Google Professional Cloud Network Engineer Question 657
Select 4Google Cloud PlatformYour organization needs to establish a secure site-to-site connection between its on-premises data center and a Virtual Private Cloud (VPC) in Google Cloud. During the VPN setup, the on-premises administrator reports that the VPN connection is not coming up. Upon reviewing the configuration, you suspect the issue is related to the Phase 1 (IKE) or Phase 2 (ESP) settings. Which of the following configurations should you verify to ensure the VPN connection can be established successfully?
- A
That the IKE version is compatible on both sides of the VPN connection.
- B
That the on-premises gateway's NAT traversal (NAT-T) setting is disabled.
- C
That the pre-shared key (PSK) is identical on both the Google Cloud VPN gateway and the on-premises gateway.
- D
That the encryption, hash, and Diffie-Hellman group settings match between the two gateways.
- E
That the VPC subnets on Google Cloud and the on-premises subnets do not overlap.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
To configure a site-to-site IPSec VPN successfully, several factors must be aligned between the two endpoints. IKE version compatibility ensures proper negotiation during the initial phase. A matching pre-shared key guarantees secure authentication. Encryption, hash, and Diffie-Hellman group settings must also match to establish a secure connection. Lastly, avoiding overlapping subnets is crucial to ensure proper routing between the two networks. NAT traversal (NAT-T), however, is typically enabled when NAT is involved, and disabling it could cause the VPN to fail in such scenarios.
- A. Correct.
Correct: IKE version compatibility is crucial for the VPN connection to work. Google Cloud VPN supports IKEv1 and IKEv2, and both sides must use a compatible version.
- B. Incorrect.
Incorrect: NAT traversal (NAT-T) must be enabled if either gateway is behind NAT. Disabling NAT-T would cause the VPN connection to fail in most cases when NAT is involved.
- C. Correct.
Correct: The pre-shared key (PSK) is used for authentication during Phase 1 of the VPN setup. A mismatch in the PSK will cause the VPN connection to fail.
- D. Correct.
Correct: The encryption, hash, and Diffie-Hellman group settings must align between the two gateways for both Phase 1 and Phase 2 negotiations to succeed.
- E. Correct.
Correct: Overlapping subnets between the on-premises network and the Google Cloud VPC will cause routing conflicts, preventing a successful VPN connection.