Cloud VPN overview  |  Google Cloud (2024)

This page describes concepts related to Cloud VPN. For definitions of termsused in the Cloud VPN documentation, see Keyterms.

Cloud VPN securely extends your peer network to your Virtual Private Cloud (VPC) network through anIPsecVPN connection. The VPNconnection encrypts traffic traveling between the networks, with one VPN gatewayhandling encryption and the other handling decryption. This process protectsyour data during transmission. You can also connect two VPCnetworks together by connecting two Cloud VPN instances. You cannot useCloud VPN to route traffic to the public internet; it is designed forsecure communication between private networks.

Choose a hybrid networking solution

To determine whether to use Cloud VPN, Dedicated Interconnect,Partner Interconnect, or Cloud Router as your hybrid networkingconnection to Google Cloud, see Choosing a Network Connectivityproduct.

To enhance the security of your Dedicated Interconnect orPartner Interconnect connection, use HA VPN over Cloud Interconnect.This solution establishes encrypted HA VPN tunnels over yourVLAN attachments.

Types of Cloud VPN

Google Cloud offers two types of Cloud VPN gateways:

• HA VPN
• Classic VPN

HA VPN

HA VPN is a high-availability (HA) Cloud VPN solution that lets yousecurely connect your on-premises network to your VPC network through anIPsec VPN connection. Based on the topology and configuration, HA VPN can provide an SLA of 99.99% or 99.9%service availability.

When you create an HA VPN gateway, Google Cloud automatically choosestwo external IPv4 addresses, one for each of its interfaces. Each IPv4 address isautomatically chosen from a unique address pool to support high availability. Each of theHA VPN gateway interfaces supports multiple tunnels. You can also createmultiple HA VPN gateways. When you delete the HA VPNgateway, Google Cloud releases the IP addresses for reuse. You can configure anHA VPN gateway with only one active interface and one external IP address;however, this configuration does not provide an availability SLA.

One option for using HA VPN is to use HA VPN over Cloud Interconnect. With HA VPN over Cloud Interconnect, you get the security of IPsec encryption from Cloud VPN alongside the increased capacity of Cloud Interconnect. In addition, because you are using Cloud Interconnect, your network traffic never traverses the public internet. If you use Partner Interconnect, you must add IPsec encryption to your Cloud Interconnect traffic to meet data security and compliance requirements when connecting to third-party providers. HA VPN uses an external VPN gateway resource in Google Cloud to provide information to Google Cloud about your peer VPN gateway or gateways.

In the API documentation and in gcloud commands, HA VPNgateways are referred to as VPN gateways rather than target VPN gateways.You don't need to create any forwarding rules for HA VPN gateways.

HA VPN can provide an availability SLA of 99.99% or 99.9%depending on the topologies or configuration scenarios. For more informationabout HA VPN topologies and supported SLAs, see HA VPN topologies.

While setting up HA VPN, consider the followingguidelines:

• When you connect an HA VPN gateway to anotherHA VPN gateway, the gateways must use identical IPstack types. For example, if you create an HA VPNgateway with the stack type of IPV4_IPV6, the otherHA VPN gateway must also be set to IPV4_IPV6.

• Configure two VPN tunnels from the perspective of the Cloud VPNgateway:

  • If you have two peer VPN gateway devices, each of the tunnels fromeach interface on the Cloud VPN gateway must be connected toits own peer gateway.
  • If you have a single peer VPN gateway device with two interfaces, eachof the tunnels from each interface on the Cloud VPN gateway must beconnected to its own interface on the peer gateway.
  • If you have a single peer VPN gateway device with a single interface,both of the tunnels from each interface on the Cloud VPN gatewaymust be connected to the same interface on the peer gateway.

• A peer VPN device must be configured with adequate redundancy. The devicevendor specifies the details of an adequately redundant configuration, whichmight include multiple hardware instances. For details, see the vendordocumentation for the peer VPN device.

  If two peer devices are required, each peer device must be connected to adifferent HA VPN gateway interface. If the peer sideis another cloud provider like AWS, VPN connections must be configured withadequate redundancy on the AWS side as well.

• Your peer VPN gateway device must support dynamic Border Gateway Protocol(BGP) routing.

  The following diagram shows the HA VPN concept,showing a topology that includes the two interfaces of anHA VPN gateway connected to two peer VPN gateways.For more detailed HA VPN topologies (configurationscenarios), see HA VPNtopologies.

