Site-to-Site VPN between Google Cloud and AWS

Establishing a Virtual Private Network (VPN) connection between Google Cloud Platform (GCP) and AWS can enhance your cloud network’s flexibility and security. This guide will walk you through setting up a high-availability VPN connection between the two providers, covering all necessary configurations for Virtual Private Clouds (VPCs), subnets, routing, and VPN tunnels. Both console and command-line instructions are provided for flexibility.

Step 1: Create the Google Cloud VPC

1. Navigate to VPC Network > Create VPC Network.
2. Configure the VPC with the following details:
   • Name: myvpc-network
   • Subnet creation mode: Custom
   • Subnets > Name: myvpc-subnet-sg
   • Region: asia-southeast1
   • IPv4 range: 10.1.0.0/20
   • Dynamic routing mode: Global

Command-line Version:

gcloud compute networks create myvpc-network \
    --subnet-mode=custom \
    --bgp-routing-mode=global

gcloud compute networks subnets create myvpc-subnet-sg \
    --network myvpc-network \
    --region asia-southeast1 \
    --range 10.1.0.0/20

Step 2: Create a High-Availability VPN Gateway in GCP

1. Go to Network Connectivity > VPN > Create VPN Connection.
2. Select High-availability (HA) VPN, then click Continue.
3. Configure with:
   • VPN gateway name: gcp-aws-vpn
   • Network: myvpc-network
   • Region: asia-southeast1

Command-line Version:

gcloud compute vpn-gateways create gcp-aws-vpn \
    --network myvpc-network \
    --region asia-southeast1

Step 3: Create AWS VPC and Subnet

1. In AWS Console, navigate to VPC Dashboard > Your VPCs > Create VPC.
2. Configure:
   • Name tag: myaws-network
   • IPv4 CIDR: 172.32.0.0/16
3. Enable DNS hostnames, click Actions > Edit VPC settings
4. in DNS settings section, click checkbox next to Enable DNS hostnames

Command-line Version:

aws ec2 create-vpc --instance-tenancy "default" \
    --cidr-block "172.32.0.0/16" \
    --tag-specifications '{"ResourceType":"vpc","Tags":[{"Key":"Name","Value":"myaws-network"}]}'

aws ec2 modify-vpc-attribute \
    --vpc-id YOUR_VPC_ID \
    --enable-dns-hostnames "{\"Value\":true}"

Create Subnet in AWS

1. Navigate to Subnets > Create subnet.
2. Configure:
   • VPC ID: myaws-network
   • Subnet name: myaws-subnet
   • IPv4 subnet CIDR block: 172.32.0.0/20

Command-line Version:

aws ec2 create-subnet \
    --vpc-id "vpc-0d84b742335a5d180" \
    --cidr-block "172.32.0.0/20" \
    --tag-specifications '{"ResourceType":"subnet","Tags":[{"Key":"Name","Value":"myaws-subnet"}]}'

Step 4: Set Up Routing and Internet Gateway on AWS

1. Attach Subnet to Route Table:
   • In Route Tables, choose your route table, go to Subnet Associations and attach myaws-subnet.

Command-line Version:

aws ec2 associate-route-table --route-table-id "ROUTE_TABLE_ID" --subnet-id "SUBNET_ID"

2. Create and Attach Internet Gateway:
   • Go to Internet Gateways > Create Internet Gateway, and name it myaws-ig.
   • Attach it to the myaws-network.

Command-line Version:

aws ec2 create-internet-gateway --tag-specifications '{"ResourceType":"internet-gateway","Tags":[{"Key":"Name","Value":"myaws-ig"}]}'
aws ec2 attach-internet-gateway --vpc-id "VPC_ID" --internet-gateway-id "INTERNET_GATEWAY_ID"

3. Add Route to Internet Gateway:
   • In the Route Tables > Routes, add a route:
     • Destination: 0.0.0.0/0
     • Target: INTERNET_GATEWAY_ID

Command-line Version:

aws ec2 create-route --route-table-id "rtb-0f07ad5674e8b8f8d" --destination-cidr-block "0.0.0.0/0" --gateway-id "igw-00c2cea55c567f80d"

Step 5: Configure AWS Customer Gateways

1. In Customer Gateways, create two customer gateways using:

   • BGP ASN: 65000
   • IP Addresses: Use GCP Interfaces 0 and 1 for each gateway.

   The customer gateways stand for the Google Cloud side, so the Cloud Router in Step 6 uses this same ASN. The AWS side keeps its own (64512 by default).

Command-line Version:

aws ec2 create-customer-gateway --ip-address "GCP Interfaces 0" --type "ipsec.1" --bgp-asn "65000" --tag-specifications '{"ResourceType":"customer-gateway","Tags":[{"Key":"Name","Value":"gcp-customer-gateway-01"}]}'
aws ec2 create-customer-gateway --ip-address "GCP Interfaces 1" --type "ipsec.1" --bgp-asn "65000" --tag-specifications '{"ResourceType":"customer-gateway","Tags":[{"Key":"Name","Value":"gcp-customer-gateway-02"}]}'

Step 6: Set Up VPN Connections and Tunnels on GCP and AWS

1. Create Virtual Private Gateway on AWS.
2. Attach it to AWS VPC and enable Route Propagation.

Command-line Version:

aws ec2 create-vpn-gateway --type "ipsec.1" --tag-specifications '{"ResourceType":"vpn-gateway","Tags":[{"Key":"Name","Value":"vpg-01"}]}'
aws ec2 attach-vpn-gateway --vpc-id "VPC_ID" --vpn-gateway-id "VPG_ID"
aws ec2 enable-vgw-route-propagation --gateway-id "VPG_ID" --route-table-id "ROUTE_TABLE_ID"

Create Peer VPN Gateway in GCP

1. Go back to GCP, select On-prem or Non Google Cloud for the Peer VPN gateway.
2. Set up four interfaces with IP addresses from AWS VPN configurations.

Command-line Version:

gcloud compute external-vpn-gateways create gcp-aws-peer-gateway --interfaces 0=AWS_VPG_1,1=AWS_VPG_2,2=AWS_VPG_3,3=AWS_VPG_4

Create Cloud Router and BGP Sessions in GCP

1. In Cloud Router, configure Google ASN and set Advertisement Mode to include all subnets.

Command-line Version:

gcloud compute routers create gcp-aws-router --region asia-southeast1 --network myvpc-network --asn 65000 --advertisement-mode custom --set-advertisement-groups all_subnets

Finalizing and Testing the VPN Connection

1. Create BGP Sessions for each VPN tunnel with ASN, IP, and BGP configurations.
2. Save the BGP Configuration and verify that all sessions establish a BGP connection.

This setup process ensures secure, high-availability network connectivity across GCP and AWS, allowing seamless resource sharing and redundancy between cloud infrastructures.