Cloud VPN for hybrid connectivity in GCP - Commands & Configuration

Introduction

Sometimes your office network and your cloud network need to talk securely. Cloud VPN creates a safe tunnel between your on-premises network and your cloud network so they can share data privately.

When you want your company office network to connect securely to your cloud resources.

When you have applications running both on your local servers and in the cloud that need to communicate.

When you want to extend your internal network to the cloud without exposing it to the internet.

When you need a backup connection between your data center and cloud in case the main link fails.

When you want to connect multiple cloud regions or different cloud providers securely.

Config File - vpn-tunnel.yaml

vpn-tunnel.yaml

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeVPNGateway
metadata:
  name: example-vpn-gateway
  namespace: default
spec:
  networkRef:
    name: example-vpc
  region: us-central1
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeVPNGatewayInterface
metadata:
  name: example-vpn-gateway-interface
  namespace: default
spec:
  vpnGatewayRef:
    name: example-vpn-gateway
  id: 0
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeVpnTunnel
metadata:
  name: example-vpn-tunnel
  namespace: default
spec:
  vpnGatewayRef:
    name: example-vpn-gateway
  peerIp: 203.0.113.1
  sharedSecret: "mysecretpassword"
  ikeVersion: 2
  region: us-central1
  targetVpnGatewayRef:
    name: example-vpn-gateway
  interface: 0
  localTrafficSelector:
    - 10.0.0.0/16
  remoteTrafficSelector:
    - 192.168.1.0/24

This file creates a VPN gateway in the cloud connected to your VPC network.

The VPN gateway interface defines the connection point.

The VPN tunnel sets up the secure tunnel to your on-premises VPN device using the peer IP and shared secret.

Traffic selectors define which IP ranges are allowed through the tunnel.

Commands

This command creates a VPN gateway in the cloud in the specified region and network. It acts as the endpoint for your VPN tunnel.

Terminal

gcloud compute vpn-gateways create example-vpn-gateway --network example-vpc --region us-central1

Expected Output

Created [https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/vpnGateways/example-vpn-gateway].

→

--network - Specifies the VPC network to attach the VPN gateway.

→

--region - Specifies the region where the VPN gateway is created.

This command creates the VPN tunnel connecting your cloud VPN gateway to your on-premises VPN device using the peer IP and shared secret for encryption.

Terminal

gcloud compute vpn-tunnels create example-vpn-tunnel --peer-address 203.0.113.1 --ike-version 2 --shared-secret mysecretpassword --target-vpn-gateway example-vpn-gateway --region us-central1 --local-traffic-selector 10.0.0.0/16 --remote-traffic-selector 192.168.1.0/24

Expected Output

Created [https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/vpnTunnels/example-vpn-tunnel].

→

--peer-address - The public IP address of your on-premises VPN device.

→

--shared-secret - The secret key used to encrypt the VPN tunnel.

→

--local-traffic-selector - The IP range in your cloud network allowed through the tunnel.

This command checks the status and details of the VPN tunnel to confirm it is up and running.

Terminal

gcloud compute vpn-tunnels describe example-vpn-tunnel --region us-central1

Expected Output

creationTimestamp: '2024-06-01T12:00:00.000-07:00'

ikeVersion: 2

localTrafficSelector:

- 10.0.0.0/16

name: example-vpn-tunnel

peerIp: 203.0.113.1

region: us-central1

remoteTrafficSelector:

- 192.168.1.0/24

sharedSecret: (hidden)

status: ESTABLISHED

targetVpnGateway: https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/vpnGateways/example-vpn-gateway

→

--region - Specifies the region of the VPN tunnel.

Key Concept

If you remember nothing else from this pattern, remember: Cloud VPN creates a secure, encrypted tunnel between your cloud network and your on-premises network so they can communicate privately.

Common Mistakes

Using incorrect peer IP address for the on-premises VPN device.

The VPN tunnel cannot establish if the peer IP is wrong or unreachable.

Verify the public IP address of your on-premises VPN device before creating the tunnel.

Mismatched shared secret between cloud VPN and on-premises device.

The tunnel will fail to establish because both sides must use the same secret key.

Ensure the shared secret is exactly the same on both VPN endpoints.

Not specifying correct traffic selectors for local and remote networks.

Traffic outside these ranges will not pass through the VPN tunnel, causing connectivity issues.

Set local and remote traffic selectors to the correct IP ranges that need to communicate.

Summary

Create a VPN gateway in your cloud network to act as the VPN endpoint.

Create a VPN tunnel connecting the cloud VPN gateway to your on-premises VPN device using peer IP and shared secret.

Verify the VPN tunnel status to ensure the secure connection is established.

