Not every organization can justify the cost and complexity of a physical Interconnect. Maybe your branch office is in a strip mall with no colocation facility within 200 miles. Maybe you need connectivity in five minutes, not five months. Or perhaps you are connecting to AWS or Azure, and there is no physical cable between you and Google. For all of these scenarios, there is Cloud VPN—an encrypted IPsec tunnel that runs over the public internet.
If Cloud Interconnect is a private bullet train, Cloud VPN is an armored truck driving on public roads. The roads are shared and sometimes congested, but the truck is impenetrable. Every single packet is encrypted with IPsec, and the setup takes minutes, not weeks.
The Evolution: Classic VPN is Dead
Historically, Google offered “Classic VPN.” It supported static routing, had a single external IP, and provided no SLA. Forget it exists. It is deprecated. The exam will only test you on HA VPN (High Availability VPN), which is the modern standard.
HA VPN: The 99.99% Architecture
HA VPN gives you a 99.99% availability SLA, but only if you configure it correctly. The architecture is specific:
- Google assigns two external IP addresses to your HA VPN gateway (Interface 0 and Interface 1).
- You must connect these to two interfaces on your peer gateway (your on-prem router, or an AWS/Azure VPN gateway).
- This creates a mesh of 2 or 4 tunnels, depending on the peer’s capabilities.
Why two interfaces? Because Google upgrades its fleet continuously. When Google needs to patch the software running Tunnel 0, it seamlessly keeps Tunnel 1 active. If you only configured one tunnel, your connection drops during maintenance.
The Brain: Cloud Router and BGP
HA VPN requires dynamic routing. You cannot use static routes with HA VPN. This means you must deploy a Cloud Router and configure BGP (Border Gateway Protocol).
The Cloud Router is not a physical device you SSH into. It is a control-plane process that manages BGP sessions on your behalf. It learns routes from your on-premises router, injects them into your VPC’s routing table, and advertises your VPC’s subnets back to on-premises.
The ASN Rule
Every BGP speaker needs an Autonomous System Number (ASN). Google’s default is 16550, or you can use a private ASN from the 64512–65534 range. The critical rule: you cannot use the same ASN on both sides. If you accidentally mirror ASNs, BGP detects a “loop” and silently drops the session.
Influencing Traffic: The MED Game
The exam loves scenarios where you have both a VPN and an Interconnect, or two VPNs to different regions, and you need to control which path traffic prefers. This is where you manipulate BGP using MED (Multi-Exit Discriminator).
How MED Works
- Lower MED is preferred. A route with MED
100beats MED200. - Cloud Router can advertise custom MED values to your on-premises router.
- Scenario: You set your Interconnect’s MED to
100and your VPN’s MED to200. Your on-prem router sends traffic via Interconnect during normal operation. If the Interconnect fails, it automatically falls back to VPN.
This is the “Active/Passive” failover pattern—one of the most commonly tested architectures on the PCNE exam.
The Ultimate Architecture: VPN over Interconnect
For organizations that need both the reliability of Interconnect and the encryption of VPN, there is a hybrid approach: HA VPN tunnels that use the Interconnect VLAN as their transport instead of the public internet.
- Layer 1: Physical Interconnect (fast, private, unencrypted).
- Layer 3: HA VPN tunnels configured on top of the Interconnect VLAN.
- Result: 99.99% SLA, massive bandwidth, and IPsec encryption.
This satisfies strict compliance requirements for healthcare (HIPAA) and finance (PCI-DSS) where “data in transit must be encrypted” is law.
Putting it Together: A Pro-Engineer View
Imagine you are connecting a startup’s single office in Bangalore to Google Cloud’s asia-south1 region. You don’t have colocation access, and your ISP gives you a standard 500 Mbps connection. You deploy an HA VPN gateway, create two tunnels to your on-prem pfSense firewall, configure BGP with a private ASN, and set MED values to prefer Tunnel 0. In twenty minutes, your developers have encrypted, private access to their GKE clusters. No hardware purchase, no carrier contract, no colocation visit. That is the beauty of Cloud VPN.
