Cloud VPN for hybrid connectivity in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a Cloud VPN gateway in GCP.

GCP

resource "google_compute_ha_vpn_gateway" "vpn_gateway" {
  name    = "my-vpn-gateway"
  network = "[1]"
  region  = "us-central1"
}

Drag options to blanks, or click blank then click option'

Adefault

Bglobal

Cvpn-network

Dmy-network

Attempts:

3 left

💡 Hint

Common Mistakes

Using a region name instead of a network name.

Using 'global' which is not a network name.

Leaving the network field empty.

The network field specifies the VPC network to attach the VPN gateway to. It must be the name of an existing network, such as my-network.

2fill in blank

medium

Complete the code to define a VPN tunnel with the correct peer IP address.

GCP

resource "google_compute_vpn_tunnel" "vpn_tunnel" {
  name          = "my-vpn-tunnel"
  region        = "us-central1"
  vpn_gateway   = google_compute_ha_vpn_gateway.vpn_gateway.id
  peer_ip       = "[1]"
  shared_secret = "my-secret"
}

Drag options to blanks, or click blank then click option'

A10.0.0.1

Bvpn-peer-ip

C35.192.0.1

D192.168.1.1

Attempts:

3 left

💡 Hint

Common Mistakes

Using a private IP address instead of a public IP.

Using a placeholder string instead of an IP address.

Leaving the peer_ip field empty.

The peer_ip is the public IP address of the remote VPN gateway. It must be a valid external IP, such as 35.192.0.1.

3fill in blank

hard

Fix the error in the firewall rule to allow VPN traffic.

GCP

resource "google_compute_firewall" "vpn_firewall" {
  name    = "allow-vpn-traffic"
  network = "my-network"
  direction = "INGRESS"
  priority  = 1000
  [1] = [
    {
      protocol = "udp"
    },
    {
      protocol = "esp"
    },
    {
      protocol = "ah"
    }
  ]
  source_ranges = ["0.0.0.0/0"]
}

Drag options to blanks, or click blank then click option'

Aallowed

Ballow

Cprotocols

Dports

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allow' instead of 'allowed'.

Using 'protocols' which is not a valid attribute.

Using 'ports' when specifying protocols.

The correct field to specify allowed protocols and ports in a firewall rule is allowed. It expects a list of protocol names or port ranges.

4fill in blank

hard

Fill both blanks to configure the VPN tunnel with correct IKE version and routing options.

GCP

resource "google_compute_vpn_tunnel" "vpn_tunnel" {
  name          = "my-vpn-tunnel"
  region        = "us-central1"
  vpn_gateway   = google_compute_ha_vpn_gateway.vpn_gateway.id
  peer_ip       = "35.192.0.1"
  shared_secret = "my-secret"
  ike_version   = [1]
  routing_type  = [2]
}

Drag options to blanks, or click blank then click option'

A2

B1

C"BGP"

D"STATIC"

Attempts:

3 left

💡 Hint

Common Mistakes

Using IKE version 1 instead of 2.

Using routing type without quotes.

Mixing routing types.

The ike_version should be set to 2 for modern VPNs. The routing_type can be "STATIC" for static routing.

5fill in blank

hard

Fill all three blanks to create a VPN tunnel with correct fields for peer IP, shared secret, and local traffic selector.

GCP

resource "google_compute_vpn_tunnel" "vpn_tunnel" {
  name                   = "my-vpn-tunnel"
  region                 = "us-central1"
  vpn_gateway            = google_compute_ha_vpn_gateway.vpn_gateway.id
  peer_ip                = "[1]"
  shared_secret          = "[2]"
  local_traffic_selector = ["[3]"]
}

Drag options to blanks, or click blank then click option'

A35.192.0.1

Bmy-secret

C10.0.0.0/16

D192.168.1.0/24

Attempts:

3 left

💡 Hint

Common Mistakes

Using private IP for peer_ip.

Leaving shared_secret empty.

Using incorrect CIDR notation for local_traffic_selector.

The peer_ip is the remote VPN gateway's public IP. The shared_secret is the pre-shared key for authentication. The local_traffic_selector defines the IP ranges to route through the VPN, such as 10.0.0.0/16.

Practice

1. What is the primary purpose of Cloud VPN in a hybrid cloud setup?

easy

A. To securely connect your local network to your cloud network over the internet

B. To store data backups in the cloud

C. To monitor cloud resource usage

D. To create virtual machines in the cloud

Solution

1. Step 1: Understand Cloud VPN function

   Cloud VPN creates a secure connection between local and cloud networks over the internet.

