HA VPN over the Internet?

[Thomasaw]

Hi,

I have a trouble to build and connect between GCP and another cloud site.

[GCP]
　Cloud Router ---(BGP)--- HA VPN ---(Endpoint: Global IP)--- Internet
[Another Cloud]
　Internet --- VyOS(VPN/BGP)
*Not describing servers this time.

From VyOS, can ping to the endpoint ip on GCP.
Checking IKE and other vpn parameters, but at the same time, I think it has a trouble on network.
Actually, I could not find any good documents that illustrates a structure over the Internet.

Does anybody have tried a structure like that or have any ideas?

best regards,

[nestors]

Hi, 

you can check in https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies for different diagrams using VPN HA.

[Thomasaw]

Hi, @nestors 

Thank you for giving me a document, from that, my structure seems to be good.
But I am still in trouble.

The ping from my cloud to GCP is OK.
Both my site and GCP send packets for VPN, but both sites say "peer not responding".
Also checked firewall rules and allow ESP, UDP/500, and UDP/4500.

https://cloud.google.com/network-connectivity/docs/vpn/support/troubleshooting
Log Explorer (on GCP) shows:
- ("initiating IKE_SA" OR "generating IKE_SA_INIT request")
- "establishing IKE_SA failed, peer not responding"
And there are no log messages like:
- ("generating IKE_AUTH request" OR "parsed IKE_AUTH response")
- and better

best regards,

[nestors · Accepted solution]

VPC Firewall rules are of no use here, VPN is established using external IP address on both sides.

If you get "peer not responding" either there's a mismatch on the configuration regarding external IPs (in GCP or the other cloud) or you have incorrect parameters / secrets on the IKE parameters.

[Thomasaw]

Hi @nestors 

Thank you, I will have to check the rules of my cloud side.
There are other points to see on my cloud and GCP project.

I would inform you if I found some.

best regards,