Classic VPN

All Cloud VPN gateways created before the introduction ofHA VPN are considered Classic VPNgateways. For information about how to move from Classic VPN toHA VPN, seeMove from Classic VPN to HA VPN.

In contrast to HA VPN, Classic VPNgateways have a single interface, a single external IP address, and supporttunnels that use static routing (policy based or route based). You can alsoconfigure dynamic routing (BGP) for Classic VPN, but only fortunnels that connect to third-party VPN gateway software running onGoogle Cloud VM instances.

Classic VPN gateways provide an SLA of 99.9% serviceavailability.

Classic VPN gateways don't support IPv6.

For supported Classic VPN topologies, see the Classic VPN topologiespage.

Classic VPNs are referred to as target VPN gateways in the APIdocumentation and in the Google Cloud CLI.

Comparison table

The following table compares HA VPN features withClassic VPN features.

Specifications

Cloud VPN has the following specifications:

• Cloud VPN only supports site-to-site IPsec VPN connectivity,subject to the requirements listed in this section. It does not supportclient-to-gateway scenarios. In other words, Cloud VPN doesn'tsupport use cases where client computers need to "dial in" to a VPN by usingclient VPN software.

  Cloud VPN only supports IPsec. Other VPN technologies (such as SSLVPN) are not supported.

• Cloud VPN can be used with VPC networks and legacynetworks. For VPC networks, we recommendcustom mode VPC networks sothat you have full control over the ranges of IP addresses used by thesubnets in the network.

  • Classic VPN and HA VPN gatewaysuse external (internet routable) IPv4 addresses. Only ESP, UDP 500, andUDP4500 traffic is permitted to these addresses. This applies toCloud VPN addresses configured by you forClassic VPN or to automatically assigned IP addressesfor HA VPN.

  • If IP address ranges for on-premises subnets overlap with IP addressesused by subnets in your VPC network, to determine howrouting conflicts are resolved, see Order ofroutes.

• The following Cloud VPN traffic remains within Google's productionnetwork:

  • Between two HA VPN gateways
  • Between two Classic VPN gateways
  • Between a Classic VPN or HA VPNgateway and the external IP address of a Compute Engine VM acting as aVPN gateway

• Cloud VPN can be used with Private Google Access for on-premiseshosts. For more information, see Private access options forservices.

• Each Cloud VPN gateway must be connected to anotherCloud VPN gateway or a peer VPN gateway.

• The peer VPN gateway must have a static external (internet routable) IPv4address. You need this IP address to configure Cloud VPN.

  • If your peer VPN gateway is behind a firewall rule, you must configurethe firewall rule to pass ESP (IPsec) protocol and IKE (UDP 500 and UDP4500) traffic to it. If the firewall rule provides network addresstranslation (NAT), see UDP encapsulation and NAT-T.

• Cloud VPN requires that the peer VPN gateway be configured tosupport prefragmentation. Packets must be fragmented before beingencapsulated.

• Cloud VPN uses replay detection with a window of 4096 packets. Youcannot turn this off.

• Cloud VPN supports generic routing encapsulation (GRE)traffic. Support for GRE lets you terminate GRE traffic on a VM from theinternet (external IP address) and Cloud VPN orCloud Interconnect (internal IP address). The decapsulated trafficcan then be forwarded to a reachable destination. GRE lets you use servicessuch as Secure Access Service Edge (SASE) andSD-WAN. You must create a firewallrule to allow GRE traffic.

• HA VPN tunnels support the exchange of IPv6 traffic,but Classic VPN tunnels don't.

Network bandwidth

Each Cloud VPN tunnel supports up to 250,000 packets per second for thesum of ingress and egress traffic. Depending on average packet size in thetunnel, 250,000 packets per second is equivalent to between 1Gbps and3Gbps of bandwidth.

The metrics related to this limit are Sent bytes and Received bytes, whichare described in View logs andmetrics. Consider that theunit for the metrics is bytes, while the 3-Gbps limit refers to bits persecond. When converted to bytes, the limit is 375 megabytes per second (MBps).When measuring usage against the limit, use the sum of Sent bytes andReceived bytes compared to the converted limit of 375 MBps.

For information about how to create alerting policies, see Define alerts forVPN tunnelbandwidth.

