Question

You configured an HA VPN gateway in Google Cloud with two tunnels to your on-premises router. The BGP sessions on Cloud Router remain in a non-established state, and the tunnel status shows 'First handshake' and never reaches 'Established'. You confirmed the on-premises firewall allows UDP 500 and UDP 4500, and the peer IP addresses are correct. What is the MOST likely cause and the correct action to take?

Accepted Answer

The IKE pre-shared key differs between the Cloud VPN tunnel and the on-premises device; reconfigure both ends to use an identical shared secret.

Answer

The Cloud Router ASN matches the on-premises ASN; change one side so the ASNs are different before the tunnel can come up.

Answer

The VLAN attachment for the HA VPN gateway was not created; create a VLAN attachment and associate it with the tunnels.

Answer

MED values on the advertised routes are equal; adjust route priorities so BGP can select a best path and establish the session.