Google Professional Cloud Network Engineer Question 656
Select 3Google Cloud PlatformYou are configuring a site-to-site IPSec VPN between your on-premises data center and a Google Cloud VPN gateway. During the setup, you notice that the VPN connection is not establishing. Which of the following configurations should you verify to troubleshoot the issue?
- A
The IKE version being used on both ends of the VPN connection matches
- B
The on-premises VPN gateway supports dynamic routing using BGP
- C
The firewall rules on Google Cloud allow UDP traffic on ports 500 and 4500
- D
The subnet ranges configured on both sides of the VPN do not overlap
- E
The VPN gateway on Google Cloud is configured as a high-availability (HA) gateway
Show answer and explanation
Correct answers: A, C, D
Explanation
To successfully establish a site-to-site IPSec VPN, certain configurations must be in place. The IKE version must match on both ends, firewall rules should allow the necessary ports for VPN traffic, and subnet ranges should not overlap to avoid routing conflicts. While BGP and HA configurations enhance functionality and reliability, they are not required for a basic VPN connection setup.
- A. Correct.
The IKE version must match on both ends for the IPSec VPN to establish. Mismatches in the IKE version (e.g., IKEv1 vs. IKEv2) will prevent the connection from being established.
- B. Incorrect.
While BGP is supported on Google Cloud for dynamic routing, it is not mandatory for setting up a basic site-to-site IPSec VPN. This is only a requirement if you are using dynamic routing.
- C. Correct.
Firewall rules must allow UDP traffic on ports 500 (for IKE) and 4500 (for IPSec NAT traversal). Without these rules, the VPN handshake and tunnel establishment will fail.
- D. Correct.
Overlapping subnet ranges on both sides of the VPN connection can cause routing issues, preventing the VPN from working properly.
- E. Incorrect.
Configuring a high-availability (HA) VPN gateway is recommended for redundancy, but it is not mandatory for establishing a basic IPSec VPN connection.