A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from http://cloud.google.com/network-connectivity/docs/vpn/how-to/creating-static-vpns below:

Create a Classic VPN gateway using static routing

Skip to main content Create a Classic VPN gateway using static routing

Stay organized with collections Save and categorize content based on your preferences.

This page describes how to use static routing to create a Classic VPN gateway and one tunnel. This tunnel is either a policy-based or route-based tunnel.

With route-based VPN, you specify only the remote traffic selector. If you need to specify a local traffic selector, create a Cloud VPN tunnel that uses policy-based routing instead.

Classic VPN does not support IPv6.

Note: HA VPN does not support static routing. Caution: If you convert an auto mode VPC network to a custom mode VPC network, you might have to delete and re-create VPN tunnels that use policy-based routing if the tunnel relied on default values for local IP ranges. Changing the mode of a VPC network with active VPN tunnels can lead to outages. For more information, see considerations for auto mode VPC networks.

For more information about Cloud VPN, see the following resources:

Routing options

When you use the Google Cloud console to create a policy-based tunnel, Classic VPN performs the following tasks:

After you create a policy-based Classic VPN tunnel, the IP ranges you entered in the Remote network IP ranges field appear as Advertised IP ranges on the VPN tunnel details page.

When you use the Google Cloud console to create a route-based tunnel, Classic VPN performs the following tasks:

Important: Traffic selectors cannot be changed after a tunnel has been created. If traffic selectors need to be changed in the future, you must delete and re-create the tunnel.

When you use the Google Cloud CLI to create either a policy-based tunnel or a route-based tunnel, traffic selectors for the tunnel are defined in the same way. However, because the creation of custom static routes is done with separate commands, you have more control over those routes.

The number of CIDRs that you can specify in a traffic selector depends on the IKE version.

For important background information, see the following:

Before you begin

Set up the following items in Google Cloud to make it easier to configure Cloud VPN:

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Install the Google Cloud CLI.

  5. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  6. To initialize the gcloud CLI, run the following command:

    gcloud init

  1. If you are using the Google Cloud CLI, set your project ID with the following command. The gcloud instructions on this page assume that you have set your project ID before issuing commands.

        gcloud config set project PROJECT_ID

  1. You can also view a project ID that has already been set by running the following command:

        gcloud config list --format='text(core.project)'
Permissions required for this task

To perform this task, you must have been granted the following permissions or the following IAM roles.

Permissions

Roles

Important: Creating a Classic VPN gateway requires external forwarding rules that you create in the Google Cloud CLI or in the Google Cloud console. Make sure that an Identity and Access Management (IAM) condition doesn't allow principals to create internal forwarding rules only. If such a condition exists, Classic VPN gateway creation fails with a permissions error. For more information, see IAM Conditions for forwarding rules. Create a custom VPC network and subnet

Before creating a Classic VPN gateway and tunnel, create a Virtual Private Cloud (VPC) network and at least one subnet in the Google Cloud region where the Classic VPN gateway is located.

Create a gateway and tunnel Console

Configure the gateway

  1. In the Google Cloud console, go to the VPN page.

    Go to VPN

  2. If you are creating a gateway for the first time, click Create VPN connection.

  3. Select the VPN setup wizard.

  4. Select the Classic VPN option button.

  5. Click Continue.

  6. On the Create a VPN connection page, specify the following gateway settings:

Configure tunnels

  1. For the new tunnel, in the Tunnels section, specify the following settings:

    For policy-based tunnels

    1. Under Routing options, select Policy-based.

    2. Under Remote network IP ranges, provide a space-separated list of the IP ranges used by the peer network. This is the remote traffic selector, or the right side from the perspective of Cloud VPN.

      After you create a policy-based Classic VPN tunnel, the IP ranges you entered in the Remote network IP ranges field appear as Advertised IP ranges on the VPN tunnel details page.

    3. Under Local IP ranges, select one of the following methods:

      • To choose an existing local IP range, use the Local subnetworks menu.
      • To enter a list of space-separated IP ranges used in your VPC network, use the Local IP ranges field. For important considerations, see Policy-based tunnels and traffic selectors.

    For route-based tunnels

    1. Under Routing options, select Route-based.
    2. Under Remote network IP ranges, provide a space-separated list of the IP ranges used by the peer network. These ranges are used to create custom static routes whose next hop is this VPN tunnel.

  2. If you need to create more tunnels on the same gateway, click Add tunnel and repeat the previous step. You can also add more tunnels later.

  3. Click Create.

Note: Google Cloud automatically creates one route for each remote IP range that you specify. The destination of the route is the remote IP range, its next hop is set to the Cloud VPN tunnel, and its priority is 1000. You cannot set the priority of this automatically created route, but you can delete and replace it. If you need greater control over the priority of VPN routes, follow the gcloud CLI steps instead. gcloud

To create a Cloud VPN gateway, complete the following command sequence. In the commands, replace the following:

Configure the gateway resources

  1. Create the target VPN gateway object:

    gcloud compute target-vpn-gateways create GW_NAME \
   --network=NETWORK \
   --region=REGION \
   --project=PROJECT_ID

  2. Reserve a regional external (static) IP address:

    gcloud compute addresses create GW_IP_NAME \
   --region=REGION \
   --project=PROJECT_ID

