Google Cloud VPN

• Cloud VPN securely extends the peer network to the Virtual Private Cloud (VPC) network through an IPsec VPN connection.
• Traffic traveling between the two networks is encrypted by one VPN gateway and then decrypted by the other VPN gateway.
• Cloud VPN protects the data as it travels over the internet.
• Two instances of Cloud VPN can also be connected to each other.
• Cloud VPN cannot be used to route traffic to the public internet; it is designed for secure communication between private networks.

Cloud VPN Types

• Google Cloud offers two types of Cloud VPN gateways:
  • HA VPN – Recommended, high-availability with 99.99% SLA
  • Classic VPN – Legacy, 99.9% SLA, limited functionality

Cloud VPN Specifications

• Each Cloud VPN gateway is a regional resource.
• Only supports site-to-site IPsec VPN connectivity.
• Does not support client-to-gateway scenarios i.e., Cloud VPN doesn’t support use cases where client computers need to “dial in” to a VPN by using client VPN software.
• Only supports IPsec. Other VPN technologies (such as SSL VPN) are not supported.
• Can be used with Private Google Access for on-premises hosts.
• Each Cloud VPN gateway must be connected to another Cloud VPN gateway or a peer VPN gateway.
• Peer VPN gateway must have a static external (internet routable) IPv4 address, needed to configure Cloud VPN.
• Requires that the peer VPN gateway be configured to support prefragmentation. Packets must be fragmented before being encapsulated.
• Each Cloud VPN tunnel supports up to 250,000 packets per second (pps) for the sum of ingress and egress traffic, equivalent to between 1 Gbps and 3 Gbps of bandwidth depending on average packet size.
• Supports IKEv1 and IKEv2 by using an IKE pre-shared key (shared secret) and IKE ciphers. Only pre-shared key authentication is supported.
• Supports generic routing encapsulation (GRE) traffic (GA since May 2021), enabling services like SASE and SD-WAN.
• Uses replay detection with a window of 4096 packets (cannot be disabled).
• Cloud VPN uses ESP in tunnel mode with authentication; does not support AH or ESP in transport mode.
• Only ESP, UDP 500, and UDP 4500 traffic is permitted to Cloud VPN gateway addresses.

Cloud VPN Components

• Cloud VPN gateway
  • A virtual VPN gateway running in Google Cloud managed by Google, using a specified configuration in the project, and used only by you.
  • Each Cloud VPN gateway is a regional resource that uses one or more regional external IP addresses.
  • A Cloud VPN gateway can connect to a peer VPN gateway.
• Peer VPN gateway
  • A gateway that is connected to a Cloud VPN gateway.
  • A peer VPN gateway can be one of the following:
    • Another Cloud VPN gateway
    • A VPN gateway hosted by another cloud provider such as AWS or Microsoft Azure
    • An on-premises VPN device or VPN service
• External VPN gateway
  • A gateway resource configured for HA VPN that provides information to Google Cloud about the peer VPN gateway or gateways.
• Remote peer IP address
  • For an HA VPN gateway interface that connects to an external VPN gateway, the remote peer IP address is the IP address of the interface on the external VPN gateway that is used for the tunnel.
• VPN tunnel
  • A VPN tunnel connects two VPN gateways and serves as a virtual medium through which encrypted traffic is passed.
• Internet Key Exchange (IKE)
  • IKE is the protocol used for authentication and to negotiate a session key for encrypting traffic.

Classic VPN

• Classic VPN gateways have a single interface, a single external IP address, and support tunnels that use static routing (policy-based or route-based) only.
• Classic VPN provides an SLA of 99.9% service availability.
• Classic VPN gateways don’t support IPv6.
• Classic VPNs are referred to as target VPN gateways in the API documentation.