Factors that affect bandwidth

Actual bandwidth depends on several factors:

• The network connection between the Cloud VPN gateway and your peergateway:

  • Network bandwidth between the two gateways: If you have establisheda Direct Peering relationshipwith Google, throughput is higher than if your VPN traffic is sent overthe public internet.

  • Round-trip time(RTT) and packetloss: Elevated RTT or packet loss rates greatly reduce TCPperformance.

• Capabilities of your peer VPN gateway: For more information, see yourdevice's documentation.

• Packet size: Cloud VPN uses theIPsec protocol in tunnel mode, encapsulating and encrypting entire IPpackets in Extensible Service Proxy (ESP), and then storing the ESP data ina second, outer IP packet. Consequently, there is both a gateway MTU forthe IPsec encapsulated packets and a payload MTU for packets before andafter IPsec encapsulation. For details, see MTU considerations.

• Packet rate: For ingress and egress, the recommended maximum packet ratefor each Cloud VPN tunnel is 250,000 packets per second (pps). Ifyou need to send packets at a higher rate, you must create more VPN tunnels.

When measuring TCP bandwidth of a VPN tunnel, you should measure more than onesimultaneous TCP stream. If you are using the iperftool, use the -P parameter to specify thenumber of simultaneous streams.

IPv6 support

Cloud VPN supports IPv6 in HA VPN, but not inClassic VPN.

To support IPv6 traffic in HA VPN tunnels, do thefollowing:

• Use the IPV6_ONLY (preview)or IPV4_IPV6 stack type when creating a HA VPNgateway and tunnels that connect IPv6-enabled VPC networkswith other IPv6-enabled networks. These networks can be on-premisesnetworks, multicloud networks, or other VPC networks.

• Include dual-stack subnets in yourIPv6-enabled VPC networks. In addition, make sure to assigninternal IPv6 ranges to the subnets.

  See Also

  What is Azure Virtual Network?

The following table summarizes the external IP addresses allowed for each stacktype of the HA VPN gateway.

Organization policy constraints for IPv6

You can disable the creation of all IPv6 hybrid resources in your project bysetting the following organizationpolicyto true:

• constraints/compute.disableHybridCloudIpv6

For HA VPN, this prevents the creation of any dual-stackHA VPN gateways and IPv6-only HA VPNgateways (Preview) in the project.

Stack types and BGP sessions

HA VPN gateways support different stack types. The stacktype of an HA VPN gateway determines what version of IPtraffic is allowed in your HA VPN tunnels.

When you create the HA VPN tunnels for a dual-stackHA VPN gateway, you can create either an IPv6 BGP sessionfor IPv6 route exchange, or an IPv4 BGP session that exchanges IPv6 routes byusing multiprotocol BGP(MP-BGP).

The following table summarizes the types of BGP sessions supported for eachstack type.

For more information about BGP sessions, see Establish BGPsessions in theCloud Router documentation.

Single-stack IPv4-only gateways

By default, an HA VPN gateway is assigned the IPv4-onlystack type and is automatically assigned two external IPv4 addresses.

An IPv4-only HA VPN gateway can support only IPv4 traffic.

Use the following procedures to create IPv4-only HA VPNgateways and IPv4 BGP sessions.

• For an HA VPN to peer VPN gateway configuration, seeCreate an HA VPNgateway and CreateBGP sessions - IPv4 BGPsessions.
• For an HA VPN to HA VPN gatewayconfiguration, see Create the HA VPN gateways and Create BGPsessions - IPv4 BGPsessions.

Dual-stack IPv4 and IPv6 gateways

An HA VPN gateway that is configured with the dual-stack(IPv4 and IPv6) stack type can support both IPv4 and IPv6 traffic.

For a dual-stack HA VPN gateway, you can configure yourCloud Router with an IPv4 BGP session, an IPv6 BGP session, or both. Ifyou configure only one BGP session, you can enable MP-BGP to allow that sessionto exchange both IPv4 and IPv6 routes. If you create an IPv4 BGP session and anIPv6 BGP session, you can't enable MP-BGP on either session.

To exchange IPv6 routes on an IPv4 BGP session using MP-BGP, you must configurethat session with IPv6 next hop addresses. Similarly, to exchange IPv4 routes onan IPv6 BGP session using MP-BGP, you must configure that session with IPv4 nexthop addresses. You can configure these next hop addresses either manually orautomatically.

