Create an HA VPN gateway to a peer VPN gateway

Console

The VPN setup wizard includes all required configuration steps for creating an HA VPN gateway, a peer VPN gateway resource, tunnels, and BGP sessions.

To create an HA VPN gateway, follow these steps:

1. In the Google Cloud console, go to the VPN page.

   Go to VPN

2. If you are creating a gateway for the first time, click Create VPN connection.

3. Select the VPN setup wizard.

4. For VPN gateway name, enter a name for the HA VPN gateway.

5. For VPC network, select an existing network or the default network.

6. For Region, select a region for your HA VPN gateway.

7. For VPN gateway IP version, select a HA VPN gateway IP version.

   The IP version of the HA VPN gateway and the peer VPN gateway must be the same.

8. For VPN gateway IP stack type, select a stack type for the VPN gateway.

9. Click Create and continue.

   The console page refreshes and displays your gateway information. Two external IP addresses are automatically allocated for each of your gateway interfaces. For future configuration steps, make note of the details of your gateway configuration.

gcloud

To create an HA VPN gateway, run the following commands. When the gateway is created, two external IP addresses are automatically allocated, one for each gateway interface.

• To support only IPv4 workloads, you can create an HA VPN gateway with the IPV4_ONLY stack type.
• To support both IPv4 and IPv6 workloads, you can create an HA VPN gateway with the IPV4_IPV6 stack type.
• To support only IPv6 workloads, you can create an HA VPN gateway with the IPV6_ONLY stack type.

To create an HA VPN gateway with IPv4 interfaces, run the following command. When the gateway is created, two external IPv4 addresses are automatically allocated, one for each gateway interface.

gcloud compute vpn-gateways create GW_NAME \
    --network=NETWORK \
    --region=REGION \
   [--stack-type=IP_STACK]

Replace the following:

• GW_NAME: the name of the gateway
• NETWORK: the name of your Google Cloud network
• REGION: the Google Cloud region where you create the gateway and tunnel
• IP_STACK: the IP stack to use. Specify either IPV4_ONLY or IPV4_IPV6. If you don't specify this flag, the stack type is IPV4_ONLY for the HA VPN gateway. The --stack-type flag is optional.

You can also specify --gateway-ip-version=IPV4. However, this flag isn't required. If you don't specify this flag, the HA VPN gateway defaults to using external IPv4 addresses.

To create an HA VPN gateway with IPv6 interfaces, run the following command. When the gateway is created, two external IPv6 addresses are automatically allocated, one for each gateway interface.

gcloud compute vpn-gateways create GW_NAME \
    --network=NETWORK \
    --region=REGION \
    --gateway-ip-version=IPV6 \
    --stack-type=IP_STACK

Replace the following:

• GW_NAME: the name of the gateway
• NETWORK: the name of your Google Cloud network
• REGION: the Google Cloud region where you create the gateway and tunnel
• IP_STACK: the IP stack to use. Specify either IPV4_IPV6 or IPV6_ONLY. If you don't specify this flag, the stack type is IPV4_IPV6 for the HA VPN gateway. The --stack-type flag is optional.

The gateway that you create looks similar to the following example output. If you specify --gateway-ip-version=IPV6, IPv6 interfaces are assigned.

Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnGateways/ha-vpn-gw-a].
NAME          INTERFACE0                 INTERFACE1                NETWORK     REGION
ha-vpn-gw-a   2600:1900:4f00:2:a:49b::   2600:1900:4f10:2:a:6a8::  network-a   us-central1

API

To create the full configuration for an HA VPN gateway, use the API commands in the following sections. All field values used in these sections are example values.

To create an HA VPN gateway, make a POST request by using the vpnGateways.insert method:

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnGateways
   {
     "name": "ha-vpn-gw-a",
     "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/network-a",
     "stackType": "IPV4_IPV6",
     "gatewayIpVersion": "IPV4"
   }

   POST https://compute.googleapis.com/compute/beta/projects/PROJECT_ID/regions/REGION/vpnGateways
   {
     "name": "ha-vpn-gw-a",
     "network": "https://www.googleapis.com/compute/beta/projects/PROJECT_ID/global/networks/network-a",
     "gatewayIpVersion": "IPV6",
     "stackType": "IPV6_ONLY"
   }

• When you create an HA VPN gateway with IPv4 interfaces, the gatewayIpVersion and stackType fields are optional.

  • If you don't specify stackType, the default value is IPV4_ONLY.

  • If you don't specify gatewayIpVersion, the default value is IPV4.

  • The only valid stackType values for a gateway with a gatewayIpVersion of IPV4 are IPV4_IPV6 or IPV4_ONLY.

• When you create an HA VPN gateway with IPv6 interfaces, specify IPV6 as the gatewayIpVersion value. The stackType field is optional.

  • If you don't specify stackType, the default value is IPV4_IPV6.

  • The only valid stackType values for a gateway with a gatewayIpVersion of IPV6 are IPV4_IPV6 or IPV6_ONLY.

Console

The peer VPN gateway resource represents your non-Google Cloud gateway in Google Cloud.

To create a peer VPN gateway resource, follow these steps:

1. On the Create a VPN page, under Peer VPN gateway, select On-prem or Non-Google Cloud.

2. Under Peer VPN gateway name, choose an existing peer gateway or click Create a new peer VPN gateway.

   If you choose an existing gateway, the Google Cloud console selects the number of tunnels to configure based on the number of peer interfaces that you configured on the existing peer gateway.

   To create a new peer gateway, complete the following steps:

   1. Specify a Name for the peer VPN gateway.
   2. Under Peer VPN gateway interfaces, select one, two, or four interfaces, depending on the type of interfaces your peer gateway has. For examples of each type, see the Topologies page.
   3. In the field for each peer VPN interface, specify the external IP address used for that interface. For more information, see Configure the peer VPN gateway.
   4. Click Create.

gcloud

Create an external VPN gateway resource that provides information to Google Cloud about your peer VPN gateway or gateways. Depending on the high availability recommendations for your peer VPN gateway, you can create external VPN gateway resources for the following different types of on-premises VPN gateways:

• Two separate peer VPN gateway devices where the two devices are redundant with each other, and each device has its own external IP address.
• A single peer VPN gateway that uses two separate interfaces, each with its own external IP address. For this kind of peer gateway, you can create a single external VPN gateway with two interfaces.
• A single peer VPN gateway with a single external IP address.