HA VPN (High Availability VPN)

• HA VPN is the recommended Cloud VPN solution that securely connects the on-premises network to the VPC network through an IPsec VPN connection.
• HA VPN provides an SLA of 99.99% service availability when configured with two interfaces and two external IP addresses.
• When you create an HA VPN gateway, Google Cloud automatically chooses two external IP addresses, one for each of its interfaces. Each IP address is automatically chosen from a unique address pool to support high availability.
• Each HA VPN gateway interface supports multiple tunnels. You can also create multiple HA VPN gateways.
• Peer VPN gateway device must support dynamic (BGP) routing.
• HA VPN supports only dynamic routing (BGP). Static routing is not supported with HA VPN.
• HA VPN can connect two VPC networks in different regions (inter-region support added June 2024).
• To achieve high availability when both VPN gateways are in VPC networks, two HA VPN gateways must be used, and both must be in the same region.
• If the VPC network uses global dynamic routing mode, routes shared through the gateways can be in any region.
• HA VPN supports connecting to Compute Engine VM instances with external IP addresses (GA Jan 2024).
• Known as the vpn-gateway resource in the API (vs. target-vpn-gateway for Classic).
• No forwarding rules required for HA VPN gateways; external IP addresses are created from a pool.

IPv6 Support in HA VPN

• HA VPN supports dual-stack (IPv4 and IPv6) and IPv6-only gateways (GA since June 2024).
• Classic VPN does not support IPv6.
• HA VPN gateway stack types:
  • IPV4_ONLY – Supports only IPv4 traffic (default). Gateway gets IPv4 external addresses.
  • IPV4_IPV6 (Dual-stack) – Supports both IPv4 and IPv6 traffic. Gateway gets both IPv4 and IPv6 external addresses.
  • IPV6_ONLY – Supports only IPv6 traffic. Gateway gets IPv6 external addresses.
• IKEv2 must be used to enable IPv6 traffic in HA VPN.
• Dual-stack HA VPN uses Multiprotocol BGP (MP-BGP) sessions in Cloud Router to exchange both IPv4 and IPv6 routes.
• Once created, the stack type of an HA VPN gateway cannot be modified; must delete and recreate.
• When connecting two HA VPN gateways, both must use identical IP stack types.

Customizable Cipher Options

• Cloud VPN supports customizable cipher options for VPN tunnels (GA since September 2025).
• Cipher selection allows configuring ciphers for IKE SA negotiation (phase 1) and IPsec SA negotiation (phase 2).
• Cipher selection is available only with IKEv2, not IKEv1.
• Once configured, cipher options cannot be modified; the tunnel must be deleted and recreated.
• If AEAD ciphers are specified for encryption, separate integrity ciphers cannot be specified.
• Note: DH algorithm group 22 has been deprecated. Google is rolling out changes to prefer more secure cipher algorithms first.

Active/Active vs Active/Passive Routing Options

• If a Cloud VPN tunnel goes down, it restarts automatically.
• If an entire virtual VPN device fails, Cloud VPN automatically instantiates a new one with the same configuration.
• The new gateway and tunnel connect automatically.
• Active/Active
  • Effective aggregate throughput is the combined throughput of both tunnels.
  • Peer gateway advertises the peer network’s routes with identical MED values for each tunnel.
  • Egress traffic sent to the peer network uses equal-cost multipath (ECMP) routing.
  • If one tunnel becomes unavailable, Cloud Router withdraws the learned custom dynamic routes whose next hops are the unavailable tunnel, which can take ~40 seconds.
• Active/Passive
  • Effective aggregate throughput is the individual throughput of each tunnel.
  • Peer gateway advertises the peer network’s routes with different MED values for each tunnel.
  • Egress traffic sent to the peer network uses the route with the highest priority, as long as the associated tunnel is available.
  • Peer gateway can only use the tunnel with the highest priority to send traffic to Google Cloud.
  • If one tunnel becomes unavailable, Cloud Router withdraws the learned custom dynamic routes whose next hops are the unavailable tunnel, which can take ~40 seconds.
• Google Cloud recommends:
  • Using Active/Passive configuration with a single HA VPN Gateway as the observed bandwidth capacity at the time of normal tunnel operation matches the bandwidth capacity observed during failover.
  • Using Active/Active configuration with multiple HA VPN Gateways as the observed bandwidth capacity at the time of normal tunnel operation is twice that of the guaranteed bandwidth capacity.

HA VPN over Cloud Interconnect

• HA VPN over Cloud Interconnect lets you encrypt the traffic that traverses Dedicated Interconnect or Partner Interconnect connections (GA since February 2023).
• Deploys HA VPN tunnels over VLAN attachments to provide IPsec encryption alongside the increased capacity of Cloud Interconnect.
• Network traffic never traverses the public internet since it uses Cloud Interconnect infrastructure.
• Particularly valuable for Partner Interconnect where traffic passes through third-party providers, requiring IPsec encryption for data security and compliance.
• Each HA VPN tunnel over Cloud Interconnect has a bandwidth of 3 Gbps.
• HA VPN gateways associated with VLAN attachments can be assigned regional internal IP addresses.