If you manually configure the next hop addresses, you must select them from theGoogle-owned IPv6 Global Unicast Address (GUA) range2600:2d00:0:2::/63,or from the IPv4 link-local address range 169.254.0.0./16. These IPaddress ranges are pre-allocated by Google. The next hop IP addresses you selectmust be unique across all Cloud Routers within your VPCnetwork.

If you select automatic configuration, Google Cloud selects the next hopIP addresses for you.

Use the following procedures to create dual-stack HA VPNgateways and all supported BGP sessions.

• IPv4 BGP sessions, with or without MP-BGP
  • For an HA VPN gateway to peer VPN gatewayconfiguration, see Create an HA VPN gateway and Create BGPsessions - IPv4 BGPsessions.
  • For an HA VPN gateway toHA VPN gateway configuration, see Create theHA VPNgateways andCreate BGP sessions - IPv4 BGPsessions.
• IPv6 BGP sessions, with or without MP-BGP
  • For an HA VPN gateway to peer VPN gatewayconfiguration, see Create an HA VPN gateway and Create BGPsessions - IPv6 BGPsessions.
  • For an HA VPN gateway toHA VPN gateway configuration, see Create theHA VPNgateways andCreate BGP sessions - IPv6 BGPsessions.
• Both IPv4 and IPv6 BGP sessions
  • For an HA VPN gateway to peer VPN gatewayconfiguration, see Create an HA VPN gateway and Create BGPsessions - Both IPv4 BGP and IPv6 BGPsessions.
  • For an HA VPN gateway toHA VPN gateway configuration, see Create theHA VPNgateways andCreate BGP sessions - Both IPv4 and IPv6 BGPsessions.

Single-stack IPv6-only gateways

By default, an HA VPN gateway is assigned the IPv6-only (preview) stack type and isautomatically assigned two external IPv6 addresses.

An IPv6-only (preview)HA VPN gateway can support only IPv6 traffic.

Use the following procedures to create IPv6-only HA VPNgateways and IPv6 BGP sessions.

• For an HA VPN to peer VPN gateway configuration, seeCreate an HA VPNgateway and CreateBGP sessions - IPv6 BGPsessions.
• For an HA VPN to HA VPN gatewayconfiguration, see Create the HA VPN gateways and Create BGPsessions - IPv6 BGPsessions.

IPsec and IKE support

Cloud VPN supportsIKEv1 andIKEv2 by using an IKE pre-shared key (shared secret) and IKE ciphers.Cloud VPN only supports a pre-shared key for authentication. When youcreate the Cloud VPN tunnel, specify a pre-shared key. When you createthe tunnel at the peer gateway, specify this same pre-shared key.

Cloud VPN supports ESP in tunnelmode with authentication, but does not supportAH or ESP in transportmode .

You must use IKEv2 to enable IPv6 traffic in HA VPN.

Cloud VPN does not perform policy-related filtering on incomingauthentication packets. Outgoing packets are filtered based on the IP rangeconfigured on the Cloud VPN gateway.

For guidelines for creating a strong pre-shared key, see Generate a strongpre-shared key. For ciphers andconfiguration parameters supported by Cloud VPN, see Supported IKEciphers.

IKE and dead peer detection

Cloud VPN supports dead peer detection (DPD), per the DPDProtocol section of RFC3706.

To verify that the peer is alive, Cloud VPN might send DPD packets atany time, per RFC 3706. If the DPD requests aren't returned after severalretries, Cloud VPN recognizes that the VPN tunnel is unhealthy. Theunhealthy VPN tunnel in turn causes removal of the routes using this tunnel as anext-hop (BGP routes or static routes) triggering a failover of VM traffic toother VPN tunnels that are healthy.

The DPD interval isn't configurable in Cloud VPN.

UDP encapsulation and NAT-T

For information about how to configure your peer device to support NAT-Traversal(NAT-T) with Cloud VPN, see UDPencapsulation in the Advancedoverview.

Cloud VPN as a data transfer network

Before you use Cloud VPN, carefully review Section 2 of the GeneralService Terms for Google Cloud.

Using Network Connectivity Center,you can use HA VPN tunnels to connect on-premises networkstogether, passing traffic between them as a data transfer network. You connectthe networks by attaching a pair of tunnels to a Network Connectivity Centerspoke for each on-premises location. You then connect each spoke to aNetwork Connectivity Center hub.