Option 1: Create an external VPN gateway resource for two separate peer VPN gateway devices

• For this type of peer gateway, each interface of the external VPN gateway has one external IP address, and each address is from one of the peer VPN gateway devices:

  gcloud compute external-vpn-gateways create PEER_GW_NAME \
     --interfaces 0=PEER_GW_IP_0,1=PEER_GW_IP_1
  

  Replace the following:

  • PEER_GW_NAME: a name representing the peer gateway
  • PEER_GW_IP_0: the external IP address for a peer gateway
  • PEER_GW_IP_1: the external IP address for another peer gateway

  The external VPN gateway resource that you created looks like the following example where PEER_GW_IP_0 and PEER_GW_IP_1 show the actual external IP addresses of the peer gateway interfaces:

  Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/externalVpnGateways/peer-gw].
  NAME      INTERFACE0    INTERFACE1
  peer-gw   PEER_GW_IP_0  PEER_GW_IP_1
  

Option 2: Create an external VPN gateway resource for a single peer VPN gateway with two separate interfaces

• For this type of peer gateway, create a single external VPN gateway with two interfaces:

  gcloud compute external-vpn-gateways create PEER_GW_NAME \
     --interfaces 0=PEER_GW_IP_0,1=PEER_GW_IP_1
  

  Replace the following:

  • PEER_GW_NAME: a name representing the peer gateway
  • PEER_GW_IP_0: the external IP address for one interface from the peer gateway
  • PEER_GW_IP_1: the external IP address for another interface from the peer gateway

  The external VPN gateway resource that you created looks like the following example where PEER_GW_IP_0 and PEER_GW_IP_1 show the actual external IP addresses of the peer gateway interfaces:

  Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/externalVpnGateways/peer-gw].
  NAME     INTERFACE0    INTERFACE1
  peer-gw  PEER_GW_IP_0  PEER_GW_IP_1
  

Option 3: Create an external VPN gateway resource for a single peer VPN gateway with a single external IP address

• For this type of peer gateway, create an external VPN gateway with one interface:

  gcloud compute external-vpn-gateways create PEER_GW_NAME \
     --interfaces 0=PEER_GW_IP_0
  

  Replace the following:

  • PEER_GW_NAME: a name representing the peer gateway
  • PEER_GW_IP_0: the external IP address for the interface from the peer gateway

  The external VPN gateway resource that you created looks like the following example where PEER_GW_IP_0 shows the actual external IP addresses of the peer gateway interface:

  Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/externalVpnGateways/peer-gw].
  NAME       INTERFACE0
  peer-gw    PEER_GW_IP_0
  

API

To create an external VPN gateway resource, make a POST request by using the externalVpnGateways.insert method.

• For an external (peer) VPN gateway that has one interface, use the following example, but specify only one interface ID and one ipAddress, with a redundancyType of SINGLE_IP_INTERNALLY_REDUNDANT.
• For an external VPN gateway with two interfaces, or two external VPN gateways with one interface each, use the TWO_IPS_REDUNDANCY example.

• For one or more external VPN gateways with four external VPN interfaces, for example, Amazon Web Services (AWS), use the following example, but specify four instances of the interface ID and ipAddress and use a redundancyType of FOUR_IPS_REDUNDANCY.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/externalVpnGateways
   {
     "name": "my-peer-gateway",
     "interfaces": [
       {
         "id": 0,
         "ipAddress": "192.0.2.1"
       },
       {
         "id": 1,
         "ipAddress": "192.0.2.2"
       }
     ],
     "redundancyType": "TWO_IPS_REDUNDANCY"
   }
  

Console

Under Cloud Router, if you haven't already, create a Cloud Router specifying the following options. You can use an existing Cloud Router as long as the Cloud Router is not being used for Cloud NAT.

1. To create a new Cloud Router, specify the following:

   • A Name
   • An optional Description
   • A Google ASN for the new router

   You can use any private ASN (64512 through 65534, 4200000000 through 4294967294) that you are not using elsewhere in your network. The Google ASN is used for all BGP sessions on the same Cloud Router, and you cannot change the ASN later.

2. To create the new router, click Create.

gcloud

You can use an existing Cloud Router as long as the Cloud Router is not being used for Cloud NAT. Otherwise, create another Cloud Router.

To create a Cloud Router, run the following command:

gcloud compute routers create ROUTER_NAME \
    --region=REGION \
    --network=NETWORK \
    --asn=GOOGLE_ASN

Replace the following:

• ROUTER_NAME: the name of the Cloud Router in the same region as the Cloud VPN gateway
• REGION: the Google Cloud region where you create the gateway and tunnel
• NETWORK: the name of your VPC network
• GOOGLE_ASN: any private ASN (64512 through 65534, 4200000000 through 4294967294) that you are not already using in the peer network; the Google ASN is used for all BGP sessions on the same Cloud Router, and it cannot be changed later

The router that you create looks similar to the following example output:

Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/routers/router-a].
NAME       REGION        NETWORK
router-a   us-central1   network-a

API

You can use an existing Cloud Router as long as the Cloud Router is not being used for Cloud NAT. Otherwise, create another Cloud Router.

To create a Cloud Router, make a POST request by using the routers.insert method:

 POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers
 {
   "name": "router-a",
   "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/network-a"
 }

Console

If you configured your peer VPN gateway resource with one interface, on the Create VPN page, configure your single tunnel in the single VPN tunnel dialog. For a 99.99% SLA, you must create a second tunnel.

If you configured your peer VPN gateway resource with two or four interfaces, configure the associated dialogs that appear at the bottom of the Create VPN page.

