[GCP Tutorial] VPN Connection Issues: Complete Guide to GCP VPN Troubleshooting

Scenario

Our company's VPN connection is experiencing issues, and we have confirmed that the Gateway configuration is correct. What could be the possible causes of this problem?

Operation

There are usually two possibilities

1. There is an issue with the client network between the Host and the gateway.
2. There is a network issue between the client gateway and the Cloud VPN gateway.

On GCP, you can start by checking the logs and following these steps

1. Verify that the client IP address configuration on the Cloud VPN gateway is correct.
2. Ensure that traffic from the on-premises network successfully reaches the peer gateway [1].
3. Confirm that traffic flows bidirectionally between the two VPN gateways, which means checking Cloud Logging for inbound records from the on-premises VPN gateway.
4. Check that the IKE version configured on both sides of the tunnel is consistent.
5. Verify that the shared secret for the tunnel is the same on both sides.
6. Ensure that peer and Google Cloud routes and firewall rules are configured correctly to allow traffic to pass through the tunnel.

Interoperability Test Considerations

Ping is used to verify connectivity between your local network and the GCP VMs, but the following should be considered:

1. Ensure that the firewall on the Google Cloud network allows incoming ICMP traffic. Similarly, ensure that your on-premises firewall rules are configured to allow both incoming and outgoing ICMP traffic.
2. Use the internal IP address to ping your GCP VMs. Pinging the external IP of the VPN gateway does not test the connectivity of your VPN.
3. When testing connectivity from on-premises to Google Cloud, it's best to ping from a machine on your network rather than from your VPN gateway. If you have the correct interfaces set up, you can ping from the gateway as well, but pinging from a machine on your network also has the added benefit of testing firewall rules.
4. Ping does not confirm whether TCP or UDP ports are open.
5. Traceroute also uses ICMP [2], so it cannot confirm TCP connectivity.

If ping, traceroute, or other methods of sending traffic are only effective from certain GCP VMs to your on-premises network, or only effective from certain on-premises sources to certain GCP VMs, and you have confirmed that neither Google Cloud nor on-premises firewall rules are blocking the traffic you are sending, you might have traffic selectors that exclude certain sources or destinations.