Question

Your company has deployed an HA VPN gateway in the us-central1 region connecting to a single on-premises peer device that supports BGP. You created one HA VPN gateway (two interfaces), two tunnels, and attached them to a single Cloud Router. Both BGP sessions are established and both tunnels are UP. However, you notice that traffic from Google Cloud to on-premises only uses one tunnel at a time; the second tunnel carries no egress traffic under normal conditions. You want Google Cloud to actively load-share egress traffic across both tunnels. What should you configure?

Accepted Answer

Advertise the same on-premises prefixes with identical MED values over both BGP sessions so the Cloud Router installs equal-cost multipath (ECMP) routes across both tunnels.

Answer

Create a second Cloud Router and move one tunnel's BGP session to it so each tunnel is managed independently.

Answer

Configure the on-premises peer to advertise the prefixes with different AS path lengths so both tunnels remain preferred.

Answer

Switch from HA VPN to Classic VPN, which supports policy-based routing across multiple tunnels.