To create VPN tunnels, follow these steps:

1. If applicable, under Associated Cloud VPN gateway interface, select the HA VPN interface and IP address combination that you want to associate with your peer VPN gateway interface for this tunnel.
2. Under Associated peer VPN gateway interface, select the peer VPN gateway interface and IP address combination that you want to associate with this tunnel and with the HA VPN interface. This interface must match the interface on your actual peer router.
   1. Specify a Name for the tunnel.
   2. Specify an optional Description.
   3. Specify the IKE version. We recommend IKE v2, the default setting, if your peer router supports it. To allow IPv6 traffic, you must select IKEv2.
   4. Specify an IKE pre-shared key by using your pre-shared key (shared secret), which must correspond with the pre-shared key for the partner tunnel that you create on your peer gateway. If you haven't configured a pre-shared key on your peer VPN gateway and want to generate one, click Generate and copy. Make sure that you record the pre-shared key in a secure location because it cannot be retrieved after you create your VPN tunnels.
   5. Click Done.
   6. On the Create VPN page, repeat the tunnel creation steps for any remaining tunnel dialogs.
3. When you have configured all tunnels, click Create and continue.

gcloud

Create two VPN tunnels, one for each interface on the HA VPN gateway. When creating VPN tunnels, specify the peer side of the VPN tunnels as the external VPN gateway that you created earlier. Depending on the redundancy type of the external VPN gateway, configure the tunnels by using one of the following two options.

Option 1: If the external VPN gateway is two separate peer VPN gateway devices or a single device with two IP addresses

• In this case, one VPN tunnel needs to connect to interface 0 of the external VPN gateway, and the other VPN tunnel needs to connect to interface 1 of the external VPN gateway.

  gcloud compute vpn-tunnels create TUNNEL_NAME_IF0 \
     --peer-external-gateway=PEER_GW_NAME \
     --peer-external-gateway-interface=PEER_EXT_GW_IF0 \
     --region=REGION \
     --ike-version=IKE_VERS \
     --shared-secret=SHARED_SECRET \
     --router=ROUTER_NAME \
     --vpn-gateway=GW_NAME \
    [--vpn-gateway-region=VPN_GATEWAY_REGION] \
     --interface=INT_NUM_0
  

  gcloud compute vpn-tunnels create TUNNEL_NAME_IF1 \
     --peer-external-gateway=PEER_GW_NAME \
     --peer-external-gateway-interface=PEER_EXT_GW_IF1 \
     --region=REGION \
     --ike-version=IKE_VERS \
     --shared-secret=SHARED_SECRET \
     --router=ROUTER_NAME \
     --vpn-gateway=GW_NAME \
    [--vpn-gateway-region=VPN_GATEWAY_REGION] \
     --interface=INT_NUM_1
  

  Replace the following:

  • TUNNEL_NAME_IF0 and TUNNEL_NAME_IF1: a name for the tunnel; naming the tunnels by including the gateway interface name can help identify the tunnels later
  • PEER_GW_NAME: a name of the external peer gateway created earlier
  • PEER_EXT_GW_IF0 and PEER_EXT_GW_IF1: the interface number configured earlier on the external peer gateway
  • IKE_VERS: 1 for IKEv1 or 2 for IKEv2; if possible, use IKEv2 for the IKE version. If your peer gateway requires IKEv1, replace --ike-version 2 with --ike-version 1. To allow IPv6 traffic, you must specify IKEv2.
  • SHARED_SECRET: your pre-shared key (shared secret), which must correspond with the pre-shared key for the partner tunnel that you create on your peer gateway; for recommendations, see Generate a strong pre-shared key
  • GW_NAME: the name of the HA VPN gateway
  • INT_NUM_0: the number 0 for the first interface on the HA VPN gateway that you created earlier
  • INT_NUM_1: the number 1 for the second interface on the HA VPN gateway that you created earlier
  • VPN_GATEWAY_REGION: the region of the HA VPN gateway to operate on. Its value should be the same as --region. If not specified, this option is automatically set. This option overrides the default region property value for this command invocation. The --vpn-gateway-region flag is optional.

  The command output looks similar to the following example:

  Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-a-to-on-prem-if-0].
  NAME                       REGION        GATEWAY       VPN_INTERFACE   PEER_GATEWAY  PEER_INTERFACE
  tunnel-a-to-on-prem-if-0   us-central1   ha-vpn-gw-a   0               peer-gw       0
  
  Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-a-to-on-prem-if-1].
  NAME                       REGION        GATEWAY       VPN_INTERFACE   PEER_GATEWAY  PEER_INTERFACE
  tunnel-a-to-on-prem-if-1   us-central1   ha-vpn-gw-a   1               peer-gw       1
  

Option 2: If the external VPN gateway is a single peer VPN gateway with a single external IP address

• In this case, both VPN tunnels need to connect to interface 0 of the external VPN gateway.

  gcloud compute vpn-tunnels create TUNNEL_NAME_IF0 \
     --peer-external-gateway=PEER_GW_NAME \
     --peer-external-gateway-interface=PEER_EXT_GW_IF0 \
     --region=REGION \
     --ike-version=IKE_VERS \
     --shared-secret=SHARED_SECRET \
     --router=ROUTER_NAME \
     --vpn-gateway=GW_NAME \
    [--vpn-gateway-region=VPN_GATEWAY_REGION] \
     --interface=INT_NUM_0
  

  gcloud compute vpn-tunnels create TUNNEL_NAME_IF1 \
     --peer-external-gateway=PEER_GW_NAME \
     --peer-external-gateway-interface=PEER_EXT_GW_IF0 \
     --region=REGION \
     --ike-version=IKE_VERS \
     --shared-secret=SHARED_SECRET \
     --router=ROUTER_NAME \
     --vpn-gateway=GW_NAME \
    [--vpn-gateway-region=VPN_GATEWAY_REGION] \
     --interface=INT_NUM_1
  

  Replace the following:

  • TUNNEL_NAME_IF0 and TUNNEL_NAME_IF1: a name for the tunnel; naming the tunnels by including the gateway interface name can help identify the tunnels later
  • PEER_GW_NAME: the name of the external peer gateway created earlier
  • PEER_EXT_GW_IF0: the interface number configured earlier on the external peer gateway
  • IKE_VERS: 1 for IKEv1 or 2 for IKEv2. If possible, use IKEv2 for the IKE version. If your peer gateway requires IKEv1, replace --ike-version 2 with --ike-version 1. To allow IPv6 traffic, you must specify IKEv2.
  • SHARED_SECRET: your pre-shared key (shared secret), which must correspond with the pre-shared key for the partner tunnel that you create on your peer gateway; for recommendations, see Generate a strong pre-shared key
  • INT_NUM_0: the number 0 for the first interface on the HA VPN gateway that you created earlier
  • INT_NUM_1: the number 1 for the second interface on the HA VPN gateway that you created earlier
  • VPN_GATEWAY_REGION: the region of the HA VPN gateway to operate on. Its value should be the same as --region. If not specified, this option is automatically set. This option overrides the default region property value for this command invocation. The --vpn-gateway-region flag is optional.

