Lab / 8 steps

A site-to-site VPN between Google Cloud and AWS.

An HA VPN gateway on Google Cloud, a virtual private gateway on AWS, and BGP between them, so each VPC learns the other’s routes.

Lab / A site-to-site VPN between Google Cloud and AWS
Google Cloud · asia-southeast1 AWS routes IPsec propagation myvpc-network 10.1.0.0/20 HA VPN gcp-aws-vpn Cloud Router BGP VPN gateway vpg-01 myaws-network 172.32.0.0/16 Customer GWs ASN 65000 myaws-ig 0.0.0.0/0
  1. Step 01 · Cloud Shell GCP network

    Create the Google Cloud VPC

    A custom-mode VPC with global dynamic routing, and one subnet in Singapore.

    Terminal window
    gcloud compute networks create myvpc-network \
        --subnet-mode=custom \
        --bgp-routing-mode=global
    

    gcloud compute networks subnets create myvpc-subnet-sg \
        --network myvpc-network \
        --region asia-southeast1 \
        --range 10.1.0.0/20
  2. Step 02 · Cloud Shell Gateway, no tunnels

    Add an HA VPN gateway

    The gateway gets two public interfaces. Their IPs become the customer gateways on the AWS side.

    Terminal window
    gcloud compute vpn-gateways create gcp-aws-vpn \
        --network myvpc-network \
        --region asia-southeast1
  3. Step 03 · AWS CLI Two networks, apart

    Create the AWS VPC and subnet

    A VPC with DNS hostnames on, and a subnet inside it.

    Terminal window
    aws ec2 create-vpc --instance-tenancy "default" \
        --cidr-block "172.32.0.0/16" \
        --tag-specifications '{"ResourceType":"vpc","Tags":[{"Key":"Name","Value":"myaws-network"}]}'
    

    aws ec2 create-subnet --vpc-id "VPC_ID" \
        --cidr-block "172.32.0.0/20"
  4. Step 04 · AWS CLI Two networks, apart

    Route the AWS subnet

    Associate the subnet with the route table, attach an internet gateway, and add a default route to it.

    Terminal window
    aws ec2 associate-route-table --route-table-id "ROUTE_TABLE_ID" --subnet-id "SUBNET_ID"
    aws ec2 create-internet-gateway
    aws ec2 attach-internet-gateway --vpc-id "VPC_ID" --internet-gateway-id "INTERNET_GATEWAY_ID"
    aws ec2 create-route --route-table-id "ROUTE_TABLE_ID" \
        --destination-cidr-block "0.0.0.0/0" --gateway-id "INTERNET_GATEWAY_ID"
  5. Step 05 · AWS CLI Peers described

    Describe Google Cloud to AWS

    Two customer gateways, one per HA VPN interface. They stand for the Google Cloud side, so their BGP ASN is the one the Cloud Router will use; AWS keeps its own (64512 by default).

    Terminal window
    aws ec2 create-customer-gateway --ip-address "GCP Interfaces 0" --type "ipsec.1" --bgp-asn "65000"
    aws ec2 create-customer-gateway --ip-address "GCP Interfaces 1" --type "ipsec.1" --bgp-asn "65000"
  6. Step 06 · AWS CLI Both gateways up

    Add the AWS VPN gateway

    A virtual private gateway, attached to the VPC, with route propagation on so the routes it learns over BGP reach the subnet.

    Terminal window
    aws ec2 create-vpn-gateway --type "ipsec.1"
    aws ec2 attach-vpn-gateway --vpc-id "VPC_ID" --vpn-gateway-id "VPG_ID"
    aws ec2 enable-vgw-route-propagation --gateway-id "VPG_ID" --route-table-id "ROUTE_TABLE_ID"
  7. Step 07 · Cloud Shell Tunnels configured

    Describe AWS to Google Cloud

    The AWS VPN connections give four tunnel endpoints. A peer VPN gateway on Google Cloud lists all four.

    Terminal window
    gcloud compute external-vpn-gateways create gcp-aws-peer-gateway \
        --interfaces 0=AWS_VPG_1,1=AWS_VPG_2,2=AWS_VPG_3,3=AWS_VPG_4
  8. Step 08 · Cloud Shell BGP established

    Start BGP

    A Cloud Router with ASN 65000, the customer gateways’ ASN, advertises all subnets. Create a BGP session for each tunnel and check that every session is established: each VPC now learns the other’s routes.

    Terminal window
    gcloud compute routers create gcp-aws-router \
        --region asia-southeast1 --network myvpc-network \
        --asn 65000 \
        --advertisement-mode custom --set-advertisement-groups all_subnets
Read the note: Site-to-Site VPN between Google Cloud and AWS All traces