer gateway and interface. This example uses 169.254.0.1.
    • Replace the peer-asn with the ASN number used for all interfaces on router-name-1 and that was set previously. This example uses ASN number 65001.
    1. To create a BGP interface for tunnel-name-gw2-if0, enter the following command.

      gcloud compute routers add-interface router-name-2 \
         --interface-name router-2-interface-name-0 \
         --ip-address ip-address \
         --mask-length mask-length \
         --vpn-tunnel tunnel-name-gw2-if0 \
         --region region-1
      

      The command output should look similar to the following example:

    2. To create a BGP peer for tunnel-name-gw2-if0, enter the following command:

       gcloud compute routers add-bgp-peer router-name-2 \
         --peer-name peer-name \
         --interface router-2-interface-name-0 \
         --peer-ip-address peer-ip-address \
         --peer-asn peer-asn \
         --region region-1
      

      The command output should look similar to the following example:

       Updated [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-b ].
      
  5. Create a BGP interface and BGP peer on router-name-2 for the tunnel tunnel-name-gw2-if1. This BGP interface connects tunnel-name-gw2-if1 on interface 1 of gw-2 to interface 1 of gw-1 using two BGP IP addresses. In the following commands, replace the options as noted below:

    • Replace router-2-interface-name-1 with a Cloud Router BGP interface name. Using a name related to tunnel-name-gw2-if1 can be helpful.
    • Replace ip-address with the BGP IP address used previously for this gateway and interface. This example uses 169.254.1.2.
    • Use a mask-length of 30.
    • Replace peer-name with a name describing the BGP peer. Using a name related to tunnel-name-gw2-if1 can be helpful.
    • Replace peer-ip-address with a BGP IP address from the 169.254.0.0/16 block that's not already in use. This example uses 169.254.1.1.
    • Replace the peer-asn with the ASN number used for all interfaces on router-name-1 and that was set previously. This example uses ASN number 65001.
    1. To create a BGP interface for tunnel-name-gw2-if1, enter the following command:

      gcloud compute routers add-interface router-name-2 \
         --interface-name router-2-interface-name-1 \
         --ip-address ip-address \
         --mask-length mask-length \
         --vpn-tunnel tunnel-name-gw2-if1 \
         --region region-1
      

      The command output should look similar to the following example:

      Updated [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-b ].
      
    2. To create a BGP peer for tunnel-name-gw2-if1, enter the following command:

      gcloud compute routers add-bgp-peer router-name-2  \
         --peer-name peer-name \
         --interface router-2-interface-name-1 \
         --peer-ip-address peer-ip-address \
         --peer-asn peer-asn \
         --region region-1
      

      The command output should look similar to the following example:

       Updated [https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-b ].
      
  6. Verify the settings for router-2 by entering the following command:

    gcloud compute routers describe router-2  \
       --region region-1
    

    The command output should look similar to the following example:

     bgp:
       advertiseMode: DEFAULT
       asn: 65002
     bgpPeers:
     — interfaceName: if-tunnel-b-to-a-if-0
       ipAddress: 169.254.0.2
       name: bgp-peer-tunnel-b-to-a-if-0
       peerAsn: 65001
       peerIpAddress: 169.254.0.1
     bgpPeers:
     — interfaceName: if-tunnel-b-to-a-if-1
       ipAddress: 169.254.1.2
       name: bgp-peer-tunnel-b-to-a-if-1
       peerAsn: 65001
       peerIpAddress: 169.254.1.1
     creationTimestamp: '2015-10-19T14:31:52.639-07:00'
     id: '4047683710114914215'
     interfaces:
     — ipRange: 169.254.0.1/30
       linkedVpnTunnel:
     https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnTunnels/tunnel-b-to-a-if-0
       name: if-tunnel-b-to-a-if-0
       — ipRange: 169.254.1.1/30
       linkedVpnTunnel:
     https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/vpnTunnels/tunnel-b-to-a-if-1
       name: if-tunnel-b-to-a-if-1
     kind: compute#router
     name: router-b
     network: https://www.googleapis.com/compute/v1/projects/project-id/global/networks/network-b
     region: https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1
     selfLink: https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/routers/router-b
    

Continue on to complete the configuration

API

STEP ONE: To create an HA VPN gateway, make a POST request to the vpnGateways.insert method. Repeat this command to create the other HA VPN gateway, using a name, network, and region for the other gateway,

 POST https://www.googleapis.com/compute/v1/projects/project-id/regions/region/vpnGateways
 {
   "name": "ha-vpn-gw-a",
   "network": "https://www.googleapis.com/compute/v1/projects/project-id/global/networks/network-a"
 }

STEP TWO:

If you've already created a Cloud Router in each of the VPC networks where each of your HA VPN gateways resides, you can use those Cloud Routers instead of creating new ones. However, if a Cloud Router manages a BGP session for an interconnect attachment associated with a Partner Interconnect; you must create a new Cloud Router.

