GCP-to-MacStadium VPN networking setup

To establish a stable, persistent connection between a Google Cloud Platform (GCP) private cloud and your MacStadium private cloud, you need to configure an IPsec site-to-site VPN between the two clouds. This guide covers the Classic VPN connection with policy-based routing. It consists of one tunnel and one interface and does not provide high availability. For more information about this option, see Google Cloud Documentation: Classic VPN. For HA VPN with BGP routing and high availability, see Site-to-Site VPN Configuration with GCP. To create a site-to-site VPN from your GCP private cloud to your MacStadium private cloud, you need to go through the following high-level steps:

1. Log into GCP
2. Create the VPN connection

​

Log into GCP

1. Log in to the GCP console with your credentials.
2. In the toolbar at the top, make sure that you’re working with the correct project.\

​

Create the VPN connection

From the GCP console sidebar, scroll to the Networking section and select Hybrid Connectivity > VPN. Classic VPN connections in GCP consist of a gateway and tunnel. You can create a gateway and a tunnel at once or you can add a new tunnel to an existing gateway.

​

Create gateway and tunnel

If you don’t have a classic VPN gateway that you want to use, complete the following steps.

1. If you don’t have any VPNs created yet, click Create VPN connection.
2. If you have one or more VPNs created, click + VPN SETUP WIZARD.
3. Select Classic VPN and click Continue.
4. In the Google Compute Engine VPN gateway section, provide Name and Description.
5. For Network, select the GCP network that needs to be able to access MacStadium.
6. Select Region.
   • For more information about this setting, see Google Cloud Documentation: Regions and Zones.
7. Select or create a reserved IP address for the connection.
   • You will need this IP address when you configure the MacStadium side of the tunnel.
8. In the Tunnels section, provide Name and Description.
9. For Remote peer IP address, provide the firewall’s public IP from My Cloud.
10. For IKE version, verify that IKEv2 is selected.
11. Provide or generate an IKE pre-shared key.

12. For Routing options, select Policy-based.
13. For Remote network IP ranges, provide the IP range in CIDR notation of the private network listed in the IP Allocation table in My Cloud.

• By default, this is the Private-1 network.
• For more information about CIDR notations, see Understanding IP Addresses, Subnets, and CIDR Notation for Networking. You can also use a CIDR calculator such as this CIDR/Netmask Lookup Tool.

14. (Optional) Select one or more GCP subnetworks to reduce latency between your GCP private cloud and your MacStadium private cloud.

• For more information, see Google Cloud Documentation: Networks and subnets.

15. (Optional) Provide one or more IP ranges within your GCP local network that needs to access MacStadium.
16. Click Done.
17. Click Create.

After the creation is complete, the VPN tunnel status is: First handshake.

​

Example: Create gateway and tunnel

This image shows a sample configuration for the VPN gateway and tunnel.

​

Add a new tunnel to an existing gateway

If you have an existing classic VPN gateway that you want to use for the connection, complete the following steps.

1. Select Cloud VPN Tunnels and click Create VPN tunnel.\
2. Select the VPN gateway that you want to use and click Continue.

3. Provide Name.
4. (Optional) Provide Description.
5. For Remote peer IP address, provide the firewall’s public IP from My Cloud.
6. For IKE version, verify that IKEv2 is selected.
7. Provide or generate an IKE pre-shared key.

8. For Routing options, select Policy-based.
9. For Remote network IP ranges, provide the IP range in CIDR notation of the private network listed in the IP Allocation table in My Cloud.
   • By default, this is the Private-1 network.
   • For more information about CIDR notations, see Understanding IP Addresses, Subnets, and CIDR Notation for Networking. You can also use a CIDR calculator such as this CIDR/Netmask Lookup Tool.
10. (Optional) Select one or more GCP subnetworks to reduce latency between your GCP private cloud and your MacStadium private cloud.

• For more information, see Google Cloud Documentation: Networks and subnets.

11. (Optional) Provide one or more IP ranges within your GCP local network that needs to access MacStadium.
12. Click Create.

After the creation is complete, the VPN tunnel status is: First handshake.

​

Example: Create the VPN gateway and tunnel

This image shows a sample configuration for the VPN connection.

​

Ensure that the GCP firewall allows ingress traffic

Based on your requirements, you might need to enable ingress traffic from MacStadium to GCP in the GCP firewall. For more information, see Google Cloud Documentation: Configuring firewall rules > Example configurations.

​

Next steps

If you are ready to proceed with the MacStadium side of the configuration, see Preparing the VPN Configuration for Input into Cisco ASA/ASAv.