2. Step 2: Identify the main use case

   It is used to link networks privately, not for storage, monitoring, or VM creation.

3. Final Answer:

   To securely connect your local network to your cloud network over the internet -> Option A

4. Quick Check:

   Cloud VPN = secure hybrid network link [OK]

Hint: Cloud VPN links networks securely over internet [OK]

Common Mistakes:

• Confusing VPN with storage or monitoring services
• Thinking VPN creates cloud resources
• Assuming VPN is for data backup only

2. Which of the following is the correct way to specify the shared secret in a Cloud VPN tunnel configuration?

easy

A. shared-secret: mySecret123

B. shared_secret = mySecret123

C. secretShared: 'mySecret123'

D. sharedSecret: "mySecret123"

Solution

1. Step 1: Review Cloud VPN tunnel config syntax

   The shared secret is specified as a key-value pair with key 'sharedSecret' and a string value.

2. Step 2: Match correct syntax

   sharedSecret: "mySecret123" uses correct key and quotes for the secret string, matching expected config format.

3. Final Answer:

   sharedSecret: "mySecret123" -> Option D

4. Quick Check:

   Correct key and quotes for shared secret [OK]

Hint: Use exact key 'sharedSecret' with quotes [OK]

Common Mistakes:

• Using underscores or hyphens incorrectly in key names
• Omitting quotes around the secret string
• Swapping key name order

3. Given this Cloud VPN tunnel configuration snippet:

localTrafficSelector: ["10.0.0.0/24"]
remoteTrafficSelector: ["192.168.1.0/24"]

What traffic will be routed through the VPN tunnel?

medium

A. Only traffic within 192.168.1.0/24 subnet

B. All traffic from 10.0.0.0/24 to any IP

C. Traffic from 10.0.0.0/24 to 192.168.1.0/24 and vice versa

D. Traffic from 192.168.1.0/24 to 10.0.0.0/24 only

Solution

1. Step 1: Understand traffic selectors

   LocalTrafficSelector defines local IP ranges; remoteTrafficSelector defines remote IP ranges for the tunnel.

2. Step 2: Determine routed traffic

   Traffic between these two IP ranges (10.0.0.0/24 and 192.168.1.0/24) is routed through the VPN tunnel.

3. Final Answer:

   Traffic from 10.0.0.0/24 to 192.168.1.0/24 and vice versa -> Option C

4. Quick Check:

   Traffic between local and remote selectors routed [OK]

Hint: Traffic between local and remote selectors goes through VPN [OK]

Common Mistakes:

• Assuming all local traffic routes through VPN
• Confusing direction of traffic routing
• Ignoring remote traffic selector

4. You configured a Cloud VPN tunnel but the connection fails. Which of these is a common misconfiguration to check?

medium

A. Mismatched shared secret between local and cloud VPN gateways

B. Incorrect VM instance size in cloud

C. Missing firewall rule allowing HTTP traffic

D. Using a public IP address for the local network

Solution

1. Step 1: Identify common VPN tunnel failure causes

   Mismatched shared secrets prevent tunnel establishment as authentication fails.

2. Step 2: Evaluate other options

   VM size and HTTP firewall rules do not affect VPN tunnel setup; local network uses private IPs, not public IPs.

3. Final Answer:

   Mismatched shared secret between local and cloud VPN gateways -> Option A

4. Quick Check:

   Shared secret mismatch breaks VPN tunnel [OK]

Hint: Check shared secret matches on both sides [OK]

Common Mistakes:

• Ignoring shared secret mismatch
• Checking unrelated VM or firewall settings
• Confusing public and private IP usage

5. You want to connect your on-premises network (10.10.0.0/16) to your GCP VPC network (10.20.0.0/16) using Cloud VPN. Which setup step is essential to avoid routing conflicts?

hard

A. Assign public IPs to all on-premises devices

B. Ensure on-premises and VPC IP ranges do not overlap

C. Disable firewall rules on both sides

D. Use the same IP range for both networks for simplicity

Solution

1. Step 1: Understand IP range requirements for VPN

   Overlapping IP ranges cause routing confusion and packet loss between networks.

2. Step 2: Identify best practice

   Assign distinct, non-overlapping IP ranges to on-premises and cloud networks to ensure clear routing.

3. Final Answer:

   Ensure on-premises and VPC IP ranges do not overlap -> Option B

4. Quick Check:

   Non-overlapping IP ranges prevent routing conflicts [OK]

Hint: Avoid overlapping IP ranges for VPN networks [OK]

Common Mistakes:

• Using overlapping IP ranges causing routing issues
• Disabling firewalls unnecessarily
• Assigning public IPs to private network devices