To create Cloud Router, make a POST request to the routers.insert method.

 POST https://www.googleapis.com/compute/v1/projects/project-id/regions/region/routers
 {
   "name": "router-a",
   "network": "https://www.googleapis.com/compute/v1/projects/project-id/global/networks/network-a"
 }

STEP THREE: To create two VPN tunnels, one for each interface on a HA VPN gateway, make a POST request to the vpnTunnels.insert method.

Enter the following command to create the first tunnel:

 POST https://www.googleapis.com/compute/v1/projects/project-id/regions/region/vpnTunnels
 {
   "name": "ha-vpn-gw-a-tunnel-0",
   "ikeVersion": 2,
   "peerIp": "192.0.2.1",
   "router": "https://www.googleapis.com/compute/v1/projects/project-id/regions/region/routers/router-a",
   "sharedSecret": "974;va'oi3-1",
   "vpnGateway": "https://www.googleapis.com/compute/v1/projects/project-id/regions/region/vpn-gateways/ha-vpn-gw-a",
   "vpnGatewayInterface": 0
 }

To create the second tunnel, repeat the preceding command, but change the following parameters:

  • name
  • peerIp
  • sharedSecret or sharedSecretHash(if needed)

For the second tunnel, change thevpnGatewayInterface parameter to the value of the other HA VPN gateway interface. In this example, you would change this value to 1.

Repeat this entire step to create two tunnels for your second HA VPN gateway that connect to your first HA VPNgateway, but change the parameters, using the gcloud command examples as a reference.

Setting the advertised route priority for BGP (optional)

The following examples create BGP sessions on instances of Cloud Router advertising the routes to their respective peer networks using unmodified base priorities. Use this configuration for active/active configurations where the priorities of the two tunnels on both sides should match. Omitting the parameter advertised-route-priority, as in this example, results in the same advertised priorities to both BGP peers.

For active/passive configurations, you can control the advertised base priority of the "to Google Cloud" routes that Cloud Router shares with your peer VPN gateway. To configure this priority, use the advertised-route-priority parameter when adding or updating a BGP peer.

To create an active/passive configuration, you set a higher advertised route priority for one BGP session, corresponding to one VPN tunnel, than the priority of the BGP session for the other VPN tunnel.

For more information about advertised base priority, see Route metrics.

You can also refine the routes that are advertised using custom advertisements, by adding the advertiseMode parameter and setting its value to custom, and by specifying IP address ranges with the advertisedIpRanges parameter.

STEP FOUR: To create a Cloud Router BGP interface, make either a PATCH or UPDATE request to the routers.patch method or the routers.update method. PATCH updates only the parameters you include. UPDATE updates all parameters for Cloud Router. Create a BGP interface for each VPN tunnel on the HA VPN gateway.

 PATCH https://www.googleapis.com/compute/v1/projects/project-id/regions/region/routers/{resourceId}
 {
   "interfaces": [
     {
       "name": "if-tunnel-a-to-on-prem-if-0",
       "linkedVpnTunnel": "ha-vpn-gw-a-tunnel-0",
       "ipRange": "169.254.0.1/30"
     }
   ]
 }

STEP FIVE: To add a BGP peer to Cloud Router for each VPN tunnel, make a POST request to the routers.insert method. Repeat this command for the other VPN tunnel, changing all options except nameand `peerAsn".

To create the full configuration for an HA VPN gateway, use the following API commands.

 POST https://www.googleapis.com/compute/v1/projects/project-id/regions/region/routers
 {
   "name": "router-a",
   "network": "network-a",
   "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "169.254.0.1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": "65002",
       "peerIpAddress": "169.254.0.2",
       "advertiseMode": "DEFAULT"
     }
   ]
  }
 

STEP SIX: Verify Cloud Router configuration with the routers.getRouterStatus method, using an empty request body:

 POST https://www.googleapis.com/compute/v1/projects/project-id/regions/region/routers

Completing the configuration

You must complete the following steps before you can use a new Cloud VPN gateway and its associated VPN tunnels:

  1. Set up the peer VPN gateway and configure the corresponding tunnel or tunnels there. Refer to these pages:
  2. Configure firewall rules in Google Cloud and your peer network as required. See the firewall rules page for suggestions.
  3. Check the status of your VPN tunnels and check the configuration of your HA VPN gateway for high availability.

What's next

Was this page helpful? Let us know how we did:

Send feedback about...