Google Professional Cloud Network Engineer Question 662
Select 4Google Cloud PlatformYou are tasked with setting up a highly available VPN connection between your on-premises data center and your Google Cloud VPC. To ensure high availability, you configure two HA VPN gateways on Google Cloud. However, during testing, you notice that some traffic is not being routed correctly. Which of the following configurations are mandatory to ensure a fully functioning HA VPN setup in this scenario?
- A
Both HA VPN gateways should have two interfaces configured, each with its own external IP address.
- B
BGP must be configured on both sides of the VPN to exchange dynamic routes.
- C
Each HA VPN gateway must be associated with at least one Cloud Router.
- D
The same ASN (Autonomous System Number) must be used on both the on-premises side and the Google Cloud side.
- E
Firewall rules must be configured to allow ESP (IPsec), IKE (UDP 500), and NAT-T (UDP 4500) traffic.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To ensure a fully functioning HA VPN setup, each gateway must have two interfaces for redundancy, BGP must be used for dynamic routing, Cloud Router must be associated for route management, and firewall rules must allow the necessary protocols. The ASN does not need to be the same on both sides, so that option is not mandatory.
- A. Correct.
Correct: Each HA VPN gateway must have two interfaces (0 and 1), each with its own external IP address, to ensure high availability and redundancy.
- B. Correct.
Correct: Configuring BGP is necessary for dynamic routing, which is essential for exchanging route information between on-premises and Google Cloud.
- C. Correct.
Correct: Cloud Router is required to manage and propagate dynamic routes for HA VPN, ensuring proper routing of traffic.
- D. Incorrect.
Incorrect: The ASN does not need to be the same on both sides. Instead, they can be different, as long as they are properly configured to establish a BGP session.
- E. Correct.
Correct: Proper firewall rules are required to allow the traffic necessary for IPsec VPN connections to function (ESP, IKE, and NAT-T).