Professional Cloud Network Engineer
Border Gateway Protocol (BGP) is the dynamic routing protocol that HA VPN uses to automatically exchange route information between VPC networks. A BGP session is a peering relationship established between a Cloud Router and a peer gateway, where each VPN tunnel requires its own BGP session to exchange routing information. You create these sessions by adding a BGP interface to the Cloud Router for each tunnel and then adding a BGP peer that specifies the Cloud Router's BGP IP address, the peer's IP address, and the peer's Autonomous System Number (ASN).
BGP determines the best path for traffic based on attributes like AS path length and local preference. To control path selection, you manipulate the advertisedRoutePriority (BGP local preference) on each BGP session. For active-standby configurations, you set a higher priority value (such as 100) on the primary session and a lower value (such as 90) on the standby session, making the primary path preferred. For active-active load sharing, you set the same priority on all sessions, allowing BGP to distribute traffic evenly across both tunnels. The Cloud Router installs learned routes into the VPC routing table as dynamic routes, which are then used to forward traffic through the appropriate VPN tunnel.
When connecting two Google Cloud VPCs via HA VPN, each Cloud Router advertises the IP prefixes of its local VPC subnets to its peer and learns the remote VPC's prefixes. The BGP peering IP addresses must be within the reserved link-local range (169.254.x.x/30) and must not conflict between the two sides. If one VPN tunnel or peer gateway becomes unavailable, BGP withdraws the route learned via that path, and traffic automatically fails over to the remaining healthy tunnel based on the next best available path in the routing table.
High-Availability Cloud VPN (HA VPN) provides encrypted IPsec connectivity between Google Cloud VPC networks with an availability service level agreement (SLA) of up to 99.99%. HA VPN uses the vpn-gateway API resource and requires dynamic routing with BGP, unlike Classic VPN which uses static routing. To connect two VPC networks directly, you deploy an HA VPN gateway in each VPC network and interconnect them across redundant VPN tunnels, ensuring that primary and secondary subnet IP address ranges do not overlap.
To achieve the 99.99% availability SLA, you need a specific topology with two Cloud VPN gateways and four distinct VPN tunnels. Both HA VPN gateways must reside in the same Google Cloud region, with each gateway automatically allocating two external IP addresses from distinct address pools (one for interface 0 and one for interface 1). You must configure two VPN tunnels per gateway, matching interface 0 to interface 0 and interface 1 to interface 1 on the peer gateway. Both gateways must share identical IP stack types, such as dual-stack IPV4_IPV6 or IPv4-only. Operating with only a single active tunnel invalidates the 99.99% SLA.
Cloud Router instances manage the BGP sessions for both tunnels in each VPC network. When a VPC network uses regional dynamic routing mode, Cloud Router advertises and learns routes only for subnets within its own region. When using global dynamic routing mode, Cloud Router advertises subnets across all regions and propagates learned routes to every subnet in the VPC. To maintain deterministic path selection, Cloud Router should advertise the same prefixes across both VPN links while applying base advertised route priorities to set primary and backup paths.
For cross-project connectivity, the peer project owner must grant the compute.vpnGateways.use IAM permission on the target HA VPN gateway before the connection can be established. Once permissions are granted and both gateways are deployed, BGP peering sessions establish dynamic routing over the encrypted tunnels, allowing private data to flow securely between distinct organizational perimeters.
HA VPN Gateway is Google's solution for creating highly available site-to-site IPsec VPN connections between Google Cloud VPC networks or between Google Cloud and on-premises networks. The service provides a 99.99% availability SLA when properly configured with two HA VPN gateways in the same region, each with two tunnels connecting corresponding interfaces. When gateways are in different regions, the SLA drops to 99.9%.
For GCP-to-GCP connectivity, you deploy an HA VPN gateway in each VPC network. The highest availability is achieved when both gateways are in the same region, even when the VPC networks span multiple regions, since VPC networks are global resources that can span regions regardless of gateway placement. You must configure Tunnel 0 to connect interface 0 on one gateway to interface 0 on the peer gateway, and Tunnel 1 to connect interface 1 to interface 1. This cross-interface pairing ensures that if one interface fails, the other interface's tunnel maintains connectivity.
Google provides two primary routing configurations: active-passive and active-active. With a single HA VPN gateway, active-passive routing is recommended because the bandwidth capacity remains constant during normal operation and failover. When using multiple HA VPN gateways, active-active routing provides double the maximum bandwidth capacity during normal operation, but this configuration can cause dropped traffic during failover events. A critical caution applies to active-passive configurations with more than two tunnels: HA VPN does not use the passive tunnels for failover until all active tunnels on all gateways have failed.
Monitoring HA VPN involves using Cloud Logging and Cloud Monitoring metrics to track tunnel status and BGP session health. Key metrics include tunnel status, number of connections per gateway, and packet counts for received and transmitted traffic. Cloud Logging captures detailed events related to tunnel state changes, IKE negotiations, and BGP session updates. Connectivity failures typically stem from mismatched IKE security parameters (encryption algorithms, authentication methods, or pre-shared keys) or BGP advertisement issues (incorrect ASN configuration, missing MD5 authentication matches, or interface IP address conflicts).
Connectivity Tests in Network Intelligence Center help diagnose failures by tracing packet paths through the network. The test performs seven key checks: verifying source VM can send egress packets, performing spoof checks on IP addresses, evaluating egress firewall rules, matching routes for the destination IP address, verifying ingress firewall rules allow the packet, running spoof checks on the destination VM, and confirming the destination VM can receive packets. Test results show whether packets were delivered or blocked at each checkpoint with specific failure reasons.
Regional mode makes Cloud Router advertise and learn routes only for subnets within its own region, while global mode advertises subnets across all VPC regions and propagates learned routes to every subnet in the VPC. Choose regional when you want traffic to stay within a specific region, and global when you want full VPC reachability across all regions.
Use active-passive with a single HA VPN gateway because the bandwidth capacity stays constant during failover. Use active-active with multiple HA VPN gateways because it provides double the maximum bandwidth during normal operation, though it can cause traffic drops during failover events.
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts