gcp-azure-ha-vpn

GCP-Azure HA VPN with BGP Terraform Configuration

This repository contains Terraform configuration to set up High Availability (HA) VPN tunnels with BGP dynamic routing between Google Cloud Platform (GCP) and Microsoft Azure.

Disclaimer: This interoperability Terraform configuration is designed to be minimal and straightforward, requiring minimal user input and automatically assigning public IPs. However, customers should validate its functionality by conducting their own tests.

Before you begin

1. Go through the steps to create GCP to Azure HA VPN Setup.
2. Review information about how dynamic routing works in Google Cloud.
3. Review information about how BGP works in Microsoft Azure.

Table of Contents

1. Terminology
2. Topology
3. Prerequisites
4. Assumptions
5. Authentication
6. Configuration
7. Usage
8. Outputs
9. Contributing

Terminology

• HA VPN: High Availability VPN is a GCP VPN offering that provides an SLA-backed managed VPN service.
• BGP: Border Gateway Protocol is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the internet.
• VPN Gateway: A virtual network gateway that sends encrypted traffic between your virtual network and your on-premises location across a public connection.
• VPN Tunnel: A secure, encrypted communication channel between two VPN gateways.
• Cloud Router: A GCP service that dynamically exchanges routes between your VPC and on-premises networks or other VPC networks.
• Local Network Gateway: A resource in Azure that represents your on-premises network and is used to configure the VPN connection.

Topology

GCP HA VPN Supports multiple topologies. This topology using with REDUNDANCY_TYPE of TWO_IPS_REDUNDANCY.

This configuration creates the following resources:

• GCP:
  • VPN Gateway
  • Two VPN tunnels for active-active configuration
  • Cloud Router with BGP enabled
• Azure:
  • VPN Gateway with two public IP addresses for active-active configuration
  • Two VPN connections
  • Two Local Network Gateway with BGP enabled

The GCP and Azure VPN gateways are connected with two VPN tunnels to provide an active-active HA configuration. BGP is used for dynamic routing between GCP and Azure.

Prerequisites

1. Install Terraform (v1.3+ is required).
2. Install Google Cloud SDK (optional, for authentication purposes).
3. Install Azure CLI (optional, for authentication purposes).

Assumptions

1. Required roles are assigned to respective user (who will run the Terraform code) on GCP and Azure.
2. VPC in GCP and VNET in Azure is already created.
3. GatewaySubnet in Azure VNET is already created.
4. Traffic is allowed on Azure NSG for Virtual Network Gateway.
5. Traffic is allowed on GCP Firewall for VPN.

Authentication

Use CLI or other methods to log in to GCP(gcloud) and Microsoft Azure(az cli).

Configuration

Update terraform.tfvars file in the same directory as the Terraform configuration files with the following variables:

Variable	Description	Required	Default
gcp_project_id	The GCP project ID	Yes
gcp_region	The GCP region	Yes
gcp_vpc_name	The GCP VPC name	Yes
gcp_router_name	The GCP VPN router name	Yes
gcp_bgp_asn	The GCP VPC Router ASN	Yes	65534
shared_secret	The shared secret for the VPN connection	Yes
azure_subscription_id	The Azure subscription ID	Yes
azure_vnet_name	The Azure VNET Name	Yes
azure_region	The Azure region	Yes
azure_resource_group	The Azure resource group	Yes
azure_bgp_asn	The Azure BGP ASN	Yes	65515
azure_vpn_sku	The Azure VPN Sku	Yes	VpnGw1
azure_vpn_allowed_az_skus	The Azure VPN Availability Zones Allowed SKUs	No	["VpnGw1AZ", "VpnGw2AZ", "VpnGw3AZ", "VpnGw4AZ", "VpnGw5AZ"]

Replace the values as per your need.

Usage

1. Initialize Terraform:

   terraform init

2. Plan and apply the Terraform configuration:

   terraform plan
   terraform apply

3. After the infrastructure is created, Terraform will output the GCP VPN Gateway IP, GCP VPN Tunnel Peer IPs, Azure VPN Gateway Public IPs, and Azure VPN Tunnel Peer IPs.

4. To clean up the resources, run:

   terraform destroy

Outputs

The following output variables are defined in output.tf:

• GCP VPN Gateway IP
• GCP VPN Tunnel Peer IPs
• Azure VPN Gateway Public IPs
• Azure VPN Tunnel Peer IPs

Contributing

If you have suggestions or improvements, feel free to submit a pull request or create an issue.