Network Connectivity Center (NCC) Integration

• Using Network Connectivity Center, HA VPN tunnels can connect on-premises networks together, passing traffic between them as a data transfer network.
• Connect networks by attaching a pair of tunnels to an NCC spoke for each on-premises location, then connect each spoke to an NCC hub.

Classic VPN vs HA VPN

Feature	HA VPN	Classic VPN
SLA	99.99% (most topologies)	99.9%
Routing	Dynamic (BGP) only	Static only (BGP deprecated Aug 2025)
External IPs	Auto-assigned from pool; no forwarding rules	Must create external IPs and forwarding rules
Interfaces	Two interfaces	Single interface
IPv6	Supported (dual-stack and IPv6-only)	Not supported
Two tunnels to same peer	Supported	Not supported
Connect to Compute Engine VMs	Supported (recommended)	Supported
API resource	vpn-gateway	target-vpn-gateway

Cloud VPN Monitoring

• Cloud VPN provides predefined monitoring dashboards in the Google Cloud console for quick insight into system health and tunnel performance (GA since December 2025).
• Displays key metrics for project-wide health and tunnel-specific diagnosis without manual configuration.
• Cloud VPN supports Dead Peer Detection (DPD) per RFC 3706 to verify peer is alive. DPD interval is not configurable.
• Network Topology visualization shows Cloud VPN gateways and VPN tunnels as entities.

GCP Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• GCP services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• GCP exam questions are not updated to keep up the pace with GCP updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

1. Your company’s infrastructure is on-premises, but all machines are running at maximum capacity. You want to burst to Google Cloud. The workloads on Google Cloud must be able to directly communicate to the workloads on-premises using a private IP range. What should you do?
   1. In Google Cloud, configure the VPC as a host for Shared VPC.
   2. In Google Cloud, configure the VPC for VPC Network Peering.
   3. Create bastion hosts both in your on-premises environment and on Google Cloud. Configure both as proxy servers using their public IP addresses.
   4. Set up Cloud VPN between the infrastructure on-premises and Google Cloud.
2. Your organization requires encryption for traffic between your on-premises data center and Google Cloud, and you already have a Dedicated Interconnect connection. Which solution should you implement?
   1. Create a Classic VPN tunnel over the Dedicated Interconnect.
   2. Deploy HA VPN over Cloud Interconnect to encrypt traffic on the VLAN attachments.
   3. Set up a separate VPN connection over the public internet.
   4. Use application-level TLS encryption only.
3. You need to connect your on-premises network to Google Cloud VPC with a 99.99% availability SLA. Your on-premises VPN device supports BGP. What Cloud VPN type should you use?
   1. Classic VPN with dynamic routing
   2. Classic VPN with static routing
   3. HA VPN
   4. Classic VPN with policy-based routing
4. Your company needs to support both IPv4 and IPv6 traffic over a VPN connection to Google Cloud. Which configuration should you choose?
   1. Classic VPN with IPv6 enabled
   2. HA VPN with dual-stack (IPV4_IPV6) stack type
   3. HA VPN with IPV4_ONLY stack type and MP-BGP
   4. Classic VPN with IKEv2
5. You are configuring HA VPN tunnels for high availability. The peer gateway advertises routes with different MED values for each tunnel. What routing configuration is this?
   1. Active/Active with ECMP
   2. Active/Passive
   3. Static routing with priority
   4. Policy-based routing
6. Which of the following statements about Classic VPN is TRUE as of August 2025? (Choose two)
   1. Classic VPN tunnels using static routing to on-premises gateways are still supported.
   2. Classic VPN supports dynamic routing (BGP) with full SLA.
   3. Classic VPN tunnels using BGP continue to function but without an availability SLA.
   4. Classic VPN supports IPv6 traffic.
   5. New Classic VPN tunnels with BGP can still be created.

Related Reads

• Google Cloud Data Transfer Services
• Google Cloud Hybrid Connectivity

References

• Cloud VPN Overview
• HA VPN Topologies
• Classic VPN Dynamic Routing Deprecation
• HA VPN over Cloud Interconnect
• Cloud VPN Release Notes