  The command output looks similar to the following example:

  Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-a-to-on-prem-if-0].
  NAME                       REGION       GATEWAY        VPN_INTERFACE   PEER_GATEWAY   PEER_INTERFACE
  tunnel-a-to-on-prem-if-0   us-central1  ha-vpn-gw-a    0               peer-gw        0
  
  Created [https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-a-to-on-prem-if-1].
  NAME                       REGION       GATEWAY        VPN_INTERFACE   PEER_GATEWAY   PEER_INTERFACE
  tunnel-a-to-on-prem-if-1   us-central1  ha-vpn-gw-a    1               peer-gw        0
  

API

To create two VPN tunnels, one for each interface on the HA VPN gateway, make a POST request by using the vpnTunnels.insert method. To get a 99.99% uptime SLA, you must create a tunnel on each interface of your HA VPN gateway.

1. To create the first tunnel, run the following command:

      POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnTunnels
      {
        "name": "ha-vpn-gw-a-tunnel-0",
        "ikeVersion": 2,
        "peerExternalGateway": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/externalVpnGateways/my-peer-gateway",
        "peerExternalGatewayInterface": 0,
        "router": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/router-a",
        "sharedSecret": "SHARED_SECRET",
        "vpnGateway": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnGateways/ha-vpn-gw-a",
        "vpnGatewayInterface": 0
      }
   

   If you plan to enable IPv6 in the BGP session associated with this tunnel, you must specify 2 for the ikeVersion.

2. To create the second tunnel, repeat this command, but change the following parameters:

   • name
   • peerExternalGatewayInterface
   • sharedSecret or sharedSecretHash(if needed)
   • vpnGatewayInterface: change to the value of the other HA VPN gateway interface—in this example, change this value to 1

Console

To create BGP sessions, follow these steps:

1. Click Configure BGP session.
2. On the Create BGP session page, complete the following steps:
   1. For BGP session type, select IPv4 BGP session.
   2. For Name, enter a name for the BGP session.
   3. For Peer ASN, enter the peer ASN configured for the peer VPN gateway.
   4. Optional: For Advertised route priority (MED), enter the priority of routes advertised to this BGP peer.
   5. Optional: To enable IPv6 route exchange, click the Enable IPv6 traffic toggle.

3. For Allocate BGP IPv4 address, select Automatically or Manually. If you select Manually, do the following: 1. For Cloud Router BGP IPv4 address, enter the Cloud Router BGP IPv4 address. 1. For BGP peer IPv4 address, enter the IPv4 address of the BGP peer. The IPv4 address must meet the following requirements: * Each IPv4 address must belong to the same /30 subnet that fits within the 169.254.0.0/16 address range. * Each IPv4 address is the first or second host of the /30 subnet. The first and the last IP addresses of the subnet are reserved for network and broadcast addresses. * Each IPv4 address range for a BGP session must be unique among all Cloud Routers in all regions of a VPC network.

   If you select Automatically, Google Cloud automatically selects the IPv4 addresses for your BGP session.

   1. Optional: If you enabled IPv6 route exchange in the previous step, for Allocate BGP IPv6 next hop, select Automatically or Manually. If you select Manually, do the following:
      1. For Cloud Router BGP IPv6 next hop, enter an IPv6 address in the 2600:2d00:0:2::/63 address range. This IP address is the next hop address for IPv6 routes that are advertised by the Cloud Router.
      2. For Peer BGP IPv6 next hop, enter an IPv6 address in the 2600:2d00:0:2::/63 address range. This IP address is the next hop address for IPv6 routes learned by the Cloud Router from the BGP peer.
      3. Optional: Expand the Advanced options section.
      4. To enable BGP peer, select Enabled. If enabled, the peer connection is established with routing information. For more information, see Establish BGP sessions.
      5. To enable MD5 authentication, select Enabled. If enabled, MD5 authentication is used to authenticate BGP sessions For more information, see Use MD5 authentication. You can alternatively choose to enable MD5 authentication later.
      6. To add outbound routes to the BGP session, for Priority of all custom learned routes, enter a custom learned route priority. For more information, see Custom learned routes.

4. Click Save and continue.

5. Repeat the previous steps for the rest of the tunnels configured on the gateway. For each tunnel, use a different Cloud Router BGP IP address and BGP Peer IP address.

6. Click Save BGP configuration.

gcloud

To create BGP sessions, follow these steps:

In the commands, replace the following:

• ROUTER_INTERFACE_NAME_0 and ROUTER_INTERFACE_NAME_1: a name for the Cloud Router interface; it can be helpful to use names related to the tunnel names configured previously
• TUNNEL_NAME_0 and TUNNEL_NAME_1: the tunnel associated with the HA VPN gateway interface that you configured
• IP_VERSION: specify IPV4 or leave unspecified. If unspecified, the default is IPV4.
• IP_PREFIXES and CUSTOM_ROUTE_PRIORITY: values that let you manually specify learned routes for a BGP session; for more information about this feature, see Custom learned routes
• AUTHENTICATION_KEY: the secret key to use for MD5 authentication; for more information about this optional feature, see Use MD5 authentication.

Assign IPv4 addresses for a BGP session

Choose the automatic or manual configuration method of configuring addresses for BGP. These commands don't enable IPv6 for BGP.