  3. Note the IP address (so you can use it when you configure your peer VPN gateway):

    gcloud compute addresses describe GW_IP_NAME \
   --region=REGION \
   --project=PROJECT_ID \
   --format='flattened(address)'

  4. Create three forwarding rules; these rules instruct Google Cloud to send ESP (IPsec), UDP 500, and UDP 4500 traffic to the gateway:

    gcloud compute forwarding-rules create fr-GW_NAME-esp \
   --load-balancing-scheme=EXTERNAL \
   --network-tier=PREMIUM \
   --ip-protocol=ESP \
   --address=GW_IP_NAME \
   --target-vpn-gateway=GW_NAME \
   --region=REGION \
   --project=PROJECT_ID

    gcloud compute forwarding-rules create fr-GW_NAME-udp500 \
   --load-balancing-scheme=EXTERNAL \
   --network-tier=PREMIUM \
   --ip-protocol=UDP \
   --ports=500 \
   --address=GW_IP_NAME \
   --target-vpn-gateway=GW_NAME \
   --region=REGION \
   --project=PROJECT_ID

    gcloud compute forwarding-rules create fr-GW_NAME-udp4500 \
   --load-balancing-scheme=EXTERNAL \
   --network-tier=PREMIUM \
   --ip-protocol=UDP \
   --ports=4500 \
   --address=GW_IP_NAME \
   --target-vpn-gateway=GW_NAME \
   --region=REGION \
   --project=PROJECT_ID

Create the Cloud VPN tunnel

  1. In the commands, replace the following:

    For policy-based VPN:

    To configure a policy-based VPN tunnel, run the following command:

    gcloud compute vpn-tunnels create TUNNEL_NAME \
    --peer-address=ON_PREM_IP \
    --ike-version=IKE_VERS \
    --shared-secret=SHARED_SECRET \
    --local-traffic-selector=LOCAL_IP_RANGES \
    --remote-traffic-selector=REMOTE_IP_RANGES \
    --target-vpn-gateway=GW_NAME \
    --region=REGION \
    --project=PROJECT_ID

    For route-based VPN, both the local and remote traffic selectors are 0.0.0.0/0 as defined in routing options and traffic selectors.

    To configure a route-based VPN tunnel, run the following command:

    gcloud compute vpn-tunnels create TUNNEL_NAME \
    --peer-address=ON_PREM_IP \
    --ike-version=IKE_VERS \
    --shared-secret=SHARED_SECRET \
    --local-traffic-selector=0.0.0.0/0 \
    --remote-traffic-selector=0.0.0.0/0 \
    --target-vpn-gateway=GW_NAME \
    --region=REGION \
    --project=PROJECT_ID

    You can also configure cipher algorithms for both policy-based and route-based tunnels. For example, to configure cipher algorithms for a policy-based tunnel, run the following command:

    gcloud beta compute vpn-tunnels create TUNNEL_NAME \
    --peer-address=ON_PREM_IP \
    --ike-version=IKE_VERS \
    --shared-secret=SHARED_SECRET \
    --local-traffic-selector=LOCAL_IP_RANGES \
    --remote-traffic-selector=REMOTE_IP_RANGES \
    --target-vpn-gateway=GW_NAME \
    --region=REGION \
    --project=PROJECT_ID \
    --phase1-encryption=PH1_ENCRYPT_ALGRTHS \
    --phase1-integrity=PH1_INTEGRITY_ALGRTHS \
    --phase1-prf=PH1_PRF_ALGRTHS \
    --phase1-dh=PH1_DH_GROUP \
    --phase2-encryption=PH2_ENCRYPT_ALGRTHS \
    --phase2-integrity=PH2_INTEGRITY_ALGRTHS \
    --phase2-pfs=PH2_PFS_ALGRTHS

    To learn more about the cipher algorithms supported by Cloud VPN, see Supported IKE ciphers.

  2. Create a static route for each remote IP range that you specified in the --remote-traffic-selector option in the previous step. Repeat this command for each remote IP range. Replace ROUTE_NAME with a unique name for the route, and replace REMOTE_IP_RANGE with the appropriate remote IP range.

    gcloud compute routes create ROUTE_NAME \
    --destination-range=REMOTE_IP_RANGE \
    --next-hop-vpn-tunnel=TUNNEL_NAME \
    --network=NETWORK \
    --next-hop-vpn-tunnel-region=REGION \
    --project=PROJECT_ID
    Note: The gcloud command to create a route uses the default priority of 1000. If you need to create a higher priority route, use the --priority flag with a lower number when you create the route. You cannot change the priority of a route after the route has been created; however, you can delete and replace the custom static route without needing to re-create the VPN tunnel. For details about how routes work in your VPC network, see Routes overview and Order of routes.
Complete the configuration

Before you can use a new Cloud VPN gateway and its associated VPN tunnel, complete the following steps:

  1. Set up the peer VPN gateway and configure the corresponding tunnel there. For instructions, see the following:
  2. Configure firewall rules in Google Cloud and your peer network as required.
  3. Check the status of your VPN tunnel and forwarding rules.

  4. View your VPN routes by going to the project routing table and filtering for Next hop type:VPN tunnel:

    Go to Routes

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-08-07 UTC.

[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[],[]]

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4