• Cloud Edge Secure Access
• Welcome to SonicWall Cloud Edge!
• Prerequisites
• Installation
  • Accessing the Client Management Console
  • Installation Methods
• Networks
  • Understanding Networks
  • SDP Networks
  • Regions and Gateways
    • Adding a region
    • Adding a gateway
  • Connecting Infrastructure
    • Prerequisites
    • Site-to-Site Connections
    • IPsec Tunnel
    • WireGuard Connector
    • Connect On-Prem Resources
      • Firewalls
        • SonicWall
    • Connect Cloud Resources
      • Amazon AWS
        • AWS Virtual Gateway
        • AWS Transit Gateway
      • Alibaba Cloud
      • Microsoft Azure
      • Google Cloud Platform
      • Heroku Enterprise
      • IBM Cloud
      • Docker
• Groups and Members
  • Members
    • Inviting Members
    • Password Requirements
    • Managing Roles
  • Groups
    • Managing Groups
    • Identity Provider Groups
  • Identity Providers (IdP)
    • Integrate Identity Providers
    • Azure AD
      • Azure Active Directory (SAML 2.0)
      • Azure Active Directory
    • Google Suite
      • Google Services
      • Google Apps (SAML 2.0)
    • On-Premises Active Directory
    • SAML 2.0
      • Generic SAML
      • Active Directory Federation Services (ADFS)
      • Auth0
      • Okta
      • OneLogin
      • PingIdentity
      • JumpCloud
• Securing the Platform
  • Securing Networks
    • Segmenting Networks
    • Device Posture Check
    • Network Traffic Control
    • Firewall-as-a-Service
  • Securing User Access
    • Multi-Factor Authentication
      • MFA Authentication
      • DUO Security
    • Agent-less Access
      • Zero Trust Application
        • HTTP/HTTPS
        • RDP (Remote Desktop Protocol)
        • SSH (Secure Shell)
        • VNC (Virtual Network Computing)
      • Zero Trust Policies and Rules
    • Agent-based Access
      • SonicWall Agents
        • Downloading and Installation
      • Agents Configuration
        • User-Groups Policies
        • Managing Configurations
        • General Configurations
        • Network Configuration
        • OS-Specific Configurations
• Monitoring
  • Activity Tracking
    • Activities and Logs
    • Member Devices
  • Monitoring Dashboard
  • Integrations
    • Amazon S3
    • Azure Sentinel
    • Splunk Cloud
• Compliance
  • HIPAA
  • GDPR
  • SOC 2 Type 2
• SonicWall Support
  • About This Document

Google Cloud Platform

This article describes how to establish a Site-To-Site IPSEC VPN connection between Google Cloud Platform (GCP) and SonicWall Cloud Edge.

• Initial Google Cloud platform configuration
• SonicWall Cloud Edge Platform configurations
• Configuring the routing rules to the VPC network
• Allowing incoming connections from the SonicWall Cloud Edge local network using firewall rules

Please follow the steps below:

Initial Google Cloud platform configuration

GCP includes few steps throughout the configuration and needs to be applied for every VPC.

1. Create Virtual Private Gateway.

   1. Go to the Hybrid Connectivity in the Google Cloud Platform Console.

   2. Under the left menu go to VPN, select Cloud VPN Gateways, then create VPN Gateway.

      

      

   3. Select Classic VPN.

   4. Fill in the following information:

      

      • Name: Enter a name of your choice.
      • Network: Select default or a specific VPC.
      • Region: Preferably the region in which your resources lie.
      • IP Address: Create an IP address that will serve to connect your gateway.

      

2. Create a Tunnel

   1. Scroll to the lower part of the page. Fill in the following information:

      

      • Name: Enter a name of your choice.

      • Remote peer IP address: Enter your SonicWall Cloud Edge Gateway IP (to obtain this, open the SonicWall Cloud Edge Platform, and under Network select the network that contains the gateway to which you'd like to create a tunnel).

        

      • IKE Version: IKEv2

        

        • IKE pre-shared key: Select Generate and copy or choose a key of your own and write it down.
        • Routing options: Route-based
        • Remote network IP ranges: 10.255.0.0/16 (unless customized)
        • Select Done, then Create.

SonicWall Cloud Edge Platform configurations

1. Enter the SonicWall Cloud Edge Management Platform. Under the Networks tab in the left menu, select the name of the network in which you'd like to set the tunnel.

2. Locate the desired gateway, select the three-dotted menu (...), select Add Tunnel, and then IPSec Site-2-Site Tunnel.

   

3. Fill in the following information:

   

   • Name: Enter a name of your choice.
   • Shared Secret: Enter the same IKE pre-shared key you inserted or generated in the Google Cloud Console.
   • Public IP: Enter the VPN Gateway IP from the Google Cloud Console.

   • Remote Gateway Proposal Subnets: Select Specified Subnets. Copy the subnets of the regions where your resources are installed. This can be queried in the Google Cloud Console here:

     

4. Fill in the Advanced Settings:

   

   • IKE Version: V2
   • IKE Lifetime: 8h
   • Tunnel Lifetime: 1h
   • Dead Peer Detection Delay: 10s
   • Dead Peer Detection Timeout: 30s
   • Encryption(Phase 1): aes256
   • Encryption(Phase 2): aes256
   • Integrity (Phase 1): sha1
   • Integrity (Phase 2): sha1
   • Diffie-Hellman Groups (Phase 1): 2
   • Diffie-Hellman Groups (Phase 2): 2

Configuring the routing rules to the VPC network

1. Go to the VPC Network in the Google Cloud Platform Console. Under the left menu go to Routes.

   

2. Select Create Route Rule and fill in the following information:

   

   • Name: The name of the VPN gateway.
   • Network: The VPC network containing the instances that the VPN gateway will serve (should be the same network as selected in the previous steps).
   • Destination Network IP range: Specify 10.255.0.0/16 (or customized)
   • Priority: 1000
   • Next hop: Select Specify VPN Tunnel.
   • Next hop VPN tunnel: Select the VPN tunnel you created in the previous steps.
   • Select Create.

Allowing incoming connections from the local network using firewall rules

1. Go to the VPC Network in the Google Cloud Platform Console.

2. Under the left menu go to Firewall Rules.

   

3. Select Create Firewall Rule and fill in the following information:

   

   • Name: Enter a name of your choice.
   • Logs: Off
   • Network: The VPC network containing the instances the VPN gateway will serve (should be the same network as selected in the previous steps).
   • Priority: 1000
   • The direction of traffic should be Ingress.

   

   • Action on match: allow
   • Target tags: optional
   • Source filter: IP Ranges
   • Source IP ranges: 10.255.0.0/16 (unless customized)
   • Second source filter: none
   • Allowed protocols or ports: all