Oracle Cloud Infrastructure Documentation

VPN Connection to Google Cloud

The Oracle Cloud Infrastructure (OCI) Site-to-Site VPN service offers a secure IPSec connection between an on-premises network and a Virtual Cloud Network (VCN). You can also use Site-to-Site VPN to connect OCI resources to other cloud service providers.

This topic provides a best practices configuration for an IPSec VPN tunnel between OCI and Google Cloud using the OCI Site-to-Site VPN service and the Google Cloud VPN service.

Note

This document assumes you have already provisioned a Virtual Cloud Network (VCN) and Dynamic Routing Gateway (DRG) and also configured all VCN Route Tables and Security Lists required for this scenario and all equivalents in Google Cloud.

Routing Type: This scenario uses Border Gateway Protocol (BGP) to exchange routes between Google Cloud and OCI. BGP is preferred for Site-to-Site VPN whenever possible. Optionally, static routing can also be used between Google Cloud and OCI.

You can verify the Site-to-Site VPN version used by the IPSec connection under the IPSec Connection Information tab on an IPSec connection page.

For a vendor-neutral list of supported IPSec parameters for all OCI regions, see Supported IPSec Parameters.

Google Cloud - Start VPN Configuration
  1. From the main Google Cloud portal:
    1. Expand the main menu from the upper left corner
    2. Scroll down to Hybrid Connectivity.
    3. Select VPN.
  2. On the next page, select the Create VPN Connection link to start the workflow to create an IPSec VPN connection.
  3. For VPN Options, select High-availability (HA) VPN then select the Continue button at the bottom.
  4. Create a Cloud HA VPN gateway. Enter the following details:
    • Name: Give the VPN gateway a name.
    • Network: Select the VPC that the IPSec VPN connects to.

    • Region: Select the region for the VPN gateway

      When you're finished configuring the VPN gateway, select the Create & Continue button to continue.

  5. The next page exposes the public IP of the Google Cloud VPN endpoint.

    Save the public IP of one of the interfaces, then open the OCI Console in a separate window and continue the configuration process. You return later to complete the Google Cloud configuration after the OCI IPSec connection has been provisioned.

OCI - Create CPE Object
  1. Open the navigation menu  and select Networking. Under Customer connectivity, select Customer-premises equipment.
  2. Select Create Customer-Premises Equipment.
  3. Enter the following values:
    • Create in Compartment: select the compartment for the VCN you want.
    • Name: A descriptive name for the CPE object. It doesn't have to be unique, and it can't be changed later in the Console (but you can change it with the API). Avoid entering confidential information.

      This example uses TO_GCP as the name.

    • IP Address: Enter the public IP address of the Google Cloud VPN gateway.
    • CPE Vendor: Select Other.
  4. Select Create CPE.
OCI - Create IPSec Connection
  1. Open the navigation menu  and select Networking. Under Customer connectivity, select Site-to-Site VPN.
  2. Select Create IPSec Connection.
  3. Enter the following values:
    • Create in Compartment: Leave as is (the VCN's compartment).
    • Name: Enter a descriptive name for the IPSec connection. It doesn't have to be unique, and you can change it later. Avoid entering confidential information.
    • Customer-Premises Equipment Compartment: Leave as is (the VCN's compartment).
    • Customer-Premises Equipment: Select the CPE object that you created earlier, named TO_GOOGLE_CLOUD.
    • Dynamic Routing Gateway Compartment: Leave as is (the VCN's compartment).
    • Dynamic Routing Gateway: Select the DRG that you created earlier.
    • Static Route CIDR: Enter a default route, 0.0.0.0/0. Because BGP is used for the active tunnel, OCI ignores this route. This entry is required for the second tunnel of the IPSec connection which by default uses static routing and is unused in this scenario. If you plan to use static routing for this connection, input static routes representing the Google Cloud virtual networks. Up to 10 static routes can be configured for each IPSec connection.

    • Ensure that OCI supports the chosen /30 address for the inside tunnel IPs. OCI doesn't allow you to use the following IP ranges for inside tunnel IPs:

      • 169.254.10.0-169.254.19.255
      • 169.254.100.0-169.254.109.255
      • 169.254.192.0-169.254.201.255
  4. Enter the following details on the Tunnel 1 tab (required):
    • Name: Enter a descriptive name for the tunnel (Example: GCP-TUNNEL-1). It doesn't have to be unique, and you can change it later. Avoid entering confidential information.
    • Provide custom shared secret: The pre-shared key used by IPSec for this tunnel. Select this checkbox if you would like to use a custom key. If no selection is provided, one is generated for you.
    • IKE Version: Select IKEv2.
    • Routing Type: Select BGP Dynamic Routing. Select Static Routing if you would like to use static routing.
    • BGP ASN: Input the BGP ASN used by Google Cloud. The Google Cloud BGP ASN is configured in future steps. This scenario uses a BGP ASN of 65000 for Google Cloud.
    • IPv4 Inside Tunnel Interface - CPE: Enter the BGP IP address used by Google Cloud. Use full CIDR notation for this IP address. This must be a link local address. This scenario uses the 169.254.20.0/30 CIDR for the BGP IP addresses.
    • IPv4 Inside Tunnel Interface - Oracle: Enter the BGP IP address used by OCI. Include this IP address in CIDR notation. This must be a link local address. This scenario uses the 169.254.20.0/30 CIDR for the BGP IP addresses.
  5. Select Show advanced options for the tunnel and change the Phase 1 and Phase 2 lifetimes to match the Google Cloud side as listed here https://cloud.google.com/network-connectivity/docs/vpn/concepts/supported-ike-ciphers.