If you want to enable IPv6, run the commands listed in Assign IPv6 next-hop addresses.

Assign IPv6 next-hop addresses

Use the commands in this section only if you want VPN tunnels that use MP-BGP and exchange both IPv4 and IPv6 traffic. If you don't want to route IPv6 traffic over this tunnel, or if you plan to add a single IPv6 BGP session to this tunnel later, then you can use the commands listed in Assign IPv4 BGP addresses.

API

To create BGP sessions, follow these steps:

1. To create a Cloud Router interface, make one of the following requests:

   • PATCH: Use the routers.patch method
   • UPDATE: Use the routers.update method

   The PATCH request updates only the parameters that you include, whereas the UPDATE request updates all the parameters of a Cloud Router.

   Each BGP address range for each IPv4 BGP session must be unique among all Cloud Routers in all regions of a VPC network.

   Repeat this step and command for each VPN tunnel on the second HA VPN gateway.

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "interfaces": [
       {
         "name": "if-tunnel-a-to-on-prem-if-0",
         "linkedVpnTunnel": "ha-vpn-gw-a-tunnel-0",
         "ipRange": "169.254.0.1/30"
         }
       ]
   }
   

2. To add a BGP peer configuration to the interface, make one of the following requests:

   • PATCH: Use the routers.patch method
   • UPDATE: Use the routers.update method

   Repeat this command for the other VPN tunnel, changing all options except nameand peerAsn.

   For example:

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "169.254.0.1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": 65002,
       "peerIpAddress": "169.254.0.2",
       "advertiseMode": "DEFAULT"
       }
     ]
   }
   

   The following example includes a command to add a BGP peer with IPv6 route exchange enabled and manually configured IPv6 next-hop addresses. If you omit ipv6NexthopAddress and peerIpv6NexthopAddress, then the IPv6 next-hop addresses are automatically assigned.

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "169.254.0.1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": 65002,
       "peerIpAddress": "169.254.0.2",
       "advertiseMode": "DEFAULT",
       "enableIpv6": true,
       "ipv6NexthopAddress: "2600:2d00:0:2::1"
       "peerIpv6NexthopAddress: "2600:2d00:0:2::2"
       }
     ]
   }
   

   If you want to specify custom learned routes for the peer, define the IP prefixes for the routes. You can also optionally set a priority value of between 0 and 65535 (inclusive) for the routes. Each BGP session can have one priority value that applies to all the custom learned routes that you configured for the session. For more information about this feature, see Custom learned routes.

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "169.254.0.1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": 65002,
       "peerIpAddress": "169.254.0.2",
       "advertiseMode": "DEFAULT",
       "enableIpv6": true,
       "ipv6NexthopAddress": "2600:2d00:0:2::1",
       "peerIpv6NexthopAddress": "2600:2d00:0:2::2",
       "customLearnedRoutePriority": 200,
       "customLearnedIpRanges": [
           {
             "range": "1.2.3.4"
           },
           {
             "range": "6.7.0.0/16"
           },
           {
             "range": "2001:db8:abcd:12::/64"
           }
         ]
         }
       ]
     }
   

   To configure the session for MD5 authentication, include an authentication key in your request by adding both the key and the name of the key. Then, when creating the BGP peering session, reference this key by its name.

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "md5AuthenticationKeys": [
       {
       "name": "bgppeer-1-key",
       "key": "secret_key_value"
       }
       ],
   }
   {
     "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "169.254.0.1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": 65002,
       "peerIpAddress": "169.254.0.2",
       "advertiseMode": "DEFAULT",
       "md5AuthenticationKeyName": "bgppeer-1-key"
       }
     ]
   }
   

Console

To create BGP sessions, follow these steps:

1. Click Configure BGP session.

2. On the Create BGP session page, complete the following steps:

   1. For BGP session type, select IPv6 BGP session.
   2. For Name, enter a name for the BGP session.
   3. For Peer ASN, enter the peer ASN configured for the peer VPN gateway.
   4. Optional: For Advertised route priority (MED), enter the priority of routes advertised to this BGP peer.
   5. Optional: To enable IPv4 route exchange, click the Enable IPv4 traffic toggle.

   6. For Allocate BGP IPv6 address, select Automatically or Manually. If you select Manually, do the following:

      1. For Cloud Router BGP IPv6 address, enter the Cloud Router BGP IPv6 address.
      2. For BGP peer IPv6 address, enter the IPv6 address of the BGP peer. The IPv6 address must meet the following requirements:
         • Each address must be unique local addresses (ULA) from the fdff:1::/64 address range with a mask length of /64. For example, fdff:1::1.
         • Each address must be unique among all Cloud Routers in all regions of a VPC network.

      If you select Automatically, Google Cloud automatically selects the IPv6 addresses for your BGP session.

   7. Optional: If you enabled IPv4 route exchange in the previous step, for Allocate BGP IPv4 next hop, select Automatically or Manually. If you select Manually, do the following:

      1. In the Cloud Router BGP IPv4 next hop field, enter an IPv4 address in the 169.254.0.0/16 address range. This IP address is the next hop address for IPv4 routes that are advertised by the Cloud Router.
      2. In the Peer BGP IPv4 next hop field, enter an IP address in the 169.254.0.0/16 address range. This IP address is the next hop address for IPv4 routes learned by the Cloud Router from the BGP peer.
      3. Optional: Expand the Advanced options section.
      4. To enable BGP peer, select Enabled. If enabled, the peer connection is established with routing information. For more information, see Establish BGP sessions.
      5. To add MD5 authentication, select Enabled. If enabled, you can use MD5 authentication to authenticate BGP sessions between Cloud Router and its peers. For more information, see Use MD5 authentication. You can alternatively choose to enable MD5 authentication later.
      6. To add outbound routes to the BGP session, for Priority of all custom learned routes, enter a custom learned route priority. For more information, see Custom learned routes.

3. Click Save and continue.

4. Repeat the previous steps for the rest of the tunnels configured on the gateway. For each tunnel, use a different Cloud Router BGP IP address and BGP peer IP address.

