Skip to main content
To establish a stable, persistent connection between a Google Cloud Platform (GCP) private cloud and your MacStadium private cloud, you need to configure an IPsec site-to-site VPN between the two clouds. This guide covers the Classic VPN connection with policy-based routing. It consists of one tunnel and one interface and does not provide high availability. For more information about this option, see Google Cloud Documentation: Classic VPN. For HA VPN with BGP routing and high availability, see Site-to-Site VPN Configuration with GCP. To create a site-to-site VPN from your GCP private cloud to your MacStadium private cloud, you need to go through the following high-level steps:
  1. Log into GCP
  2. Create the VPN connection

​
Log into GCP

  1. Log in to the GCP console with your credentials.
  2. In the toolbar at the top, make sure that you’re working with the correct project.\ GCP console toolbar with project selector

​
Create the VPN connection

From the GCP console sidebar, scroll to the Networking section and select Hybrid Connectivity > VPN. GCP sidebar with Hybrid Connectivity VPN option highlighted Classic VPN connections in GCP consist of a gateway and tunnel. You can create a gateway and a tunnel at once or you can add a new tunnel to an existing gateway.

​
Create gateway and tunnel

If you don’t have a classic VPN gateway that you want to use, complete the following steps.
  1. If you don’t have any VPNs created yet, click Create VPN connection.
  2. If you have one or more VPNs created, click + VPN SETUP WIZARD.
  3. Select Classic VPN and click Continue.
  4. In the Google Compute Engine VPN gateway section, provide Name and Description.
  5. For Network, select the GCP network that needs to be able to access MacStadium.
  6. Select Region.
  7. Select or create a reserved IP address for the connection.
    • You will need this IP address when you configure the MacStadium side of the tunnel.
  8. In the Tunnels section, provide Name and Description.
  9. For Remote peer IP address, provide the firewall’s public IP from My Cloud.
  10. For IKE version, verify that IKEv2 is selected.
  11. Provide or generate an IKE pre-shared key.
Keep a record of the pre-shared key. You will need it later.
  1. For Routing options, select Policy-based.
  2. For Remote network IP ranges, provide the IP range in CIDR notation of the private network listed in the IP Allocation table in My Cloud.
  1. (Optional) Select one or more GCP subnetworks to reduce latency between your GCP private cloud and your MacStadium private cloud.
  1. (Optional) Provide one or more IP ranges within your GCP local network that needs to access MacStadium.
  2. Click Done.
  3. Click Create.
After the creation is complete, the VPN tunnel status is: First handshake.

​
Example: Create gateway and tunnel

This image shows a sample configuration for the VPN gateway and tunnel. GCP VPN gateway and tunnel configuration form with sample settings

​
Add a new tunnel to an existing gateway

If you have an existing classic VPN gateway that you want to use for the connection, complete the following steps.
  1. Select Cloud VPN Tunnels and click Create VPN tunnel.\ GCP Cloud VPN Tunnels tab with Create VPN tunnel button
  2. Select the VPN gateway that you want to use and click Continue.
Make sure that you have selected a classic VPN gateway. High-availability gateways are not supported.
  1. Provide Name.
  2. (Optional) Provide Description.
  3. For Remote peer IP address, provide the firewall’s public IP from My Cloud.
  4. For IKE version, verify that IKEv2 is selected.
  5. Provide or generate an IKE pre-shared key.
Keep a record of the pre-shared key. You will need it later.
  1. For Routing options, select Policy-based.
  2. For Remote network IP ranges, provide the IP range in CIDR notation of the private network listed in the IP Allocation table in My Cloud.
  3. (Optional) Select one or more GCP subnetworks to reduce latency between your GCP private cloud and your MacStadium private cloud.
  1. (Optional) Provide one or more IP ranges within your GCP local network that needs to access MacStadium.
  2. Click Create.
After the creation is complete, the VPN tunnel status is: First handshake.

​
Example: Create the VPN gateway and tunnel

This image shows a sample configuration for the VPN connection. GCP VPN tunnel configuration form showing sample settings for an existing gateway

​
Ensure that the GCP firewall allows ingress traffic

Based on your requirements, you might need to enable ingress traffic from MacStadium to GCP in the GCP firewall. For more information, see Google Cloud Documentation: Configuring firewall rules > Example configurations.

​
Next steps

If you are ready to proceed with the MacStadium side of the configuration, see Preparing the VPN Configuration for Input into Cisco ASA/ASAv.