DevOps Peach

GCP Basics · Load Balancing & Hybrid – Cloud Load Balancing, Cloud Armor, CDN, VPN and IAP · Lesson 4 of 5

Cloud VPN and Cloud Interconnect

HA VPN gives encrypted tunnels over the Internet with a 99.99% SLA; Dedicated and Partner Interconnect give private, high-bandwidth links; Cloud Router exchanges routes with BGP for all of them.

Practice interactively →

To connect an office or data center to a VPC you choose between tunnels over the Internet and private physical links.

flowchart TB
  ON["On-premises router<br/>192.168.0.0/16"] -- "2 IPsec tunnels" --> HA["HA VPN gateway<br/>2 interfaces"]
  HA --> CR["Cloud Router<br/>BGP ASN 64512"]
  CR --> VPC["VPC vpc-shop<br/>10.10.0.0/16"]
  ON -- "VLAN attachments" --> IC["Dedicated or Partner Interconnect"]
  IC --> CR
  %% step ON: The on-premises router has its own address space and a public IP for VPN.
  %% step HA: HA VPN has two interfaces with two public IPs; two tunnels give the 99.99% SLA.
  %% step CR: Cloud Router speaks BGP with the on-premises router, so routes update automatically when tunnels fail.
  %% step VPC: The VPC learns 192.168.0.0/16 and advertises its subnets to on-premises.
  %% step IC: For more bandwidth and private connectivity, VLAN attachments on Interconnect connect to the same Cloud Router.

Cloud VPN

HA VPN Classic VPN
SLA 99.99% with two tunnels to a redundant peer 99.9%
Routing Dynamic (BGP) via Cloud Router Static or dynamic (most features deprecated)
Use Default choice Legacy

Cloud Interconnect

Option Bandwidth When
Dedicated Interconnect 10 Gbps or 100 Gbps circuits (bundled) You can reach a Google colocation facility
Partner Interconnect 50 Mbps – 50 Gbps via a service provider No presence in a colocation facility
Cross-Cloud Interconnect 10 / 100 Gbps to AWS, Azure, Oracle, Alibaba Multicloud private links

Interconnect traffic is private but not encrypted by default; add MACsec or HA VPN over Interconnect if you need encryption. For a 99.99% SLA, Google recommends redundant connections in two metropolitan areas.

Choosing

Need Choose
Quick start, < a few Gbps, encryption HA VPN
High throughput, stable latency, lower egress cost Interconnect
Many sites and VPCs, transitive hub Network Connectivity Center with VPN/Interconnect spokes

Plan IP ranges with no overlap between on-premises and VPCs, and set the VPC dynamic routing mode to global if all regions should learn on-premises routes.

gcloud compute vpn-gateways create ha-vpn-gw --network=vpc-shop --region=asia-southeast1
gcloud compute external-vpn-gateways create onprem-gw --interfaces=0=203.0.113.10,1=203.0.113.11
Command Meaning
gcloud compute vpn-tunnels list Tunnels and status
gcloud compute routers get-status vpn-router --region=… BGP sessions and learned routes
gcloud compute interconnects attachments list VLAN attachments

Traps: one HA VPN tunnel alone does not get the 99.99% SLA; Interconnect is not encrypted by default; overlapping ranges cannot be routed.

Practice interactively →