5. Click Save BGP configuration.

gcloud

To create BGP sessions, follow these steps:

In the commands, replace the following:

• ROUTER_INTERFACE_NAME_0 and ROUTER_INTERFACE_NAME_1: a name for the Cloud Router interface; it can be helpful to use names related to the tunnel names configured previously
• TUNNEL_NAME_0 and TUNNEL_NAME_1: the tunnel associated with the HA VPN gateway interface that you configured

• IP_VERSION: IPV6. This parameter is only required if you want Google Cloud to assign the IPv6 address automatically for this interface. If you are manually assigning an IPv6 address to this interface, you can omit this flag.

• IP_PREFIXES and CUSTOM_ROUTE_PRIORITY: values that let you manually specify learned routes for a BGP session; for more information about this feature, see Custom learned routes

• AUTHENTICATION_KEY: the secret key to use for MD5 authentication; for more information about this optional feature, see Use MD5 authentication.

Optional: Assign a BGP identifier range

When you add the first interface to a Cloud Router, a BGP identifier range is automatically assigned to the Cloud Router. If you prefer to define your own BGP identifier range for a Cloud Router, you can create your own range. You can also modify this range later. For more information, see Configure the BGP identifier range for a Cloud Router.

Assign IPv6 BGP addresses

The following procedures create IPv6 BGP sessions with automatically or manually configured BGP IPv6 and BGP peer IPv6 addresses.

If you want to use IPv6 BGP with MP-BGP, run the commands listed in Assign IPv4 next-hop addresses.

Assign IPv4 next-hop addresses

Use the commands in this section only if you want VPN tunnels that use MP-BGP. With MP-BGP, you can exchange IPv4 routes over IPv6 BGP sessions.

If you don't plan to use MP-BGP in the BGP session for the tunnel, then use the commands listed in Assign IPv6 BGP addresses.

You can choose to automatically or manually configure BGP peer next hop IPv4 or IPv6 addresses.

API

To create BGP sessions, follow these steps:

1. To create a Cloud Router interface and assign it an IPv6 address, make either a PATCH or UPDATE request by using the routers.patch method or the routers.update method. PATCH updates only the parameters that you include. UPDATE updates all parameters for Cloud Router.

   The following example creates an interface with a manually configured IPv6 address.

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "interfaces": [
       {
         "name": "if-tunnel-a-to-on-prem-if-0",
         "linkedVpnTunnel": "ha-vpn-gw-a-tunnel-0",
         "ipRange": "fdff:1::/112"
         }
       ]
   }
   

   Each BGP address range for each IPv6 BGP session must be unique among all Cloud Routers in all regions of a VPC network.

   As another example, the following command creates an interface with an automatically assigned IPv6 address.

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "interfaces": [
       {
         "name": "if-tunnel-a-to-on-prem-if-0",
         "linkedVpnTunnel": "ha-vpn-gw-a-tunnel-0",
         "ipVersion": "IPV6"
         }
       ]
   }
   

   Repeat this step for each VPN tunnel on the HA VPN gateway.

2. Add a BGP peer configuration to a Cloud Router for a VPN tunnel, make either a PATCH or UPDATE request by using the routers.patch method or the routers.update method. Repeat this command for the other VPN tunnel, changing all options except nameand peerAsn.

   For example:

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "fdff:1::1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": 65002,
       "peerIpAddress": "fdff:1::2",
       "advertiseMode": "DEFAULT"
       }
     ]
   }
   

   The following example includes a command to add a BGP peer for the IPv6 BGP interface with IPv4 route exchange enabled and IPv4 next-hop addresses manually configured. If you omit ipv4NexthopAddress and peerIpv4NexthopAddress, then IPv4 next-hop addresses are automatically assigned.

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers//ROUTER_NAME
   {
     "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "fdff:1::1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": 65002,
       "peerIpAddress": "fdff:1::2",
       "advertiseMode": "DEFAULT",
       "enableIpv4": true,
       "ipv4NexthopAddress: "169.254.0.1",
       "peerIpv4NexthopAddress: "169.254.0.2"
       }
     ]
   }
   

   If you want to specify custom learned routes for the peer, define the IP prefixes for the routes. You can also optionally set a priority value of between 0 and 65535 (inclusive) for the routes. Each BGP session can have one priority value that applies to all the custom learned routes that you configured for the session. For more information, see Custom learned routes.

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "fdff:1::1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": 65002,
       "peerIpAddress": "fdff:1::2",
       "advertiseMode": "DEFAULT",
       "enableIpv4": true,
       "ipv4NexthopAddress: "169.254.0.1",
       "peerIpv4NexthopAddress: "169.254.0.2"
       "customLearnedRoutePriority": 200,
       "customLearnedIpRanges": [
           {
             "range": "1.2.3.4"
           },
           {
             "range": "6.7.0.0/16"
           },
           {
             "range": "2001:db8:abcd:12::/64"
           }
         ]
         }
       ]
   }
   

   If you want to configure the session to use MD5 authentication, your request must include an authentication key, which means that it must provide both the key and a name for the key. It must also reference the key by name when creating the BGP peering session. For example:

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "md5AuthenticationKeys": [
       {
       "name": "bgppeer-1-key",
       "key": "secret_key_value"
       }
       ],
   }
   {
     "bgpPeers": [
     {
       "interfaceName": "if-tunnel-a-to-on-prem-if-0",
       "ipAddress": "fdff:1::1",
       "name": "bgp-peer-tunnel-a-to-on-prem-if-0",
       "peerAsn": 65002,
       "peerIpAddress": "fdff:1::2",
       "advertiseMode": "DEFAULT",
       "md5AuthenticationKeyName": "bgppeer-1-key"
       }
     ]
   }
   

Console

To create both IPv4 and IPv6 BGP sessions, follow these steps:

1. Click Configure BGP session.

2. On the Create BGP session page, complete the following steps:

   1. For BGP session type, select Both.

   IPv4 BGP session

   1. For Name, enter a name for the BGP session.
   2. For Peer ASN, enter the peer ASN configured for the peer VPN gateway.
   3. For Allocate BGP IPv4 address, select Automatically or Manually. If you select Manually, do the following:
   4. For Cloud Router BGP IPv4 address, enter the Cloud Router BGP IPv4 address.

