How to Configure BGP over IKEv2 IPsec Site-to-Site VPN to a Google Cloud VPN Gateway

To connect to the Google Cloud VPN gateway, create an IPsec IKEv2 site-to-site VPN tunnel on your CloudGen Firewall and configure BGP to exchange information with the Google BGP peer.

Open

• You will need the following information:

  • Public IP address of your on-premises CloudGen Firewall

  • (private) ASN number

• Create a VPC network in Google Cloud.

1. Go to https://console.cloud.google.com.

2. Click the hamburger menu in the upper-left corner.

3. In the Networking  section, click Network Connectivity.

4. In the left menu, click + Cloud Routers.

5. In the main area, click CREATE ROUTER.

6. Configure the settings for the Google Cloud router:

   • Name – Enter a name for the cloud router.

   • Network – Select the network from the list.

   • Region – Select the region from the list.

   • Google ASN – Enter a private ASN. This ASN number must be unique in your network.

   Open

   

7. Click Create.

Open

1. Go to https://console.cloud.google.com.

2. Click the hamburger menu in the upper-left corner.

3. In the Networking section, click Network Connectivity.

4. In the left menu, click VPN.

5. In the main area, click + VPN SETUP WIZARD.

6. The Create a VPN page opens. Select High-availability (HA) VPN and click CONTINUE. 

7. Configure the Create Cloud HA VPN gateway settings:

   • VPN gateway name – Enter a name. 

   • Network – Select your Google Cloud network from the list.

   • Region – Select the region for the Google VPN gateway. Select a location close to your on-premises CloudGen Firewall appliance.

   • VPN gateway IP version – Select an HA VPN gateway IP version. Note that the IP version of the HA VPN gateway and the peer VPN gateway must be the same.

   • VPN gateway IP stack type – Select a stack type for the VPN gateway.

8. Click CREATE & CONTINUE.

9. You can see that two external IP addresses are automatically allocated for each of your gateway interfaces. Make a note of the details of your gateway configuration for future use.

10. Configure a VPN tunnel in the Add VPN tunnels settings:

    • Peer VPN gateway – Select On-prem or Non Google Cloud.

    • Peer VPN gateway name – Select an existing peer VPN gateway from the drop-down menu or click Create a new peer VPN gateway. 

      This peer VPN gateway resource represents your remote peer gateway. Under Peer VPN gateway interfaces, you can select one, two, or four interfaces, depending on the type of interfaces your peer gateway has, and specify the external IP address used for that interface. E.g., 80.109.163.8

    • High Availability – Select Create a single VPN tunnel. Note: A single tunnel does not provide high availability. However, you can add more tunnels later when needed.

    • Verify that the Routing Options display as Dynamic (BGP).

    • Cloud router – Select the cloud router created in Step 1.

    • Name – Enter the name.

    • IKE version – Select IKEv2

    • IKE pre-shared key – Enter either a passphrase as the shared secret, or click GENERATE AND COPY. Note: Make sure you record the pre-shared key in a secure location.
      

      The shared secret can consist of small and capital characters, numbers, and non-alpha-numeric symbols, except the hash sign (#)

11. Click CREATE & CONTINUE.

12. The Configure BGP sessions page opens.

13. Click CONFIGURE BGP SESSION FOR <TUNNEL-CAMPUS> to configure BGP session.

14. The Create BGP session page opens. Configure the BGP session for the cloud router:

    • BGP session type – Select IPv4 BGP session.

    • Name – Enter a name for the BGP configuration.

    • Peer ASN – Enter the ASN assigned to the on-premises CloudGen Firewall appliance.

    • (optional) Advertised route priority – Enter a priority value. Routes with higher priorities are preferred.

    • Allocate BGP IPv4 address  –  Select Manually.

      • Cloud Router BGP IPv4 address – Enter the first IP address in a private /30 subnet. The IP address must be in the same /30 network as the peer BGP IP address: E.g., 169.254.1.1

      • Peer BGP IPv4 address – Enter the second IP address in the private /30 subnet used for the Google BGP IP address. E.g., 169.254.1.2
        

15. Click SAVE AND CONTINUE. 

16. Verify the BGP session you have configured and click SAVE BGP CONFIGURATION.

17. The Summary and reminder page opens.

18. Click OK.

Open

1. Log into the Barracuda CloudGen Firewall.

2. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN > VPN Settings.

3. Click Lock.

4. In the left navigation bar, click Routed VPN.

5. Click Add in the VPN Next Hop Interface Configuration  section.

   • VPN Interface Index – Enter a number between 0 and 99. Each interface index number must be unique.

   • MTU –  Enter 1398. 

   • IP Addresses – Enter the Peer BGP IP address from Step 2 with a /30 subnet mask. E.g., 169.254.1.2/30

   Open

   

6. Click OK.

7. Click Send Changes and Activate.