    Phase 1 and Phase 2 lifetimes have different values on the Google Cloud side depending on if you're using IKEv1 or IKEv2. These are:

    • Phase 1 IKE session key lifetime in seconds = 36,000 seconds
    • Phase 2 IPSec session key lifetime in seconds = 10,800 seconds

    Leave all other settings at their default.

  6. Select Create IPSec Connection.

    The IPSec connection is created and displayed on the page. The connection is in the Provisioning state for a short period.

OCI - Save Oracle VPN IP Address and Shared Secret

After the IPSec connection has been provisioned, save the Site-to-Site VPN IP address to use as the CPE IP in the Google Cloud portal and the shared secret for the tunnel.

  1. Browse to the IPSec connection in the OCI Console.

    Decide which tunnel to use as the primary. Save the Site-to-Site VPN IP address of that tunnel. Next, select the tunnel name of that tunnel to be taken to the tunnel view.

  2. Under the tunnel, select the link to view the shared secret. Save it. The shared secret is used to complete the IPSec VPN configuration in Google Cloud.
Google Cloud - Create a VPN Peer Gateway

  1. Return to the Google Cloud VPN configuration window.
  2. Under Peer VPN Gateway, select On-prem or Non Google Cloud.
  3. Expand the Peer VPN gateway name list and select Create new VPN peer gateway.
  4. You're taken to the Add a peer VPN gateway page. Enter the following details:
  5. Select the Create button at the bottom to continue. You're taken back to the Create a VPN workflow.
Google Cloud - Create a Cloud Router
  1. Expand the Cloud Router list and select Create new router.
  2. You're taken to the Create a router page. Enter the following details:
    • Name: Give the cloud router a name.

    • Google ASN: Input the Google BGP ASN, also used when configuring the IPSec connection in OCI.

      Leave all other options as default.

  3. When you're finished configuring the cloud router, select the Create button to continue.

    You're taken back to the Create a VPN workflow.

Google Cloud - Complete configuring VPN Tunnel
Complete configuring the VPN tunnel. Enter the following details:
  • Cloud Router: Select the cloud router that was configured in the previous step.
  • Associated Cloud VPN gateway IP: Match the CPE object IP address configured in OCI.
  • Associated peer VPN Gateway interface: Match the Oracle VPN IP address of the OCI VPN tunnel. See OCI - Save Oracle VPN IP Address and Shared Secret.
  • Name: Give the VPN tunnel a name.
  • IKE version: Select IKEv2 (recommended). If using IKEv1, ensure IKEv1 is also configured for the VPN tunnel under the IPSec connection in OCI.

  • IKE pre-shared key: Match the shared secret of the VPN tunnel in the IPSec connection in OCI. See OCI - Save Oracle VPN IP Address and Shared Secret. Leave all other options as default.

    When you finish configuring the VPN tunnel, select Create & Continue.

Google Cloud - Configure BGP Sessions

This step involves configuring the BGP session for an IPSec tunnel. The BGP settings need to match the OCI side of the configuration configured in OCI - Create IPSec Connection.

  1. Select the Configure button under BGP Session for the VPN tunnel.
  2. In the Create BGP Session page for the tunnel, enter the following details:
    • Name: Give the BGP session a name.
    • Peer ASN: Enter the BGP ASN. Oracle's BGP ASN for the commercial cloud is 31898, except the Serbia Central (Jovanovac) region which is 14544.
    • Cloud Router BGP IP: Match the IP address configured for IPv4 Inside Tunnel Interface - CPE of tunnel 1 in OCI - Create IPSec Connection. Don't use CIDR notation in this field.
    • BGP peer IP: Match the IP address configured for IPv4 Inside Tunnel Interface - Oracle of tunnel 1 in OCI - Create IPSec Connection. Don't use CIDR notation in this field.

    • BGP peer: Select Enabled.

      Leave all other options as default.

  3. When you finish configuring the BGP session, select Save & Continue to go back to the Configure BGP sessions page.
  4. Select the Save BGP configuration button to continue.
  5. You're taken to the Summary and reminder page.

    The VPN tunnel status and BGP status displays as Established.

  6. Select OK at the bottom to complete the configuration.
Verification

Browse to the IPSec connection in OCI and the Site-to-Site VPN connections in Google Cloud to verify status of the tunnel.

The OCI tunnel under IPSec connection displays Up for IPSec status to confirm an operational tunnel.

The IPv4 BGP Status also displays Up indicating an established BGP session.

Browse to the cloud VPN tunnels in the Google Cloud Console. Both VPN tunnel status and BGP session status should indicate Established.

A Monitoring service is also available from OCI to actively and passively monitor cloud resources. For information about monitoring for OCI Site-to-Site VPN, see Site-to-Site VPN Metrics .

If you have issues, see Site-to-Site VPN Troubleshooting.