   5. For BGP peer IPv4 address, enter the IPv4 address of the BGP peer. The IPv4 address must meet the following requirements:

      • Each IPv4 address must belong to the same /30 subnet that fits within the 169.254.0.0/16 address range.
      • Each IPv4 address is the first or second host of the /30 subnet. The first and the last IP addresses of the subnet are reserved for network and broadcast addresses.
      • Each IPv4 address range for a BGP session must be unique among all Cloud Routers in all regions of a VPC network.

      If you select Automatically, Google Cloud automatically selects the IPv4 addresses for your BGP session.

      If you select automatic IPv6 address allotment, Google Cloud automatically selects the IPv6 addresses for your BGP session.

   6. Optional: Expand the Advanced options section.

   7. To enable BGP peer, select Enabled. If enabled, the peer connection is established with routing information. For more information, see Establish BGP sessions.

   8. To add MD5 authentication, select Enabled. If enabled, you can use MD5 authentication to authenticate BGP sessions between Cloud Router and its peers. For more information, see Use MD5 authentication. You can alternatively choose to enable MD5 authentication later.

   9. To add outbound routes to the BGP session, for Priority of all custom learned routes, enter a custom learned route priority. For more information, see Custom learned routes.

   10. Click Save and continue.

   IPv6 BGP session

   1. For Name, enter a name for the BGP session.
   2. For Peer ASN, enter the peer ASN configured for the peer VPN gateway.
   3. Optional: For Advertised route priority (MED), enter the priority of routes advertised to this BGP peer.
   4. For Allocate BGP IPv6 address, select Automatically or Manually. If you select Manually, do the following:
   5. For Cloud Router BGP IPv6 address, enter the Cloud Router BGP IPv6 address.

   6. For BGP peer IPv6 address, enter the IPv6 address of the BGP peer. The IPv4 address must meet the following requirements:

      • Each address must be unique local addresses (ULA) from the fdff:1::/64 address range with a mask length of /64. For example, fdff:1::1.
      • Each address must be unique among all Cloud Routers in all regions of a VPC network.

      If you select Automatically, Google Cloud automatically selects the IPv6 addresses for your BGP session.

   7. Optional: Expand the Advanced options section.

   8. To enable BGP peer, select Enabled. If enabled, the peer connection is established with routing information. For more information, see Establish BGP sessions.

   9. To enable MD5 authentication, select Enabled. If enabled, MD5 authentication is used to authenticate BGP sessions between Cloud Router and its peers. For more information, see Use MD5 authentication. You can alternatively choose to enable MD5 authentication later.

   10. To add outbound routes to the BGP session, for Priority of all custom learned routes, enter a custom learned route priority. For more information, see Custom learned routes.

   11. Click Save and continue.

3. Repeat the previous steps for the rest of the tunnels configured on the gateway. For each tunnel, use a different Cloud Router BGP IP address and BGP peer IP address.

4. Click Save BGP configuration.

gcloud

To create BGP sessions, follow these steps:

In the commands, replace the following:

• ROUTER_INTERFACE_NAME_0_ipv4and ROUTER_INTERFACE_NAME_0_ipv6: names for the first pair of Cloud Router BGP interfaces that share the same tunnel; it can be helpful to use names related to the tunnel names configured previously
• ROUTER_INTERFACE_NAME_1_ipv4, ROUTER_INTERFACE_NAME_1_ipv6: names for the second set of Cloud Router BGP interfaces
• TUNNEL_NAME_0 and TUNNEL_NAME_1: the tunnel associated with the HA VPN gateway interface that you configured
• IP_PREFIXES and CUSTOM_ROUTE_PRIORITY: values that let you manually specify learned routes for a BGP session; for more information about this feature, see Custom learned routes

• AUTHENTICATION_KEY: the secret key to use for MD5 authentication; for more information about this optional feature, see Use MD5 authentication.

  In addition, you can choose to automatically or manually configure the IPv4 and IPv6 addresses for your Cloud Router interfaces and BGP peers.

  Optional: Assign a BGP identifier range

  When you add the first interface with an IPv6 address to a Cloud Router, a BGP identifier range is automatically assigned to the Cloud Router. If you prefer to define your own BGP identifier range for a Cloud Router, you can create your own range. You can also modify this range later. For more information, see Configure the BGP identifier range for a Cloud Router.

API

To create BGP sessions, follow these steps:

1. To create two Cloud Router interfaces, make either a PATCH or UPDATE request by using the routers.patch method or the routers.update method. PATCH updates only the parameters that you include. UPDATE updates all parameters for Cloud Router.

   Create two Cloud Router interfaces for the first VPN tunnel on the HA VPN gateway. You create interface with an IPv4 address and an interface with an IPv6 address. You can configure both interfaces and their BGP peers in the same PATCH or UPDATE request. The interfaces are associated with the same linkedVpnTunneltunnel, and the BGP peers are then associated with the interfaces.

   The BGP address ranges for each interface must be unique among all Cloud Routers in all regions of a VPC network.

   Repeat this step and command for each VPN tunnel on the HA VPN gateway.

   The following example adds one interface with an IPv4 address and one interface with an IPv6 address to the same linkedVpnTunnel. The example command manually specifies the IPv4 and IPv6 BGP addresses:

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "interfaces": [
       {
         "name": "if-tunnel-a-to-on-prem-if-0_ipv4",
         "linkedVpnTunnel": "ha-vpn-gw-a-tunnel-0",
         "ipRange": "169.254.0.1/30"
         },
         {
         "name": "if-tunnel-a-to-on-prem-if-0_ipv6",
         "linkedVpnTunnel": "ha-vpn-gw-a-tunnel-0",
         "ipRange": "fdff:1::/126"
         }
   
       ]
   }
   

   The following example adds an IPv4 BGP interface and an IPv6 BGP interface to the same linkedVpnTunnel with automatically assigned IPv4 and IPv6 BGP addresses:

   PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
   {
     "interfaces": [
       {
         "name": "if-tunnel-a-to-on-prem-if-0_ipv4",
         "linkedVpnTunnel": "ha-vpn-gw-a-tunnel-0",
         "ipVersion": "IPV4"
         },
         {
         "name": "if-tunnel-a-to-on-prem-if-0_ipv6",
         "linkedVpnTunnel": "ha-vpn-gw-a-tunnel-0",
         "ipVersion": "IPV6"
         }
   
       ]
   }
   

   1. To add the BGP peers to the Cloud Router for each VPN tunnel, make either a PATCH or UPDATE request by using the routers.patch method or the routers.update method. Repeat this command for the other VPN tunnels, changing all options as needed.

