Question

You operate a production VPC connected to on-premises via HA VPN. Last week a tunnel went down for 40 minutes before anyone noticed, causing an outage. The network team wants to be paged immediately whenever any VPN tunnel loses its BGP session or drops. Using Google Cloud Observability, what is the most appropriate way to implement this proactive notification?

Accepted Answer

Create a Cloud Monitoring alerting policy on the VPN Gateway metric 'vpn.googleapis.com/tunnel_established' (and/or the BGP session state metric) with a notification channel that pages the on-call team.

Answer

Enable VPC Flow Logs on the subnets behind the VPN and build a Logs-based metric that counts dropped packets, then alert when the count exceeds zero.

Answer

Schedule a recurring Connectivity Test every 5 minutes against the on-premises endpoint and email the results to the team.

Answer

Enable Firewall Rules Logging on the VPN traffic and create a dashboard that the NOC reviews hourly for tunnel status.