GCP HA VPN Mesh Interconnect

Dual-Tunnel BGP Mesh 99.99% Availability SLA
Project: my-devops-journey-502420 Region: us-central1 VPC A: 10.10.0.0/24 (ASN 65001) VPC B: 10.20.0.0/24 (ASN 65002)
+25
To Add
0
To Change
0
To Destroy
💡 Click any gateway, router, tunnel, or VM node to inspect Terraform parameters
Google Cloud Project: my-devops-journey-502420 • Region: us-central1 (Zone us-central1-a) • 25 Terraform Resources Managed A VPC Network: vpn-vpc-a routing_mode = GLOBAL • auto_subnets = false Subnet: vpn-subnet-a CIDR: 10.10.0.0/24 • us-central1 Compute Instance: vpn-vm-a e2-micro • debian-12 • us-central1-a INTERNAL IP (DHCP) 10.10.0.X (known after apply) BOOT DISK & PROTECTION Auto-Delete: true • Deletion: DELETE TARGET WORKLOAD IN VPC A Pingable from VPC B via HA VPN Tunnel Firewall: vpn-vpc-a-allow Priority: 1000 • Ingress • Target: vpn-vpc-a ALLOW: TCP 22 (SSH) ALLOW: ICMP (Ping) AUTHORIZED SOURCE RANGES: 10.20.0.0/24 (VPC B) + 35.235.240.0/20 (IAP) Cloud Router: ha-vpn-router-a BGP ASN: 65001 • Keepalive: 20s • us-central1 router-a-if0 (BGP Peer 0) IP Range: 169.254.0.1/30 Peer: bgp-a-to-b-if0 (ASN 65002 @ 169.254.0.2) Bound Tunnel: tunnel-a-to-b-if0 router-a-if1 (BGP Peer 1) IP Range: 169.254.1.1/30 Peer: bgp-a-to-b-if1 (ASN 65002 @ 169.254.1.2) Bound Tunnel: tunnel-a-to-b-if1 HA VPN Gateway: ha-vpn-gw-a Stack: IPV4_ONLY • 2 High-Availability Interfaces GW IF 0 Public Interface IP: (known) Connects to Tunnel: tunnel-a-to-b-if0 GW IF 1 Public Interface IP: (known) Connects to Tunnel: tunnel-a-to-b-if1 DUAL IPsec VPN TUNNELS & BGP MESH IKEv2 • 32-Byte Secret • Active / Active Routing random_password.vpn_shared_secret Length: 32 • Special: false • (sensitive) PRIMARY TUNNEL 0 (if0 ↔ if0) A → B: tunnel-a-to-b-if0 GW Interface: 0 • IKEv2 • Sensitive Secret BGP: 169.254.0.1 (65001) BGP 0 B → A: tunnel-b-to-a-if0 GW Interface: 0 • IKEv2 • Sensitive Secret BGP: 169.254.0.2 (65002) BGP SESSION SUMMARY (TUNNEL 0): Router A (ASN 65001): 169.254.0.1/30 Router B (ASN 65002): 169.254.0.2/30 Priority: 100 • Metric: Equal Cost State: Active / Redundant Mesh Auto-learns 10.10.0.0/24 & 10.20.0.0/24 SECONDARY TUNNEL 1 (if1 ↔ if1) A → B: tunnel-a-to-b-if1 GW Interface: 1 • IKEv2 • Sensitive Secret BGP: 169.254.1.1 (65001) BGP 1 B → A: tunnel-b-to-a-if1 GW Interface: 1 • IKEv2 • Sensitive Secret BGP: 169.254.1.2 (65002) BGP SESSION SUMMARY (TUNNEL 1): Router A (ASN 65001): 169.254.1.1/30 Router B (ASN 65002): 169.254.1.2/30 Priority: 100 • Metric: Equal Cost State: Active / Redundant Mesh Provides Instant Failover (99.99% SLA) ACTIVE-ACTIVE HIGH AVAILABILITY Dual 99.99% SLA Compliant Architecture Dynamic BGP route advertisement & withdrawal Seamless Zero-Downtime Failover B VPC Network: vpn-vpc-b routing_mode = GLOBAL • auto_subnets = false Subnet: vpn-subnet-b CIDR: 10.20.0.0/24 • us-central1 Compute Instance: vpn-vm-b e2-micro • debian-12 • us-central1-a INTERNAL IP (DHCP) 10.20.0.X (known after apply) BOOT DISK & PROTECTION Auto-Delete: true • Deletion: DELETE TARGET WORKLOAD IN VPC B Pingable from VPC A via HA VPN Tunnel Firewall: vpn-vpc-b-allow Priority: 1000 • Ingress • Target: vpn-vpc-b ALLOW: TCP 22 (SSH) ALLOW: ICMP (Ping) AUTHORIZED SOURCE RANGES: 10.10.0.0/24 (VPC A) + 35.235.240.0/20 (IAP) Cloud Router: ha-vpn-router-b BGP ASN: 65002 • Keepalive: 20s • us-central1 router-b-if0 (BGP Peer 0) IP Range: 169.254.0.2/30 Peer: bgp-b-to-a-if0 (ASN 65001 @ 169.254.0.1) Bound Tunnel: tunnel-b-to-a-if0 router-b-if1 (BGP Peer 1) IP Range: 169.254.1.2/30 Peer: bgp-b-to-a-if1 (ASN 65001 @ 169.254.1.1) Bound Tunnel: tunnel-b-to-a-if1 HA VPN Gateway: ha-vpn-gw-b Stack: IPV4_ONLY • 2 High-Availability Interfaces GW IF 0 Public Interface IP: (known) Connects to Tunnel: tunnel-b-to-a-if0 GW IF 1 Public Interface IP: (known) Connects to Tunnel: tunnel-b-to-a-if1
📤 Terraform Plan Outputs
bgp_session_summary.tunnel_0 Router A (ASN 65001 @ 169.254.0.1/30) ↔ Router B (ASN 65002 @ 169.254.0.2/30)
bgp_session_summary.tunnel_1 Router A (ASN 65001 @ 169.254.1.1/30) ↔ Router B (ASN 65002 @ 169.254.1.2/30)
gateway_a_interfaces / gateway_b_interfaces (known after apply - 2 Public IPs each)
vm_a_ip / vm_b_ip Dynamic DHCP within 10.10.0.0/24 & 10.20.0.0/24