      For example:

      PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers/ROUTER_NAME
      {
      "bgpPeers": [
      {
        "interfaceName": "if-tunnel-a-to-on-prem-if-0_ipv4",
        "ipAddress": "169.254.0.1",
        "name": "bgp-peer-tunnel-a-to-on-prem-if-0_ipv4",
        "peerAsn": 65002,
        "peerIpAddress": "169.254.0.2",
        "advertiseMode": "DEFAULT"
        },
        {
        "interfaceName": "if-tunnel-a-to-on-prem-if-0_ipv6",
        "ipAddress": fdff:1::1",
        "name": "bgp-peer-tunnel-a-to-on-prem-if-0_ipv6",
        "peerAsn": 65002,
        "peerIpAddress": "fdff:1::2",
        "advertiseMode": "DEFAULT"
        }
      ]
      }
      

Console

To verify the configuration, go to the Summary and reminder page:

1. The Summary section of this page lists information for the HA VPN gateway and the peer VPN gateway profile. For each VPN tunnel, you can view the VPN tunnel status, the BGP session name, the BGP session status, and the MED value (advertised route priority).
2. The Reminder section of this page lists the steps that you must complete to have a fully operational VPN connection between Cloud VPN and your peer VPN.
3. If you want to download a configuration template for your peer VPN device, click Download configuration. For instructions on how to select your template and to view a list of supported vendors, see Download a peer VPN configuration template. You can also download the configuration template later by going to the Peer VPN gateways page.
4. After reviewing the information on this page, click OK.

gcloud

To verify the Cloud Router configuration, follow these steps:

• List the BGP session IP addresses chosen by Cloud Router. If you added a new interface to an existing Cloud Router, the BGP IPv4 or IPv6 addresses for the new interface might be listed with the highest index number. Use the BGP IPv4 or BGP IPv6 address peerIpAddress to configure your peer VPN gateway:

  gcloud compute routers get-status ROUTER_NAME \
     --region=REGION \
     --format='flattened(result.bgpPeerStatus[].name,
       result.bgpPeerStatus[].ipAddress, result.bgpPeerStatus[].peerIpAddress)'
  

  The expected output for a Cloud Router managing two Cloud VPN tunnels (index 0 and index 1) looks like the following example where the following is true:

  • GOOGLE_BGP_IP_0 represents the BGP IP address of the Cloud Router's interface for the tunnel on Cloud VPN gateway interface 0; PEER_BGP_IP_0 represents the BGP IP address of its peer.
  • GOOGLE_BGP_IP_1 represents the BGP IP address of the Cloud Router's interface for the tunnel on Cloud VPN gateway interface 1; PEER_BGP_IP_1 represents the BGP IP address of its peer.

    result.bgpPeerStatus[0].ipAddress:      169.254.0.1 GOOGLE_BGP_IP_0
    result.bgpPeerStatus[0].name:           bgp-peer-tunnel-a-to-on-prem-if-0
    result.bgpPeerStatus[0].peerIpAddress:  169.254.0.2 PEER_BGP_IP_0
    result.bgpPeerStatus[1].ipAddress:      169.254.1.1 GOOGLE_BGP_IP_1
    result.bgpPeerStatus[1].name:           bgp-peer-tunnel-a-to-on-prem-if-1
    result.bgpPeerStatus[1].peerIpAddress:  169.254.1.2 PEER_BGP_IP_1
  

• You can also use the following command to get a full listing of the Cloud Router configuration:

  gcloud compute routers describe ROUTER_NAME \
     --region=REGION
  

  The full listing looks like the following example:

  bgp:
    advertiseMode: DEFAULT
    asn: 65001
  bgpPeers:
  - interfaceName: if-tunnel-a-to-on-prem-if-0
    ipAddress: 169.254.0.1
    name: bgp-peer-tunnel-a-to-on-prem-if-0
    peerAsn: 65002
    peerIpAddress: 169.254.0.2
  - interfaceName: if-tunnel-a-to-on-prem-if-1
    ipAddress: 169.254.1.1
    name: bgp-peer-tunnel-a-to-on-prem-if-1
    peerAsn: 65004
    peerIpAddress: 169.254.1.2
  creationTimestamp: '2018-10-18T11:58:41.704-07:00'
  id: '4726715617198303502'
  interfaces:
  - ipRange: 169.254.0.1/30
    linkedVpnTunnel: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-a-to-on-prem-if-0
    name: if-tunnel-a-to-on-prem-if-0
  - ipRange: 169.254.1.1/30
    linkedVpnTunnel: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-a-to-on-prem-if-1
    name: if-tunnel-a-to-on-prem-if-1
    kind: compute#router
    name: router-a
    network: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/network-a
    region: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1
    selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/routers/router-a
  

API

To verify the Cloud Router configuration, make a GET request by using the routers.getRouterStatus method , and use an empty request body:

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/routers

Console

To receive a 99.99% uptime SLA, configure a tunnel on each HA VPN interface of an HA VPN gateway.

Configure a second tunnel in the following circumstances:

• If you configured an HA VPN gateway to a peer VPN gateway that has a single peer VPN interface.
• If you previously set up a single tunnel on an HA VPN gateway to a peer VPN gateway that contains any number of interfaces, but now want a 99.99% uptime SLA for your HA VPN gateway.

To configure a second tunnel, follow the steps at Add a tunnel from an HA VPN gateway to a peer VPN gateway.