How Can I Update Encryption and Deffie Hellman Groups for VPN in GCP?

[jotaemec41]

So, I've got a VPN set up at the moment that's connected to the client's VPN and it's all good. Now, the client wants to tweak the encryption method to AES256 and Deffie Hellman groups to 19.

Is it doable? 'Cause I can't make those advanced changes through the GUI. Is there a way to make these tweaks in GCP?

As of now, I haven't run any tests because I'm not sure what steps to take. My concern is also whether, if the client makes these changes, will GCP automatically adjust and synchronize with the modifications made to the client's VPN?

[VannGuce]

Hi,

I believe there is no option to modify these ciphers. However, if the cipher role (Diffie-Hellman (DH) and Encryption) supported the cipher you want to place (AES256 and Deffie Hellman groups to 19) from Cloud VPN then there is a possibility. Just expect that there will be an interruption that will happen in your vpn set up if you change the cipher from the on-premise end.

However, if the cipher that you want to change is not supported in Cloud VPN then definitely it will not work. To check or to double check if the “AES256 and Deffie Hellman groups 19” are supported, you may visit this link[1] to see the supported IKE Cipher. I suggest also check this link[2] to see the updated changes in IKE Cipher.

[1]https://cloud.google.com/network-connectivity/docs/vpn/concepts/supported-ike-ciphers
[2]https://cloud.google.com/network-connectivity/docs/vpn/deprecations/cipher-changes#deprecated-config...

[jotaemec41]

Hey VannGuce, thanks for the quick response!

So, does that mean my Google Cloud VPN is gonna sync up and handle the settings from my client's VPN automatically?

I checked the links you shared, they've got good info. It does lay out that Cloud VPN is indeed DH 19 compatible. Just a lingering doubt on how to make my VPN grab that config.

Cheers!