For more information about Network Connectivity Center, see the Network Connectivity Centeroverview.

Bring your own IP (BYOIP) support

For information about using BYOIP addresses with Cloud VPN, see Support forBYOIP addresses.

Active-active and active-passive routing options for HA VPN

If a Cloud VPN tunnel goes down, it restarts automatically. If anentire virtual VPN device fails, Cloud VPN automatically instantiates anew one with the same configuration. The new gateway and tunnel connectautomatically.

VPN tunnels connected to HA VPN gateways must use dynamic(BGP) routing. Depending on the way that you configure route priorities forHA VPN tunnels, you can create an active-active oractive-passive routing configuration. For both of these routing configurations,both VPN tunnels remain active.

The following table compares the features of an active-active or active-passiverouting configuration.

Active-passive routing in full mesh topologies

If Cloud Router receives the same prefix with different MED valuesthrough a given Cloud VPN interface, it only imports the route with thehighest priority to the VPC network. The other inactive routesare not visible in the Google Cloud console or through the Google Cloud CLI. If theroute with the highest priority becomes unavailable, Cloud Routerwithdraws it and automatically imports the next best route to theVPC network.

Using multiple tunnels or gateways

Depending on the peer gateway configuration, it's possible to construct routessuch that some traffic traverses one tunnel and other traffic traverses anothertunnel due to route priorities (MED values). Similarly, you can adjust the basepriority that the Cloud Router uses to share your VPCnetwork routes. These situations demonstrate possible routing configurationsthat are neither purely active-active nor purely active-passive.

Recommended routing option

When using a single HA VPN gateway, we recommend using anactive-passive routing configuration. With this configuration, the observedbandwidth capacity at the time of normal tunnel operation matches the bandwidthcapacity observed during failover. This type of configuration is easier tomanage because the observed bandwidth limit stays constant, except for themultiple gateway scenario described previously.

When using multiple HA VPN gateways, we recommend using anactive-active routing configuration. With this configuration, the observedbandwidth capacity at the time of normal tunnel operation is twice that of themaximum bandwidth capacity. However, this configuration effectively underprovisions the tunnels and can cause dropped traffic in case of failover.

Restricting peer IP addresses through a Cloud VPN tunnel

If you're an Organization Policy Administrator(roles/orgpolicy.policyAdmin),you can create a policy constraint that restricts the IP addresses that userscan specify for peer VPN gateways.

The restriction applies to all Cloud VPN tunnels—bothClassic VPN and HA VPN—in a specificproject, folder, or organization.

For steps describing how to restrict IP addresses, see Restrict IP addressesfor peer VPN gateways.

Visualizing and monitoring Cloud VPN connections

Network Topology is a visualization tool that shows the topology ofyour VPC networks, hybrid connectivity to and from youron-premises networks, and the associated metrics. You can view yourCloud VPN gateways and VPN tunnels as entities in theNetwork Topology view.

A base entity is the lowest level of a particular hierarchy and represents aresource that can directly communicate with other resources over a network.Network Topology aggregates base entities into hierarchical entitiesthat you can expand or collapse. When you first view aNetwork Topology graph, it aggregates all the base entities intotheir top-level hierarchy.

For example, Network Topology aggregates VPN tunnels into their VPNgateway connection. You can view the hierarchy by expanding or collapsing theVPN gateway icons.

For more information, see the Network Topologyoverview.

Maintenance and availability

Cloud VPN undergoes periodic maintenance. During maintenance,Cloud VPN tunnels are taken offline, resulting in brief drops innetwork traffic. When maintenance completes, Cloud VPN tunnels areautomatically re-established.

Maintenance for Cloud VPN is a normal operational task that can happenat any time without prior notice. Maintenance periods are designed to be shortenough so that the Cloud VPN SLA is not impacted.

HA VPN is the recommended method of configuringhigh-availability VPNs. For configuration options, see the HA VPN topologies page.If you are using Classic VPN for redundancy and high-throughputoptions, see the Classic VPN topologiespage.

Best practices

To build your Cloud VPN effectively, use these best practices.

What's next

• To use high-availability and high-throughput scenarios or multiple subnetscenarios, see Advanced configurations.

• To help you solve common issues that you might encounter when usingCloud VPN, seeTroubleshooting.

• Learn more about the recommended topologies for HA VPN.