Practice

1. What is the primary purpose of Cloud VPN in a hybrid cloud setup?

easy

A. To securely connect your local network to your cloud network over the internet

B. To store data backups in the cloud

C. To monitor cloud resource usage

D. To create virtual machines in the cloud

Solution

1. Step 1: Understand Cloud VPN function

   Cloud VPN creates a secure connection between local and cloud networks over the internet.

2. Step 2: Identify the main use case

   It is used to link networks privately, not for storage, monitoring, or VM creation.

3. Final Answer:

   To securely connect your local network to your cloud network over the internet -> Option A

4. Quick Check:

   Cloud VPN = secure hybrid network link [OK]

Hint: Cloud VPN links networks securely over internet [OK]

Common Mistakes:

• Confusing VPN with storage or monitoring services
• Thinking VPN creates cloud resources
• Assuming VPN is for data backup only

2. Which of the following is the correct way to specify the shared secret in a Cloud VPN tunnel configuration?

easy

A. shared-secret: mySecret123

B. shared_secret = mySecret123

C. secretShared: 'mySecret123'

D. sharedSecret: "mySecret123"

Solution

1. Step 1: Review Cloud VPN tunnel config syntax

   The shared secret is specified as a key-value pair with key 'sharedSecret' and a string value.

2. Step 2: Match correct syntax

   sharedSecret: "mySecret123" uses correct key and quotes for the secret string, matching expected config format.

3. Final Answer:

   sharedSecret: "mySecret123" -> Option D

4. Quick Check:

   Correct key and quotes for shared secret [OK]

Hint: Use exact key 'sharedSecret' with quotes [OK]

Common Mistakes:

• Using underscores or hyphens incorrectly in key names
• Omitting quotes around the secret string
• Swapping key name order

3. Given this Cloud VPN tunnel configuration snippet:

localTrafficSelector: ["10.0.0.0/24"]
remoteTrafficSelector: ["192.168.1.0/24"]

What traffic will be routed through the VPN tunnel?

medium

A. Only traffic within 192.168.1.0/24 subnet

B. All traffic from 10.0.0.0/24 to any IP

C. Traffic from 10.0.0.0/24 to 192.168.1.0/24 and vice versa

D. Traffic from 192.168.1.0/24 to 10.0.0.0/24 only

Solution

1. Step 1: Understand traffic selectors

   LocalTrafficSelector defines local IP ranges; remoteTrafficSelector defines remote IP ranges for the tunnel.

2. Step 2: Determine routed traffic

   Traffic between these two IP ranges (10.0.0.0/24 and 192.168.1.0/24) is routed through the VPN tunnel.

3. Final Answer:

   Traffic from 10.0.0.0/24 to 192.168.1.0/24 and vice versa -> Option C

4. Quick Check:

   Traffic between local and remote selectors routed [OK]

Hint: Traffic between local and remote selectors goes through VPN [OK]

Common Mistakes:

• Assuming all local traffic routes through VPN
• Confusing direction of traffic routing
• Ignoring remote traffic selector

4. You configured a Cloud VPN tunnel but the connection fails. Which of these is a common misconfiguration to check?

medium

A. Mismatched shared secret between local and cloud VPN gateways

B. Incorrect VM instance size in cloud

C. Missing firewall rule allowing HTTP traffic

D. Using a public IP address for the local network

Solution

1. Step 1: Identify common VPN tunnel failure causes

   Mismatched shared secrets prevent tunnel establishment as authentication fails.

2. Step 2: Evaluate other options

   VM size and HTTP firewall rules do not affect VPN tunnel setup; local network uses private IPs, not public IPs.

3. Final Answer:

   Mismatched shared secret between local and cloud VPN gateways -> Option A

4. Quick Check:

   Shared secret mismatch breaks VPN tunnel [OK]

Hint: Check shared secret matches on both sides [OK]

Common Mistakes:

• Ignoring shared secret mismatch
• Checking unrelated VM or firewall settings
• Confusing public and private IP usage

5. You want to connect your on-premises network (10.10.0.0/16) to your GCP VPC network (10.20.0.0/16) using Cloud VPN. Which setup step is essential to avoid routing conflicts?

hard

A. Assign public IPs to all on-premises devices

B. Ensure on-premises and VPC IP ranges do not overlap

C. Disable firewall rules on both sides

D. Use the same IP range for both networks for simplicity

Solution

1. Step 1: Understand IP range requirements for VPN

   Overlapping IP ranges cause routing confusion and packet loss between networks.

2. Step 2: Identify best practice

   Assign distinct, non-overlapping IP ranges to on-premises and cloud networks to ensure clear routing.

3. Final Answer:

   Ensure on-premises and VPC IP ranges do not overlap -> Option B

4. Quick Check:

   Non-overlapping IP ranges prevent routing conflicts [OK]

Hint: Avoid overlapping IP ranges for VPN networks [OK]

Common Mistakes:

• Using overlapping IP ranges causing routing issues
• Disabling firewalls unnecessarily
• Assigning public IPs to private network devices